njrat | hxxps://dropmefiles[.]net/ru/L7ZAE

Analysis

max time kernel
533s
max time network
518s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
04-01-2025 10:15

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://dropmefiles.net/ru/L7ZAE

Score

10^/10

njrat hacked google discovery evasion persistence phishing privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

hakim32.ddns.net:2000

127.0.0.1:5555

Mutex

7fff0ab4aad436543bdebc87a6cc7f15

Attributes

reg_key
7fff0ab4aad436543bdebc87a6cc7f15
splitter
|'|'|

Signatures

Detected google phishing page
phishing google
Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3904	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000\Control Panel\International\Geo\Nation	Server.exe

Executes dropped EXE 6 IoCs

pid	Process
324	Server.exe
5468	tmpA0C5.tmp.exe
6184	tmp6F0F.tmp.exe
6848	tmpC500.tmp.exe
6992	tmpD9B2.tmp.exe
6624	tmp1A75.tmp.bat

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	NjRat 0.7D Danger Edition.exe
File opened (read-only)	\??\F:	NjRat 0.7D Danger Edition.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\88d25e32-c494-44e6-b97f-85e4e8f298a0.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250104101536.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NjRat 0.7D Danger Edition.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ilasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC500.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
4740	taskkill.exe
940	taskkill.exe
6636	taskkill.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NjRat 0.7D Danger Edition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NjRat 0.7D Danger Edition.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1	NjRat 0.7D Danger Edition.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	NjRat 0.7D Danger Edition.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0	NjRat 0.7D Danger Edition.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6000	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4236	msedge.exe
4236	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe
5648	msedge.exe
5648	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
476	7zFM.exe
476	7zFM.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe
5468	tmpA0C5.tmp.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
476	7zFM.exe
324	Server.exe
5964	NjRat 0.7D Danger Edition.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1744	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1744	AUDIODG.EXE
Token: SeRestorePrivilege	476	7zFM.exe
Token: 35	476	7zFM.exe
Token: SeSecurityPrivilege	476	7zFM.exe
Token: SeDebugPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: SeDebugPrivilege	5468	tmpA0C5.tmp.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeCreatePagefilePrivilege	2684	explorer.exe
Token: SeShutdownPrivilege	2684	explorer.exe
Token: SeCreatePagefilePrivilege	2684	explorer.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: SeDebugPrivilege	940	taskkill.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: SeDebugPrivilege	6636	taskkill.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe
Token: 33	324	Server.exe
Token: SeIncBasePriorityPrivilege	324	Server.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
5964	NjRat 0.7D Danger Edition.exe
5964	NjRat 0.7D Danger Edition.exe
5964	NjRat 0.7D Danger Edition.exe
476	7zFM.exe
476	7zFM.exe
5964	NjRat 0.7D Danger Edition.exe
324	Server.exe
324	Server.exe
324	Server.exe
4236	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
5964	NjRat 0.7D Danger Edition.exe
5964	NjRat 0.7D Danger Edition.exe
5964	NjRat 0.7D Danger Edition.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5964	NjRat 0.7D Danger Edition.exe
5964	NjRat 0.7D Danger Edition.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3824	4236	msedge.exe	81
PID 4236 wrote to memory of 3824	4236	msedge.exe	81
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4432	4236	msedge.exe	82
PID 4236 wrote to memory of 4288	4236	msedge.exe	83
PID 4236 wrote to memory of 4288	4236	msedge.exe	83
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84
PID 4236 wrote to memory of 4720	4236	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://dropmefiles.net/ru/L7ZAE
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff605946f8,0x7fff60594708,0x7fff60594718
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff698d05460,0x7ff698d05470,0x7ff698d05480
    3⤵
    PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1000 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6408 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1144 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8496 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8660 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8328 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:6176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:6216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1224 /prefetch:1
  2⤵
  PID:6304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9632 /prefetch:1
  2⤵
  PID:6812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1
  2⤵
  PID:7088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8528 /prefetch:1
  2⤵
  PID:7004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8132 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:1
  2⤵
  PID:6912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8768 /prefetch:1
  2⤵
  PID:7112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7936 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8308 /prefetch:1
  2⤵
  PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8284 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10112 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10456 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10620 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1000 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=10636 /prefetch:8
  2⤵
  PID:7192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:1
  2⤵
  PID:7328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1792 /prefetch:1
  2⤵
  PID:7636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11024 /prefetch:1
  2⤵
  PID:7720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11188 /prefetch:1
  2⤵
  PID:7900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11372 /prefetch:1
  2⤵
  PID:7980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11568 /prefetch:1
  2⤵
  PID:7272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11740 /prefetch:1
  2⤵
  PID:7632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11888 /prefetch:1
  2⤵
  PID:8088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12076 /prefetch:1
  2⤵
  PID:8188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11704 /prefetch:1
  2⤵
  PID:7236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12244 /prefetch:1
  2⤵
  PID:8176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12192 /prefetch:1
  2⤵
  PID:8396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12220 /prefetch:1
  2⤵
  PID:8440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12224 /prefetch:1
  2⤵
  PID:8572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12640 /prefetch:1
  2⤵
  PID:8680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11516 /prefetch:1
  2⤵
  PID:8864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13156 /prefetch:1
  2⤵
  PID:9052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13344 /prefetch:1
  2⤵
  PID:8408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13528 /prefetch:1
  2⤵
  PID:8852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13672 /prefetch:1
  2⤵
  PID:9040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13792 /prefetch:1
  2⤵
  PID:9280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13980 /prefetch:1
  2⤵
  PID:9380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14184 /prefetch:1
  2⤵
  PID:9740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14160 /prefetch:1
  2⤵
  PID:9884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11144 /prefetch:1
  2⤵
  PID:9976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14600 /prefetch:1
  2⤵
  PID:10108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14768 /prefetch:1
  2⤵
  PID:10224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14900 /prefetch:1
  2⤵
  PID:9452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14904 /prefetch:1
  2⤵
  PID:9636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=15152 /prefetch:1
  2⤵
  PID:10216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=15296 /prefetch:1
  2⤵
  PID:10232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=15420 /prefetch:1
  2⤵
  PID:10372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13500 /prefetch:1
  2⤵
  PID:10528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=15488 /prefetch:1
  2⤵
  PID:10664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=15692 /prefetch:1
  2⤵
  PID:10720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,7280407114020835753,16239643863346015192,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=15720 /prefetch:8
  2⤵
  PID:10828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:396

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\de196c32-f03a-4e9b-a7b4-6a0366f6fa99_NjRat+0.7D+Danger+Edition.zip.a99\NjRat 0.7D Danger Edition\Settings.ini
1⤵
PID:5164

C:\Users\Admin\Downloads\NjRat+0.7D+Danger+Edition\NjRat 0.7D Danger Edition\NjRat 0.7D Danger Edition.exe
"C:\Users\Admin\Downloads\NjRat+0.7D+Danger+Edition\NjRat 0.7D Danger Edition\NjRat 0.7D Danger Edition.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5964
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\Admin\AppData\Local\Temp\stub.il" /output:"C:\Users\Admin\Downloads\NjRat+0.7D+Danger+Edition\NjRat 0.7D Danger Edition\Server.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5408

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x538 0x534
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\NjRat+0.7D+Danger+Edition\NjRat 0.7D Danger Edition\NjRat 0.7D Danger Edition.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:476
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOCD15AB99\version.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6000

C:\Users\Admin\Downloads\NjRat+0.7D+Danger+Edition\NjRat 0.7D Danger Edition\Server.exe
"C:\Users\Admin\Downloads\NjRat+0.7D+Danger+Edition\NjRat 0.7D Danger Edition\Server.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:324
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\Downloads\NjRat+0.7D+Danger+Edition\NjRat 0.7D Danger Edition\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3904
- C:\Users\Admin\AppData\Local\Temp\tmpA0C5.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA0C5.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x12c,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x14c,0x150,0x154,0x128,0x158,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x14c,0x150,0x154,0x128,0x158,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
    3⤵
    PID:5976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp84FC.tmp.BAT" "
  2⤵
  PID:6076
- - C:\Windows\SysWOW64\taskkill.exe
    TASKKILL /F /IM EXPLORER.EXE
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9190.tmp.BAT" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4824
- - C:\Windows\SysWOW64\taskkill.exe
    TASKKILL /F /IM EXPLORER.EXE
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp91D0.tmp.BAT" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6568
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:2808
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:6528
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6756
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:3676
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:4428
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:360
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:4676
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3808
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:5328
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:5520
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:1516
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:4612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:2168
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:5256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:4740
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:3640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:5388
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2140
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:5652
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:3280
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:1932
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3700
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:3560
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:1440
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:3424
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:5944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:5844
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:3156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:5616
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6592
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:6980
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:5888
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6968
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:7024
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:4104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:1228
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:7116
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:7156
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:6340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:6324
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:6452
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:6500
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:6556
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:6548
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:5952
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:2216
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:5396
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:2272
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:6580
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4152
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:4928
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:5856
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:6596
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:1488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:6528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBB03.tmp.BAT" "
  2⤵
  PID:4672
- - C:\Windows\SysWOW64\taskkill.exe
    TASKKILL /F /IM EXPLORER.EXE
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBB43.tmp.BAT" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2980
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:648
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:4832
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5652
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:2140
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1932
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:5896
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4224
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:3560
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:5332
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:5104
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:2424
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:2204
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:1904
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:6916
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:6972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:5884
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2320
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:7032
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:6048
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:2672
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6316
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:7144
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:6468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:7164
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:6424
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:6336
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:6428
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:5476
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:6432
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3160
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:228
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:6616
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:6564
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:6456
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6620
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:6736
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2040
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:6600
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:4952
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6624
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:5368
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:5912
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5068
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:4108
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:4816
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:1868
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:2288
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:5684
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:2436
- - C:\Windows\SysWOW64\net.exe
    net user Yougetdestoryed /ADD
    3⤵
    PID:4824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Yougetdestoryed /ADD
      4⤵
      PID:1164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE12B.tmp.BAT" "
  2⤵
  PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x14c,0x150,0x154,0x128,0x158,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:6920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:6316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:6324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x148,0x14c,0x150,0x124,0x154,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:7576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:7588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:7744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:7756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:7196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:7264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:7440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x150,0x154,0x158,0x12c,0x15c,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:7304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:7188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:8252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:8264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:8512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:8524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:8700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:8776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:8344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:8360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:9072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:8324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:9208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:8244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:9572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x150,0x154,0x158,0x120,0x15c,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:9616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:9824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x148,0x14c,0x150,0x124,0x154,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:9836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:9968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:9988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:9608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:9392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:9828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:9716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:10412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fff605946f8,0x7fff60594708,0x7fff60594718
      4⤵
      PID:10448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sambaporno.com/
    3⤵
    PID:10576
- C:\Users\Admin\AppData\Local\Temp\tmp6F0F.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6F0F.tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:6184
- C:\Users\Admin\AppData\Local\Temp\tmpC500.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpC500.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6848
- C:\Users\Admin\AppData\Local\Temp\tmpD9B2.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpD9B2.tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:6992
- C:\Users\Admin\AppData\Local\Temp\tmp1A75.tmp.bat
  "C:\Users\Admin\AppData\Local\Temp\tmp1A75.tmp.bat"
  2⤵
  - Executes dropped EXE
  PID:6624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  PID:7676
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7536

C:\Windows\explorer.exe
explorer.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\a46b7e869f7f4132a9701c5d358c39d9 /t 1624 /p 4236
1⤵
PID:10540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d57a449c855203411a38d5ae80bc24c

SHA1
b361032efa556fc4557bbad595ce89c4b0c13dba

SHA256
bb59bab10e406cd91bdfe4fc0e8ce2817a6ca32fc731ccb3f90b6b79c1a46c21

SHA512
8d4244dc9c0e9518cd71aacaa54d43c1e2d74519e3e692160b2b040d00aac25c4ba7a5705391e50957d46c8c711dc07604effea3bc06c8956ecf717f61008da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
77fe0ce7e1f9c9ec2f198ad2536bf753

SHA1
2a366472f227a24f3c0fba0af544676ea58438d7

SHA256
c69ca7653724e1e9e52518de8f4f030813e1431223d5b6ad3270531d8df89f00

SHA512
e8d4e17b93fb19364eeeffc5b1016fdbe566a8b8d702005291ff263367840b8ccc76290d8a3ad457d40fb5d1c2204bdaa5acba9374236c77935ebb0fe597a095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b85cb68afaa0d8799c2ca52837081a

SHA1
625beb796af60d315feada1271934d08e1a55442

SHA256
4483f93f107e9eca43c552d8d3d070572c249578fba12224b6df60d98dda7b5a

SHA512
5e8bbb8fbe83fe31c9fa0df1855c8cef9fd6ecf164f5d8bae9497f54858a95fe1f6228361953ef2b99063d204142046872991450c94540c913bf530521ce76ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
89KB

MD5
a73840570b2da15851ee734d5e4f0e68

SHA1
4ca3d95eaba39003cbbfd5cd8a874016ee4f1a0e

SHA256
f67290554e9a93a2b288bb28d2fa08476e04a012e8df4b94d882abee0fc1c5d8

SHA512
887531cb777b660f3d7feb7a69a3d6fa766d27de812364c0ba80c4ee808c9de110484e1db46a4df62ae9a82f0f1f80db6b814ed98bb0be22a17321d1be084cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
53KB

MD5
a6854d13c20c7451f358e49e3ae8e09d

SHA1
1ece3927996b15de7fa77c844bffb1b02c94b382

SHA256
4d4f9893a85f14af2240c56f15f1ec1617edefe46c0d23daf191d40c2ac6b273

SHA512
df02c4bf87af09d236ca51a4fc9e3f5f53603cf048dee13ac4fe17479b7b6964058b7bc21a0beb533aafee07235ef3abc30c496946c68bdc2f062a416c99f5f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
27KB

MD5
d54610da47dc44325ea76881d208e182

SHA1
a909191e9c5a5c7f77ca797b38b9d53d719214ed

SHA256
850966eab92437bfffdec5719f4cd5e1526c6f5da913aaaa8863aeee0204954d

SHA512
a80cf3457955a572db39794f66560087d9569c56efb97e339885e26ce15056e0df6891e0654169c8dff2fdbf7e029af1214705523ffe1796b935519012a42965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
134KB

MD5
8bfeec18f422da864c400cd702c85b1f

SHA1
18146d19584ec95461ce4b3ddc06417414e9ce46

SHA256
b6c525cdaf3be3361100fd0be1b82c3d0267fd5acecc049ffabe74cf02a6980a

SHA512
d0b2ba3316497e51831f13e1782bb1d7af13992be0a26d449f947c7bf7f531b8d10f273eae9981f14498cdd0a5e6cb52e593ab6a6f8c99a3094a226d5e8f2504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
34KB

MD5
251e37359a48e75c54bef2e965953a9c

SHA1
317e290c6bb52215a26e6add0a576b6469f29e43

SHA256
1316cb380f71fb6dcf937458c8a47e1b4cf771c832e3ba17c76793cb5470006e

SHA512
e9484f00adc78b0b6d371424702e49519719bf54a97700e3e86a1d40feec14be257cb261552b84c9da5dc5cc14a436d9823a41025547a11b866404b7a072eab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
64KB

MD5
4c77cd83fc6f505af839c5d72b66941a

SHA1
342af65df84465d5802867a1658a4ac2b146481d

SHA256
f410b70d0abb4f4abc8bab89b65737503e97ef32a195183fc2d7d38952a971a8

SHA512
fe06049d1571d0a09d453832adcdb92e2ebd3221b20368629e9d5be68f20e1ec1f9bfda25a9811624d423ca172b923cb35ba575f90dcfb37d49a22da54f4dbcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
16KB

MD5
56522c66937d677e091fe5b8296bc16e

SHA1
ffb310dd79981b405860c12c6c86dfcec19d9877

SHA256
fa73a867adde7047b5da33912b0fbf9d6a505120b75c7dc6606d82903299bf6b

SHA512
aa8eba9f695c724300fe4b1f8e354246dfede9cde5adfc116f98f59961fcad26e18f886237d9c8cc3746258e31d0b89833d21949b0b2b251a820b9a6afdf3968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
18KB

MD5
e3f024af78c6292a75bb7e727d9c5952

SHA1
15c12571e0299335554325c6a23d8a87be354844

SHA256
af0328462ab4a17d62e94efb4ee5abad981c43b6e6a9ba6361fbda17804cb450

SHA512
c465fa5715ba0ec4ccdc6de97126977626194e7a5fcde92b3f3a211364e2c52f7b50a3ffb20bd20b56c8e326abe3f7d29322186e20e799600d3d459c427fa132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
46KB

MD5
37913c50535cb8edf5f475efc084e09b

SHA1
ecc49dbc5c54c0b2e59a6334fa0396a35e30bb89

SHA256
3c5dd1187a8a8d0d1e9cc28d0bd9739355868ab25f474bcfaa14ae3bc45c3f65

SHA512
82af2c1b58083bc0e926838d3809e975699549e39bfef3707fa0aa1319a359458c4a69794b110118b27b1e79b08316b79a861c1a5122452d4a49bd365a7135d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
80KB

MD5
cdacd81430ad9c16e51bc6504691e82b

SHA1
fb675593ee633d383fc5df1cd012a084a490c342

SHA256
323ef270e34e3b7ff42efc0880b29c29781c40cbd0b144af995f1c3a1b2b486b

SHA512
16150690fd0b516fa3bef35d170df918d840914a3d9198e9f57af3cc4116704704f192cceec75fe2506a69a62f85d659301992083b2b2c5728629052dc8d7000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
26KB

MD5
d301a6de1dc815ae3947b51c41a4b2a1

SHA1
02ce565267c28ffa1c5ff202734060cfa8763b69

SHA256
7e47fc246822ae990fec966430e93ed395b6ba43c32fea13bba2ff0bb9dbfa96

SHA512
957fe572d5a2dd2bb798f92759fcec3035d4205c4b967788b2834af502918bb5e44818d14e05ea77688ba180ce315e6a8f0d757d53e14292157af9dd9b432a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
64KB

MD5
3838e74a4f3536ef4fbd00aac99df67d

SHA1
b2b3f6ccb7794b0b7fb83107fa24de50c4980ce6

SHA256
40f4936e4277422d20485a045962a81b75ca1f92ab6e4abe48a4ef3ba46d4fca

SHA512
e3b5aa48a69110d05d7b4c3ed3722c565c348cf4d11a23efc3fb33551220f74355c796cbb2e75ba349ce92c3c6c7029579b11aaff263855bd6986f3cd66e1c50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
73KB

MD5
bcfab19dc614a6c8ae3edb55555c5186

SHA1
59c929a45c5c24cbe54317b16fadcc86c0b1810a

SHA256
041ac07486e0b3b6a0debc68bd942f7015ed920c36b681d534201d1b9e09cdd6

SHA512
41d8adb525144d27dcec7329b309c9b289524a6c739f712da74a70cb722c83fdf2af832cf0d6fbb40fa4cc61459c9214ccedfa6b419e15f8453e912345553b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
21KB

MD5
3669e98b2ae9734d101d572190d0c90d

SHA1
5e36898bebc6b11d8e985173fd8b401dc1820852

SHA256
7061caa61b21e5e5c1419ae0dc8299142ba89c8169a2bd968b6de34a564f888a

SHA512
0c5f0190b0df4939c2555ec7053a24f5dae388a0936140d68ed720a70542b40aaf65c882f43eb1878704bea3bd18934de4b1aac57a92f89bbb4c67a51b983ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
20KB

MD5
c1164ab65ff7e42adb16975e59216b06

SHA1
ac7204effb50d0b350b1e362778460515f113ecc

SHA256
d7928d8f5536d503eb37c541b5ce813941694b71b0eb550250c7e4cbcb1babbb

SHA512
1f84a9d9d51ac92e8fb66b54d103986e5c8a1ca03f52a7d8cdf21b77eb9f466568b33821530e80366ce95900b20816e14a767b73043a0019de4a2f1a4ffd1509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
34KB

MD5
b63bcace3731e74f6c45002db72b2683

SHA1
99898168473775a18170adad4d313082da090976

SHA256
ea3a8425dcf06dbc9c9be0ccd2eb6381507dd5ac45e2a685b3a9b1b5d289d085

SHA512
d62d4dddb7ec61ef82d84f93f6303001ba78d16fd727090c9d8326a86ab270f926b338c8164c2721569485663da88b850c3a6452ccb8b3650c6fa5ce1ce0f140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
16KB

MD5
9978db669e49523b7adb3af80d561b1b

SHA1
7eb15d01e2afd057188741fad9ea1719bccc01ea

SHA256
4e57f4cf302186300f95c74144cbca9eb756c0a8313ebf32f8aba5c279dd059c

SHA512
04b216bd907c70ee2b96e513f7de56481388b577e6ccd67145a48178a605581fab715096cfb75d1bb336e6ad0060701d2a3680e9f38fe31e1573d5965f1e380a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
28KB

MD5
e41c15a7a70567c15d682d0bf2e1b8df

SHA1
4cb016d736bf45c4387d6140ea0137611f6efe5a

SHA256
633102fc849646e6626b905205eb136c5470e5f4d8b6bead1a05d3aca6fcb899

SHA512
87a32e019601988fcab97b3ecaf5ad7a5d72e36c37f70dfe665eb4f4c58898bf9c72eca3a4f4c0258cc59093899ffadfa0a12b7e2a2bb8e08fd2cdffccc65aeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
19KB

MD5
2a0e846e69daebeb5e9915a978ce610b

SHA1
b42df8ae6cc51450039d0b7176929a86b5f88779

SHA256
100e255fb398360bb933c47e5a7c6febb0a05d24a954a592d17d653a3baf0e04

SHA512
c9e13545ee42244991b6b7690505b2c9d0536ccbab14ffeab65848e8392b1ad15f6b4b3e3ba62256dcc2b99fb6fcfd04d8cd6574162579cf12a114e68edc2016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
21KB

MD5
ef31254e5ed0d95bc9e1a8721f7f78c1

SHA1
ea76360cf9dd76e22e5aaa6393901bbe08029511

SHA256
352af5d5f294d4cf563e510fd854ba8ff889f106a645f67ecf950e884990c2ed

SHA512
b9769e468486e4f6702f9a8b6d6b5e69b638140b49d8383530f94b7d44182eac899cf38d3e0bf717901c0dc1f3bfdfa4956dbb7e389b6d167f82afed152e0519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

Filesize
19KB

MD5
d7db6e2f2cca1d2902654ce70b3cd1c0

SHA1
c68c983ddd00573faa456f204b7258e61508c03a

SHA256
e5704c2c94731e857084cdb7a86efd27325c76aa063562949af9278947d50261

SHA512
b5326e2af6e9803465a77cba86677a2c195a115da8fc91e53124f4bd58d2b625c5c57f5242bba1fc375f8131337125dd15a05dee8889c9e9525bca4b0cee7071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
17KB

MD5
87e484d8f96b56a0b9747298a80d2750

SHA1
1b0d17bb0fccd4f0b913939131768d63a47708e5

SHA256
eb996754a85828c5e3f9f90d9969efe6dbaf7253376dbc9a421738a6d20e69ae

SHA512
0a2a1cac390a18ee69a9d0d8781b7f928d06889142a45267aa32c19669fcdc2ce43c2f5793c2f782fcd10d93c1a667fe2fa4a29dfea1063c8ce3e5d12ee75357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
16KB

MD5
f5b76a3a0e8db2768c3e8aae318ebddb

SHA1
652287394ab579a5d3ab477b5f92f75cb91b5d0d

SHA256
657a7d9a9c8ec4104556402e5509b195083400da1813b2554428e05cf99c7797

SHA512
03599bacb3fb787d3af8051349d4645d0a4ac03fd50df6ba8781157adee068eec66dbd83caa938b66310ada21b702218cac283bf706b536342f448a4128e9e5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
25KB

MD5
df5f960d709a99c283f16f91d0c28748

SHA1
0760791dcf87f88d2896de4e20e76a0a1674295b

SHA256
cc867518548c1a25c0a42744681a54c12d8e7e9501c1ef69530998f31708dcbd

SHA512
41d66d1c45e7f88bb2e352c6413dcb8509065272ab4518d2a2e93a2cdf3fe9834082e317e14035f2848ab0913ecc0ed429a30377e2e5a214ade4ae39ee2f7315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
73KB

MD5
f4264768b0be3fca5f16f0db1754ad21

SHA1
66b61df775e6445aba2e041360bbca2d196a6529

SHA256
68b6309462ff387ee8a04e7d199f4ccda7842074a7e3651713f35a4ed406aaa9

SHA512
f7d082309e1a2899c98a847cecf13a5f18997c1a1e5f8b554eaf2c4d23f78ad22170b74ff0bc153514e6b17d5ad241e63195d155f5e5a379b91351a139cec135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
23KB

MD5
46c44bee2bfd392834a0446740ffea67

SHA1
3739959a42421f14bef4ce69cef098ba938e080d

SHA256
b39745ed2b0384002d130166baf2207b825b433cc670829f8425a0c40ca58e1f

SHA512
304c9163c92c52a31487e20eaac21002170f558def415ce8b6e748133a285a8ba6e4cc65ec8e5cf80b247b3765d1927105a5007d7c67c243eb73698e5e50de54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

Filesize
21KB

MD5
eb29dce6bc7fd6e074734bb189dfe1d9

SHA1
1147a8706eda2b0f52179fe7b792f5dedc041aa5

SHA256
bccb83843cd519d7fb70bc9bf93907b057acc0eb07ab42a2ebc8a3c954b8d610

SHA512
aa84aa69f2cb2cb749ac7270b782dd2ab2e9af80a82a6fc1b9f5f00da39f6772af61fe1599bbf4fd0316a97b5baee2a4faa465a56a0068f53a68c40b741f59de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

Filesize
62KB

MD5
30a73a794d063147c6b25f96dfe1b525

SHA1
b6333bd17e347042c90b17b3bbfa3ee814cd03f3

SHA256
73e287f089973e4d963f5896a20589c6239fc6b896ba060fdd5932fc7160f14e

SHA512
f2a7de2e48e3656198effc44c7ba205d8a3f25e816ee62be21661b127ef7405371a413db34e064b4bb7e311983bb3cc5c01c60831c8d025a18e6500462c874a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
19KB

MD5
6fa08550bb13e3b24fc833cac5fa5ba7

SHA1
f98b9c8831d2496482d675d5c72a5d8044d49237

SHA256
e8a693478757a37d165e03969159cb8dba3285276fa460c6a9a7e3c425b84087

SHA512
56928908a8e781cab340727b8d525c8d111fe415ee13ec3e24392da3756e7ef0fbbf59519f8b7292f906cef74e51d52e6bb21a320a6f0bfeda5ab4a33d34ab10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
17KB

MD5
2a4c3b01508550da9001e7abceb7ef96

SHA1
fc9a9cca675063609f12ca828fa6c712e2bd3c12

SHA256
e38eae12c02acbbd28a7163d4d7bc1fe35ce350ed6c13893ddbfe4c25472bbff

SHA512
f59029db209538bcfa7af3e7584e17a52734d9e20ab407d2e1c01bc564665d25d6c1b04a4bec02ad790c1b03fb27f663ce65ea353a1b258c70d74d41f61b99d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
96KB

MD5
add020c7eb39321d940beb572c3d96aa

SHA1
4cf8ba381a7ed254d0c8fbdaaf54c1f9d95bac63

SHA256
ebb85d22c765ae59fbe4747d52b24a180b1d8c385ba5793bbcafc1b517f40ee3

SHA512
260e3a0ab854facf0b19a90187c7060a8558368e70dff9b7ee0a51679592341defe1375a84cba06140cf02cad5c5f0196518acfa8609f3a2c4b96e51f9aa4653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
24KB

MD5
064a0f9474ba45661394fc4981596248

SHA1
18b68335d64d280a1307072c1539782932676f18

SHA256
f6b5d7aefb74b459d1ec0778d8fd127ab83bf67528add2a005444f05c7ec6841

SHA512
0177060e0971d9c0b6cdb74ee17a580a8723e857876413ead22524bae676aaf926389a998be99d59b343c895a889caccb92c95f5837f5eb33ae60649d6d779fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
29KB

MD5
d5a7d3fb7f69edd05ed1e13496993a11

SHA1
830887ac971ef5994ae001cee5f947cd140f20a6

SHA256
8ca5f1a9c85251980490f75f51ccde293712ead8a2bbbc4aac5c0c438a9229a3

SHA512
a8b5075840d7234362f6a892329a772b19bd56f6771b490e5374a856e43caf4959319889a390cedbfd385521b96da697253aae3572e545407c9499f38b661a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
16KB

MD5
8f6145c30e5ba6c9cdc98765ebd41b86

SHA1
5c9bb7688cbdfa5b24c7bf39b41beac9b304c022

SHA256
9f10aa620000f29ee6172b54facd587b862b4962b035e3e52f90d680c2ec1ab0

SHA512
083afc0793ef3a20e92fc03d97aabeaa9110e6b5d17e0c84f314329527a9d8f186f9e23299e8c4a032bea05fc279c4963a329f41096806f5a73dc398b3ecad63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
18KB

MD5
e7e506105c3c2b9030ad78b5fff3519a

SHA1
b7493f54236e757c8544321dcd3ae98bc7e28a1e

SHA256
80a42184209065f3b5be307216c4c63d6b8ef87d510930b1474a82081e7d864d

SHA512
fabea6be2c4215d74fcfa28fc7d0c493ba1bc7103cfbffb5de6622f2d344b73cdaacce7f6b87dea4791983a40c568117d2a37a9e824b45807f93d0f66ded778a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004a

Filesize
19KB

MD5
301357610667362759b745bec1e30ea3

SHA1
9004edc42ead0804573a324ba0552cf5d0cece1b

SHA256
0d279c70bb1f413f4b813d3c442ca3be083f4218a37d959089e00062d704d768

SHA512
5e87e4392856cb75e8fe0af88de50c5456e60270b15edc076ac897b78a1cad3b65cd77603ff7fd88f2e82eedddf5079d7ab938783735b84bedc973c846a48965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
18KB

MD5
d610df58b31e6800c88dd1c20c7e3978

SHA1
8e1050ac43a3c8837bbbbb79d6a32ad9a113b9c2

SHA256
61841cea773e75691ef320eb74e5d3d53091d2aa8e3104e238f7e128d7e8a768

SHA512
8e254c85badb5e588761ae44a9cadb6bff43e63b1ace343df1df1e7cbaef9b9c6ebde1e2d57fba0fab59c54d1a181b4be60784e7e980f83537f37965ad536e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
25KB

MD5
8f04b9abf01fe95bdf93681082612ec4

SHA1
02b77706a099e37b281d0a95bb96476831526a5e

SHA256
6db86398c39385c1991f6cb948d3a776617d484707d835376ceabc8e9fe88ee4

SHA512
d70fd563f5b4c003775a8b99de3a4bb1677ed5dfe5b535f78a2272f8e405396e55e4d64a85f4a88fd449936012acba68174808e7d437dc4f75b91ca45b81f8a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
16KB

MD5
47c10613ecc83c525cf30bb3586e9228

SHA1
037ffd9bab4e6bf1f1840bfe9b327e93522f2104

SHA256
390f95662dc77095968033eef0b4efca01f7b978eb9f6580bad4b0401ec02eaa

SHA512
df13bbf51c92d7ff1e72da2e4959b0eeefff1dd691b34c896af30da868b7636330d4953b52d52833b9c8f24c09af397c69ba2c59e79665cdb782da5f30120ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
21KB

MD5
8e47c807e1d26fc00c0c1b93c12a5713

SHA1
140d6a9e9f0103005841e7c51fdf6ca476324550

SHA256
f5c0a6fe38a4a1451a46fc4fd1f9a0d799b2f167e5357de0d020d5cc105a8d49

SHA512
f3f7c8953e2abedc2ad778377bf0e349c87bf0a66029d47bdf3951f653ac635c5d993a50275517dea13292e3d406a2dca6ba9b7f71dacdbca7862dd34c590bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
16KB

MD5
3782285ed9fee62b751f49a8159b8601

SHA1
f6defe13d61014a414985139633a8474c53c606c

SHA256
c790bf1771aec00e7b86c8a582d1cf5f5f3b6cbafd7cecb4e398cd90298ed52a

SHA512
d59ee293282088b0672162f73f03bb67538243792e19b70ce144da38b5947a0998fb52912cdafd3fb666d3673e2eb459aff539240066e7d457c0fc592f688cda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000050

Filesize
20KB

MD5
9c16125b498d5778ba49baa5c4f122c5

SHA1
a8d801afbd09ad530ac46a666e302206942da2ab

SHA256
7bac51248c8d228d62c8aee34d5d24bd21c5f638aab2042bd101405a37da908a

SHA512
4aba5860fe43b9a3b4501fc4c37f63e88388a38f8c852703734b7832e3ac5e489ed03032414bdca8e480c7cf8b7147747cacca8a0fbbe40c4cb2dd4f338fec00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
18KB

MD5
a4ba435c13a009233868c12e05b5c242

SHA1
8e9bd2f6b380d041fe5e82936de4593444f87d47

SHA256
ec228eecbb9cdb6b331fca0adab73aaf34f2bb19884baa80010702c8517ef959

SHA512
7c49fdb16a6ad951c9d4b20ce702f0bdc70d7e9094fb5a1f20eef87e6590c16c1366ee21d376f1a7894f0af5737707d5da8dd1b6301fc2d56b939836e6ab658f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

Filesize
37KB

MD5
fad2677e5ed8935b670887ade12c35b3

SHA1
6c28ab6f49dab0ec1e8744b3e53bd68fc964cd20

SHA256
081c63c3cb1717ed833a37f5e62f5a13e094b14956d701bd21a510d9f56b404a

SHA512
c01c3acfb6b9ba81e19e9429521241fbb285c781f3904d3d24ac7435c96c4fc4f31017e20e204a74f8323ed73281c1f1f69aabefec63f840898cade28c31fdb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000053

Filesize
29KB

MD5
a216c166c3ac48c0477bc407ea7eee93

SHA1
5623d52551bfd37198973e5839f81ea96cf9b870

SHA256
9957230cff17f186a364aa130b09c6b936ded824aa0b88d1113d91b478697569

SHA512
fb475e85edfc7a39e080a4abb470ecb3477d1bf79e0f419741877217d593dc4770d2a852eaedec2df5e823db48dad6a5ce689fe12a4953fe178d37f19e1010f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054

Filesize
35KB

MD5
a867219aedec936543ef93749a82bdce

SHA1
0d06a2f1e9d46d7d04baba3856c622e90d260b19

SHA256
2522b4a8e365a429238c06787c010b2b8c741304963728c839b761c8e50b1094

SHA512
2d3b32c64c6f9511fec9d7f04e69c56ded48b18cf85f6a7381f420c14001f7172e27115b4e2e52e0744ad4da29c48aa9ce442c8a8746f64a7776fbaeaeb36458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
18KB

MD5
938a00af8575bff7bd66e22c0a6b9c23

SHA1
2b4b1f2a877800bc6545861742c99c1efe519ca5

SHA256
5f91eef2ce3baf76d075393615252e1bb787363930465da41fb87582eeca1de1

SHA512
33f1ca38a4e3099ddfe86d3c2587d2d9370b1bb7f1ba80900e8fc3958d195fc4716ca8a3e11ae52c6744226f3d37735c37a9c6b780b28918d2f1f093efb4addf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

Filesize
17KB

MD5
5316eaf80f074440c48be24377f9b091

SHA1
83847fca947cc7d92c48ae24b421a79e25d62a15

SHA256
a3c03e4ba8601a2bd6497bafb9b3eee52beae78e3f6b36da8c7c17edd7af1c2b

SHA512
58bf241d1e2758b14640ff425f4504e14bc673cc61423b92355b9aaf514e087dd30892bfee05f2ec7a634576dbdcab40b9a6a03f9b43a3cbc2e92aacf9836cab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0147da8bed5f0629_0

Filesize
3KB

MD5
46996f3936b5d720116490fa0f748575

SHA1
7ee653eccde2b04a703a01e9e11246e74c19dc70

SHA256
06c8b4b8c0aeafcde3f55d2211ad7f675925aaab49937a66765810dff5cc40b9

SHA512
5b00f41973eaf28e7b7397535426a5d67d25e745de7ced7082f8ddf3cafada8428e1911ba63ea468946451b3922671377070ee13b8790a7f7ce6089828be391c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0cf00afa223e3f59_0

Filesize
270B

MD5
fc2f75e715437d48a19e7fe79c9bfbf2

SHA1
81f711610b256cbd1053d62517f971dba0ff046b

SHA256
986825d20a9056301aee0194c8f8b64a2eb0e5c3cbe3117701c61b0cd26efb67

SHA512
1eef61f44304b2ca78b1fe49daf1bce19752870337fb68a6eb529747a56fecb123f68ccc3cf0fae07fbf20d38430c4d31233dbf75d3f11450c4b26857afd5e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\118d871aa2ee15fb_0

Filesize
281B

MD5
8e7b5d1f007ea4b333a9339542784e2b

SHA1
3672b4bf1a1ceb0c9ae19ad58f72f1f21ad98e6f

SHA256
aba0739039228b0953cab98ced301a9ecc34241864cd495aa675de09f2a05f1b

SHA512
74a9fb98ab71a34d03b47b4ae79586927552056c9c1f27feec7d12a757c58eeaad2c87e3b00472d2104f6262b73f8ebe1c275a69f5d1538c1669fed4fc95cd89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\12bb92749d957218_0

Filesize
148KB

MD5
c1318d7b98ffa70a9717cea371d47dc4

SHA1
24925e632e9c13658ba9c87b92d63d78eaabd685

SHA256
e8af84814cb10cbe8dc46df2afa3594031ecb5195d94f82d2b29407f179f5b8d

SHA512
7d46f510151f6a3170215542ab0f20bdaf14241e31f4b5595eb1d5af00f7bf85c769f51e400f64a82cb9502826e1a25ec89507462332f57bf30a39089d84aef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2040f2c2881eec6a_0

Filesize
16KB

MD5
bde31fa2ac8c04ee19e721e174d8106e

SHA1
de5d9a174a4e03e174d5ecfee195ffe5beb98fef

SHA256
281c8f246c7868ffdd74a6fe14997786479611bd8f0c4024fde593d420a0eece

SHA512
97e9b2c396175b3d4f32b651c37d75ca6e77770111ba0e6a2a6119d358e1e3363891c51c0bd4b29eda7ca44b0ca3d6baf17dbfd864aa1d706c7218a9ea721ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\22a27b2ee5c814f6_0

Filesize
281B

MD5
418a304612ae01524094b87443aa9949

SHA1
91922b7672cff01368179b0406c9eca18fd9dec5

SHA256
496f527d78d461b2a0172817a708ef8fab51a89ea09c1da3a84214f09460dcea

SHA512
4e0c44842a0b73b1e6010a8ab10f1895e9943718119a471018b9a7138aeb6925bd80b02fad5ccc51ad5328219f79309d4e59d0589d834971b092acd047f15171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2bef8463149a8601_0

Filesize
43KB

MD5
43fb2f4ba6ab95009f6f6549149c9ee0

SHA1
5e5887264fcaf9f72854b1536b1babd63937eea8

SHA256
19b49963082d5f04e713e15582ae1454201bf6bb22f5f850249ac120acc395cf

SHA512
581735ad650510daa049211236bedd17c81d42464de40008d0c6c7d7abf7d168eded6682f67625b58668519bb617c40ae4de98febad7fb4ef0887a23d2329c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\392195a0e6f0340c_0

Filesize
272B

MD5
1813e1a4ec24a5d5029781376149a36e

SHA1
c3491d73fe3b93462b9db5b54be40768ca26543f

SHA256
33e0bb1a32ebb62a8189ec4ee3a2d02cbb29ce9897dcc702fcb94b569b1a1f1e

SHA512
1929f8a3f26f38da4c158481dec828b217fd408a1c54a6ea9ef93269c4cfe1e695aeeee8bd0ff079bee99a229e748bff1c57fede6a05555fbc9fbcab1d6c2ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\39df74a4f38d6b34_0

Filesize
30KB

MD5
69e75175efa71c3f2110e10473668378

SHA1
8b82a890841237f9f2492ebdd1e0318ea786668d

SHA256
c692808416ade64b63c9dcaa8a2c0a22dc0669bd918659ffd16aac823f43dc9a

SHA512
38fb0b5b05e8cdb764ff6911f64620269c39f84e23d92107fbec9ffd3e4966254321b9e1ebb5fa30c3035634ea7621f9a78e8493020bc88e7338a98a5f3b6a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3eee372c14dc6458_0

Filesize
38KB

MD5
5c2f0e6c657eef73c96cdcd4c7d94313

SHA1
4396b716cb09e0b6202701877e38821ced5583b1

SHA256
1302399b081243ea8c594a0a384cc00a90488e0d0316666a245f016170bd698c

SHA512
9bc755f54cf805b43e06e26e444753e848ba946074dc2d4c95ba7199484aad9106d69d67eff81630152bc73f3cb0d64a872118acd3c7a6680a306bcc0d82e1d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\451eae9eef59d6a1_0

Filesize
6KB

MD5
d80d8744b0feb598c494f6b78d731d3c

SHA1
c6e177bd4c1f3bd6e25c962e8727e40f80e6948d

SHA256
41db33f9b2f9fe9a6a9d83f60c51fdf9bd78eb2e8f0109052af973ddc8ab5991

SHA512
44287ada81b430b4d863924eb56ca1b619ba44c2b90226d3e32f6e5442838b9b84cd8967cf75780d3110a3f23c64769b39a329a16e820522af7c7af03df1602b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\464659b2c96c91ca_0

Filesize
122KB

MD5
3c0093cd1c4d130af47123825bbab850

SHA1
780e5d89896c5329c50893df29a91b6de5ee122a

SHA256
9b5d0b2ef55e0ae6ea8ec8e6dfb65e5beea2202eae2cc2b36ca66c92db530b95

SHA512
a6d13b24ed6ccd5533b39c4e9e0219f517110e15f4b6720c5e672254c531f0fbfb93b898ff0e669fafbe662ddb3876c452756c20844bf2b5828d8c9fb9a97de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4b880b124cf62580_0

Filesize
270B

MD5
127593d4adb84b38295ed4f89732c13c

SHA1
8cc236bc4c7c387bee2f4dc80b083181b2634434

SHA256
61d55a007b3c6d659a595f89a834339166ffeebdd9fd84c42f31434791e378ba

SHA512
5d3845a5d7cde55a9273aac7e2c9f3c3dd3ecd2d43222459af668d57472ffbda67d2909d1fa2261a3bed7355d042cf46c74055a29a6693fd338e14d9cabb25a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e2e8991c649e897_0

Filesize
92KB

MD5
4e0291f1c2cde04d9e09bb5abe52c347

SHA1
f2feb95f8cced69846de38fdbcfedf6c189a7214

SHA256
3cf94f7de0c0e856660d88a60bacfffde10be37295f59ab9f925ebdd4bd66e4e

SHA512
53ad179734981c0ecf51cf64fdc41cc9668c0b1a16cd1e60780a0edab48ac3668b94af807384909b04a1962d3c0fd499b7db337719c6334a24ace2f0ceea3481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e892fa198808dad_0

Filesize
11KB

MD5
b965b7a03677ade7e25e7319ed48c7ae

SHA1
55c5efd6effff4d7c7ea9a0591b4251d8d51e36d

SHA256
f39102573dcb24c08db4c5af821d3de414b1ac6f5419ba2d293965c622cc1377

SHA512
ae64eb2c9012441e7af1b0e186a93e493f62eef48e91ae88ab92b1573aa3d41b4fb36da2e38b099749855e9458c0a5a03d8e768697f5ac9c8aaf633f02a29110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\517945dc3fb4aafd_0

Filesize
22KB

MD5
9caab13cb81915a9aba5e321b48ae981

SHA1
0c068b04e084ae7c3ed7d051c405f6c12e0c1361

SHA256
42405173186fb56bc9cf07ac99bb5e1c5ae09c6c3497a7dbb8f7bcd509d88393

SHA512
3bfafd085aa8185110e295a55d7df1eec383151ced6123f9afbaf08fb49ae3a337c540eba57f9b637c187425fbca517c65757b090f5ee79b82078eb351b1ba5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\57750dcd1420ca15_0

Filesize
20KB

MD5
06cd5d90640b0881ffe001b7cb07daa9

SHA1
c259620553253827133d5b98ada95d4c6b7eaed1

SHA256
6e7bb00e3eeddc4836fab7619421af26567f366e74be334383564434df9b9cb5

SHA512
fa998d07048220764063ddb36e27d332b9939588fe26285e563aa37cb2bae7d47f7f6bae523f98fc388f2caff80608c1a7b0b3c0ef4f25aa7410b4286bb91717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5abcbeb32bd44576_0

Filesize
172KB

MD5
6c5319044d93108a6922e782a6ca25e6

SHA1
961ad5f22be3ea8a3c1b8d603edbb9f7ab6a0d4e

SHA256
2be3a0a355d937349f374736e1e3c642b6cf148e3c9d2b9b2fac9884563a5736

SHA512
0afef1d552def4051d684c1f85c6742ef8382089a7030a41f1d96fa09480bf5c3e51a988e864d84d0c4de7e2838cf4e62d88fc793ce8e01e5a033d67b20cd139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b32e12ab57189b6_0

Filesize
2KB

MD5
5f3e5fb9bd4ff15e7b8e8b492a779fd7

SHA1
3f369b387861066c9c4c303ff9ba2c128b0573c0

SHA256
e6dd5e44b67ee56574ff9957e0434bbe090036b79464a36daf50deca960c59e1

SHA512
69bd6c05060aacd1b4f846043717837b1f797290412e631832719fd0b629fa34f9dec34545e68c961d88cf63a8a03b7ece34718229ff8e575723625eade34718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5cc0f163569954ca_0

Filesize
281B

MD5
00f310452a4a70714298016a2f488b1a

SHA1
9d77741f4c5e29075a0e5ea276a0df3d380576da

SHA256
69b1d9194c773efa3611fc94203e391b6b46c6a1d00552ce176154b09536c87f

SHA512
60025367612c3e96bfc0ee73d601f33efaf2fd887de552297187819ab17be024602ebd0db88688f193a1ea72f42c7cab1f8ca992fa93d14af10cba8037f8f956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6cd960aeffb38a59_0

Filesize
43KB

MD5
a9acf675064a9c0f11e0d03f87df4b1a

SHA1
fb528ddabee2af0b2b93b85c4be99e99af8116d2

SHA256
06877ffd14436b783257bd49bbe53afe1aa436ff7238074ca7284143065c447f

SHA512
b8a6c1b092e288cdf6c1da218b054ba46c56c223d0b78dbd977c18b987317345448c63686a814705d1f2d2a6fd886913cd7eeffeb9a176ab565163b326e2cd9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\808acc28afc4d268_0

Filesize
3KB

MD5
030c0d0a97281e601d194eb8e558e3fd

SHA1
af8ac1cf33c39c6b3e40841b32a32fbe0aed40cd

SHA256
f62212e10c3577a546d1685e42e477e57b6d78f967d25d76aa7ee58bbe77c3c4

SHA512
e5cadf31c5509db832fd6af9fc4fb907779f29dd823101ddf3fc77329833acd662c8d67d63c570ca45dd2373a3e7fc0e686093ca9588ef1023cf6ba78608d545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81cc758cf122624a_0

Filesize
270B

MD5
661e31251368147c1acca3791b3a3ec1

SHA1
88e04a5597b22b353a763525e7724e435787d967

SHA256
45611813536c49819576b9d77b4dfb55f2f1052bc95e030ef056567b8c79fcc9

SHA512
50149e55d8961ff14dae4e20099eabe606f8634e8933ddcec34e46e09f02f04e877d7828aee509b8f435718f6e52fb780b471484cf442f27d821e827ef2f7b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81f63725eddfceb8_0

Filesize
4KB

MD5
63eee7a32a9abe4409aaba73b86fe0bc

SHA1
4c0ee44b80eb6e4b3eba21804a1597ee50760a4b

SHA256
1f131c18f57232ec291defa0b83760a31dd5dfb6d952810cc936c7e8faebef31

SHA512
438949228687ac9e36b2f31ed5699acd04de0bd55f4190ad81154736ed98c90f670bca6af2d2c7b83b6a9cbc608b41f8c0a2dc794256500625571d63d6b2a89d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d787a53029bca6a_0

Filesize
270B

MD5
7220ea6ee99a6e9b1ec99a27ff7e3571

SHA1
b5184d98e706693d28d420fa955361bf61879934

SHA256
27e5ecdee52dd02388a45c0c12da9e7b6b352216e22be806276ee80a414984fb

SHA512
893170915205e82281f89941768e27a86ad5f5f5017437f9f66ce4214f354cb92ad567fac299c2e44109023436eedde43c99729fd60420e0df004a079bfa5bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8efd9d9ef8619aad_0

Filesize
278KB

MD5
d8e1d4e21e345e74b65e4d89d4b49e52

SHA1
067fee49a3fb8548c467efcd6cf8e00b0d04a424

SHA256
4618ee120f6b1d6fdb0d22925e31d5884ace437555e553c2a51c4c449f9c2f36

SHA512
bce23ade98394ff79c9af9eb6ad80c348eb6b65307da74b74bf98dd501c40b36df55c43597fbc687dbdb51e852696b1f2ea66d14d9ee16d92ac8b6b4fc150f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9239ac3332ec9927_0

Filesize
16KB

MD5
5f7e59fb426ee99346933558a2f192de

SHA1
11493d1ee3485c99022a2b0ac3294efbf7fd8d46

SHA256
96b578645181b7809109b6898445a7a7aae73c56bd41e8e610ce4d77f2fb381e

SHA512
8dc53ec5e74ff470747c88f2e3f28960fc344fe4942539f258c6b1c87fe79ac827870c5ecea3803dab0f7d730cbed88127b3032c8f5027ce1d1389d1daebc6a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9c411743a122cefb_0

Filesize
37KB

MD5
f75bcb9dadde2cdb64141bbc182ec60d

SHA1
1b1b5bbe494d158ceff9e0199c942e39b8e197b2

SHA256
b53adda3d30c1b20c79f3199f1fef8cb572eb965b95f5d577607be87f2bb1393

SHA512
91f58f9b8756eeebdf59833192109383c4e08ac9bfc9ed4e51af97b46860bd86f2fdcb0e5f12f991cff4dc0ecc419b5d800cfa5f5fd388d801a5df930102c424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a333cc2aa17e02a7_0

Filesize
10KB

MD5
ee6a95829d583558785d39b149b8a747

SHA1
786dbc014957bb4c6f27e87b2cfb31801cad0819

SHA256
563cabf263795cb99e074a15368a99c994bd6ef4366dc07aa1afd008345ce646

SHA512
f4104e117c8a185b77c601fec60a7e69760c1c5a036c8a1fb2d22fc650869afb7bb4f1e8cc1c4fa6dfe60b12f899a3d4646d7d27fca53e15b1e8de71ae68a8a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\abd5228fd9223124_0

Filesize
2KB

MD5
3fc70d21e839688884b6a358a4e876c7

SHA1
3f126ee958399ecd015cfc299e26a44441d7f407

SHA256
2e78e05cb365dfe345d06bfe1e9b2a255d325dc77cc939feb488b9edd36525ac

SHA512
15ed5d75b29992cdff7af126fd5fde90746b1682c903b37e4db14130cdd25450a53b411f5f40fd285d53a93288580515e0f85d4062a5077c1f748c08a6783a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ad3a41a5a89cc4b3_0

Filesize
24KB

MD5
188daa2919c7b63b2e9a05601a24f982

SHA1
0fd115f2f2bac0d0cdeabb6a16b6a1fb93cc4e65

SHA256
7dedcdeff6771479c1bfc9481b4a4ecad54db14edb400349eff7f49180ce1ee6

SHA512
90f439900bf0d138e7834a892efdc0fb6b1cca620e57711fd86f248b6369475657f2e4f94ad73e965ede12495931367dd1cbd450a11661501e62ee28cdd6afe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\adf2a3b7421f1223_0

Filesize
265B

MD5
6d47e15247053903e7df8e1389f641ad

SHA1
c5687971f3b7308e79f7bbe25b1a08bdfb11baa0

SHA256
4e065f118437ab0589c5657b5f6672d3436f03d096f20eaa2ca1051d988f392a

SHA512
72894d66fda928dda958217f4d6379170fbd9b4809235878756a4c62c4aefda57a9eed695b5794db78bd1c27bee851bdc8a81aadad6ff392038174f7303a3877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b6f7e155417a56f2_0

Filesize
67KB

MD5
4ec66004bd54a560311b067cfe055fab

SHA1
efb35904283ebd81bd51b4423bdc743f6a2a3051

SHA256
904ca5705d9566b2a3f3fbce852e4ae3375f88498e5529b928cdc0d96bd14011

SHA512
e9ab21ad5c0deacf1f0fafdb6b69e584771b35910565eaa7f7a40693f5377472320507b9081c5d29d71fda2f1c302686e6bc554bf5972368b812f253310589f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bcbd0c350c74579b_0

Filesize
53KB

MD5
fad07156e5e9511086664b3fb7a6f147

SHA1
096510d47c47b77ffaa08677923a44f73d766bc3

SHA256
9ada56c7180e007f58f4103239ada7017e88779ba06abb1fd4b680e101fa1d5f

SHA512
e2f0ea1b794fe759872f033846427a6a08065c93000abe8fa7d4504edc9581d89a469127dd0166685582a9e3374d9affc53f5831c93964528bee563a18f47cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c783724e274d0bcf_0

Filesize
100KB

MD5
570235a427a8e6807ba648b58dd3a875

SHA1
423215abb4495349da65e1479647e52c9db175af

SHA256
e18f6f14b54212c24d951e37751c7cb07f434be8c6e22cb4515d6db62e3a9127

SHA512
4866549b2865db209970fc7e267c59d841768fa23801f7ff59d7415880b89f9ce82baa3feaf7dda4f58f40b0fae9cd3333cef3e41504a1a7cf9285a8625f6b64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c869236842546b2f_0

Filesize
28KB

MD5
3e522c8a882dd87ca4fd1a8b04f60dba

SHA1
76ef9d6c8bce857ffeccf520a2d5dd5d27232a0b

SHA256
ee849163bf1fc5ccdc412f6fe1246d077583e354e8c3eed789d03dd28a8449c1

SHA512
d2910482503be7d5d81be58aa4c7e176b3f3683c46851f84852bf28e1561972872cb7fa8ac1d0aebd9eb7b5476b2ac5fff5a85effc99f1e3552024ad97edf4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cac262a2c37ed387_0

Filesize
34KB

MD5
575e2cfb8e2bd01f6a14e05a68356ff2

SHA1
8cd50c378379e330b89e7c1b2ef5ef2aa1b05f8c

SHA256
c0c3805f872bf76e31589cc7f482b4381eab87860c87bbbfe0562fe5cc94dde3

SHA512
3930b486812eea75e4e80f89d2f14f97f3cb1d45e2d9548f93b2bc309df751e1ac9bedd3769faba4924d8c0bb6ba73c9e538a3510d57f4607e688447dd8d1891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d0c9da78ad5e0d33_0

Filesize
4KB

MD5
f08c15f0f05836544d6a0f49304bb651

SHA1
8c6ab319d0fa29ca7ddf4e31426465e7e6ff004a

SHA256
e1c9c28bf81e75a1eb9f9c98ec2cedd1fb39c85aa418b42772696db278eb9d3e

SHA512
bde1ce0985c63e80217e5f9291e22f757c9914bc9208429ccbff1db4edee0fb22ad6b9edd2720fb98cc49b5c55ee98442f7ee53238fbac41739a2e5c70f2b2a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d55141128444d91d_0

Filesize
27KB

MD5
90ec65df64ce06f5b31eeb12f8cc01bc

SHA1
2d431ca6ee2bd320779b0a55d286cf4912eaccd3

SHA256
7680b4d25d46534ebdf6e5b6f51c03c11e42b06cb2f6d98719e0ebf7d4d243d9

SHA512
e0681ce21419253add8777ac8fcd79c16384170a4d12de245341bc0e85db1d885d1e2aa80425abbcc44793dfd4d2682023baa575553018a8ab03a5a1e11a858b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dba4dda3824ec30f_0

Filesize
80KB

MD5
fb3e1b447434a2d5f9e8afe2ffdb6757

SHA1
8cda2dfbfa7e41971218ab5daa976d3d688fbbb2

SHA256
c6c8cd162a137b028399c0646e15c3babad3ea0dbead61100dac5d2f9b65323b

SHA512
2432e083c5e3312ba4c120bb0c206d540930b4b19409009ae861db3050d6b7104b26abe3c23a8695feba3dff92032da4773a2518379461dfbc593e9e0346d2bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dbbe4f54499673a6_0

Filesize
54KB

MD5
b1e4aa94ce37e876086c2e8891eb117f

SHA1
7eea408bc494c8e376314ff39137eafc39fa20d4

SHA256
6c73586e638f9bfc678f03a9e19db0a69ad1d6ccf6076a5e5ea852e4c69ac315

SHA512
de75a55dd84d157bd36b86c4a3073d8fe296bcce2c13a81f6257493e1c112ede477e3ffa301fe4ed6e81ad870abebc8ad136c681963a036666da7c44dd43cee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dee287841b64a6da_0

Filesize
244KB

MD5
07c37b80e181e64bf9a6433d952a3a82

SHA1
0ea81dd712bb07368a7fc1fba73098cb88bbea05

SHA256
f3fb574d4698e1e7b7cfb9a7a1420e7c2862cdb8a5a12ed89486c9479dec7fbf

SHA512
a16c3d1487b8face615c28d2c695b95c07e0ba29bae532dc511cc5572f677f0566e4e8f12cd88ce0291af1d629e8aa150cc34809d2738e6baa009100b36326a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\defad20e90fa8fd0_0

Filesize
1KB

MD5
911f9e706ed6ca89958d7341843d28ab

SHA1
c0f4216d1a040e7f2554f73087a150475f7aa2ca

SHA256
09ffe13ed982f49289f0ebe90bff67afe926a5c557f0ac07562d7ccc64acdbdf

SHA512
13e2a85c2e7ade39b813fa892dbbc1830a091e4da09bd88947b2fadc9d29061b1918a77a571c586fcc9411aa57f7001a1e72ad88726875f1bb0930c4f105112c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e17145ffccf84fc9_0

Filesize
11KB

MD5
592acc4ead329637d2a4ddb9845b8e4d

SHA1
038c2bc997047d3da42275907b0c626e52a55519

SHA256
0a8f38f305ae772730e3adca6c5d5696a905a4f0d1952b268f619097e7645d1e

SHA512
57f12ebefcdf73ddc9c2f26a4a486a515f8ccd7d379df69b4a1e4f2c9d97b207acdef8ebd69b49d196624e604da939cb441bab3dcf6755f87472aa241d6922e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e3f9ab597478da96_0

Filesize
21KB

MD5
c191c1aaee9a7795d2d21d381d642d81

SHA1
230abe3b82d10347a615e89df06210b83f316b0e

SHA256
833d516931e746404ee0bf00ee4718c7cab935bf8e918f9d64726dac161b0788

SHA512
1f06414e1678d9da7c7a97261dffc5e1743246f0eb3ab37bf69292d2d531a45abd2b69a6c624e6995e4e71621489a9d60e2154301fbc37a98a06ce43fea8c644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e76467554fbe260e_0

Filesize
13KB

MD5
b2b56c35d764df734ae4cb6c0eb3f3c6

SHA1
2d1063c91e5149dfbce809d5b56f22145bd4ffdf

SHA256
da287744cdea9e506fcc86e30e604ff78eb5a9942f9f09d905deb5d618561222

SHA512
181e7f1015ba08c39ad9e775a23fe9283f55f87c861eaef0f48993df43a4fdbb59259d17d29960ba9032bdce64da8cb6af64814dcb6695866749f61334c806a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eb0c1057f7cc7455_0

Filesize
5KB

MD5
5d1b6bf2aff43a310a897f4a5a0099e3

SHA1
aaad3315a6c5f8ee9c3f3cf89f00b8e9caf4265f

SHA256
0c19fe0d75f4ab3e446e77e9fbf3ff5daa60c196bcc21a2b9e2af8fc85f77aa5

SHA512
abe5d99bb5d4d8ea64a554f1968b82fe9fc7d7d0be889ca76339f7ac95dc15d9c76e91a81a63d29ef05c5d53ab15b51be92b2519547eee76121f5a3809f9a290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
2844139a8238030461c087351fd47c76

SHA1
69ae4d4614968d6a11ce7e7912c8e74cf2b827a9

SHA256
77eac0cdcb43f706d98ed91d243e6c22eac1f223fba3efd43d073574d9b64c17

SHA512
4096e68a30cc249b2be55d7c4b50a17f34505e9615ab870e3ec6745ce25403a198b15b262dafca2c86f09b2ddc7e032142fd932283743f177f080fa1e8730982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
33366052961f865e5ac3f86a074f5de9

SHA1
d6883fa178d4d1d35e9502789a667fe0063781d7

SHA256
342e92ab62efccaac169453e38198ea726bec68e4949f640b66331f819a832bd

SHA512
70834b3c8fa09dc3a5ae840e8d680ca3015c4556175df609bb8d71f2e76b43be7a59b036c7f6bc23bf3c60623cc027e8a86506289fcec034f8af4e8534b5f98c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0af76d26af42e7b6573570715af8fb9f

SHA1
438c0fa3765167a19461ce218b1fcd01869f9bdc

SHA256
33e3d263a2fcfa6410e3447635059a3d84a03d0ff52741dba210de3a17964340

SHA512
8f979a980f95315c7ce904e7a5f9dbc1a6f36e434c3f682b28fb69250098a74056a29409d333126c903611fad9b69c0af58b05ed71fbaabc82610426ed9edca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d9d40f43e5715961eeebfb871a3637ce

SHA1
6db4c25f7f86825092de7bf2a7664bb4e981c439

SHA256
fe3cd2c78a6dd74618709b95c96252a657f2445759cad428013084f891e64427

SHA512
6e214ec3255893eb06d985c0dbe92bf083e8c74c644b698c4a93737131a77daf601f9e68065afbd41673c5aa36bda4b01001a6526224b0575ed3d69003b1596f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2a83c0bf8b062250487cb5e243544fca

SHA1
cd3bfd6ccc5446a9bcd62d281516e1eaa1029c86

SHA256
b3f2f3c9443be8b17eb3a2cff89320d842e52f02be2aa2b62ced93e72f81a4bd

SHA512
ea509f85cbe9689d76f14712a533434f2a7e95c83dae7968a0d42b538dbb14179c84d2d045d7b4f049e9c324035568baf9a8e8ffe25f6845c7dc1551e721ec11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
590a27a82ca8ef5202797a6b3e1c2ebe

SHA1
c7a877b0506a6f857beeb14d89e7b8103d9258f7

SHA256
033edc52eeeeefff2a0caab5d5888c1239d2ee54bd07cfc2a6140e998846d891

SHA512
9dee663eea492a7ce5252872b59a7da92d526652e9c5c9d782ae2a91965e7f7246ca9569f59bbc237377aeee18b7f2f783dba197e3b92a5f6440eba4c6e3845f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
09b003851fc23db6586f3044ca19634b

SHA1
1e22b383ee5228e923fab1245e4e95249acfee17

SHA256
bf6e5e013bb18702728f67847ad94cdb26b489f1daf54de9b958769e1a7b6d51

SHA512
8798259cfc0fd352dc090603cace1bc79cdcf42f83a4f777866edcb0e81114916a6991e404d0b6c3b2e5161628e7cad21b1800e0017ceedcdbe891f96f4b525d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58b987.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d8f403bba2d5883c7fc310df1ae0b340

SHA1
f74db7d6df3dc63175139a7d4b753d4329dc15f1

SHA256
fb27bfb2a7ac43f31a01aa4f18db3503769fea96b3a01ea77893737dd611816e

SHA512
b6b927ded2aa7e5abf0c39c2846cbbd795a38f12fcd6efa5f5f2ea87c0d970e657d2b45b1b3681bcf71a709a81ee5aa6b7765fa80f82a9e7737c44bffc9719b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5296eedb5d302340ab963f6f4e9e978b

SHA1
92c26fde446c780d36d89c1cebdec5f4c2e956fc

SHA256
b528b925c7f941984072a1b31723c4fbe40c7cf18e32ee93eec8f12bfd5f2d21

SHA512
1d2fa00d5f87f532387ecb4f2a8ce6fea28f43191afcc01a113f4a951bf53ed74b628ccbc7f77e35a009d962cc7713a35ecc9ce07226bccb89cc41d77d1c7bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b7aa972d6b7f71ecaf29f6de070ad2c9

SHA1
e14788a4a7f30ddfc1a78fb1f78e19b6b3b05d74

SHA256
1b283e6ee728cddf918550b86bae61ba4cd8a8c286c65eed796a5a6fe4428af6

SHA512
8cf8cad61b05ba284cbd5e4d2d1a5c9c89ebc0792dfb32bbc9344fcd62ac02d1cbda08fa82a69a3d91927a057a0cfdbecee0b7cb664f799676dfa61969ae6c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b6e4e7450d34f9a25fd6c4683cf31afa

SHA1
4b66814f5bf93a58c5ecf560ff77584039ff02f9

SHA256
74f0a5a785303a15c893d064e105caa39737f409dc9e9fe083a0524eba97886f

SHA512
be4b8802072b1e4b5483193d223ea9311d7bf6195f04755ce9dc34759bd0a1195de792140390f6419edb7bd5bf155e8871a30e9812a1a3f56c439a4544cb33df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0720ade8b544ebdca837d61ec663e0c8

SHA1
62c60bd8fd67cf549351e3937c195f05171f1b0f

SHA256
0ab762299d75439cd67ac09d30d84b0ddfc83c02637c7198e80d03843693a2e3

SHA512
d090bb488d884060079b5ac2f61806894f3db4a4b87624a2513d06deb2a7cad7462cd7c97a9db0b1011e8a561b468ac19ea351b39fad7737c0b478f7c2f48bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
831d8785963953419e4ccbe51a1ba0b6

SHA1
ea0bb976edad09a33e383956ece298bfc4044307

SHA256
923333c53a9a8a9cb044cd83829034b25a30f5f8efe73effb11371963374012f

SHA512
41b75877b24884ecab291a79047731a2b873850218c315b237ae3c64bbb3b2ce2853e3fa0c081491ba3e6cb831a9efa2b4c33c37f470e2bee4b47fc1bf5c6bdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b52931353c6f0f6352a5f90d29a03ca1

SHA1
c4c809df315b4a6e210bdc1f620b2a3825767e8a

SHA256
e164c69a6b669c0ac20040ae2b22f3b12a8c49c74f92c2da16afc0d0157e4ee6

SHA512
34e05e6b1f7c0c695e22e5099e07275e70aa26fbce32cdc1d9e50cef865fc66525d397467ca1fef3714fc5474511394cdadc43cfb848b9d387d6270d578e1da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
31c047fbdc1c782cfc8634e44a1dd530

SHA1
6660524c809b3370b3e2d8a2f9d8e3322ef4a9ef

SHA256
d5962254ff1e0d006bb0558d76ee3acc4e225b5b21718f7c80d00cfbbd717362

SHA512
307506181408674e0ae799fb2d6859df61d20ecb3a43d0a4976415bd1d08f38845878de6aac3016027c53f816cd4b8ff581bfdedd0bbc4a35e4807a067effb09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d74ddad06d2076a5ec03545913fdf06a

SHA1
8ee3e03aa12f59f7065632143efad182b7413afd

SHA256
a6f159c74e9dd7c540314fdc094a28690fdf3356a840a51176edb5702979b872

SHA512
e35b349e793f666ddd216464abc58febb52b58686178cc8fd8c0ff170b6880ec813d68ece56f6ee84afbed37ffbba13de8afa7e480ee85eeff3c8811f792bcdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
9b2345e425acf05ffaa1dee20d4fdbe7

SHA1
aecf86c5a5d24b77aea68f6bc99e7f42c9048bc3

SHA256
1eb6cc0eab0b222c1111dba69db74281366b9f5dc9f8707ff215b09155c58d14

SHA512
647fc97d693b709ef3b0877b6de1d4f9f4e1085d35b809d27360ede1be52b37f9a967fb80ce43be35d60b52409c7e4036376d7d931c96f0660a2eeffa58a8208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
77006dacd174a80aa9b867f95d5df337

SHA1
7078db638c72ee5cf4ede7911e4421cc4ae103c7

SHA256
5e22af33da2ed3f3197d9c899a8fec5e2716b54be019c484cd59960da8f143d9

SHA512
e8268ed24af38eaebda4cd864e5580ed1bb63e3e4b72a27fe3404baeb7c8c944a7e79282712ac9d0b33f0123654dedb1984633d6ae2a5b412d6536e2b0389bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7d7b7ae255e10403f2c4ad4c0a640f05

SHA1
6e78f57d586e41ed557536d29c655d6faeb1a4f6

SHA256
4ae282d60170732564273774bef2c308360c48bdf144edba5ceff08199454b76

SHA512
508d3f026460e3afb15a64998bedcf0ea87cec57971cee9a81668cbe3817622fc90b5052a7499d387d94aa63cfa752b01cf2fbd9a6a37a6325090eae6ff49475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ef46d93d1880417773bc3914c3e89997

SHA1
04bbc2a74767f65dbb5fb5a3b4d73f3bcca640ba

SHA256
91c195bd84fe85a9db95920773d95bf6ea2681f9f9825a1a031171f5a5924e85

SHA512
eddceb3979ca98f427286b597b23733bcd2b332c917247c110c8f097e8e6f2c695d518aca22006ba0883cfc3b5cfb8203f836a88705dd1ffea2aaa60322efb54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b32b8cd598ecd651c8404cf15c4399f

SHA1
5d57a0411daa516f27f52ea3c3f684a4d1f658ee

SHA256
f40d16bfb00c92d7ca6808bcdb32ec052ac0a741174461a28eb2c7d71994656e

SHA512
5bd1e727fdeb49434cb6e4f3e0d08c0bc48d217a553fce186db4fc552ef1ed77f15a365b8f434c354490155299f40b3ef6ffc59f1d583ce7c2cdecaf1638482c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
859d5cb200ca3178f4c86722806ff1ce

SHA1
22c3343aea41ac20de4dbd3e694307c4daedccca

SHA256
f5c22d22e85fbc509f4c76a72cf7d00a866a8658ab70a6c9f250574d79a855a5

SHA512
c07cb244fe4aaa434dbd65cf998c60d58b13de49d24f6ba044efd3e9b073f685db376891a403628b38b050c03ec81119681efb4985e480a5253227f1dbd5ea05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6d8aa5d6f15dbcf6902b81fa71127176

SHA1
fffd966cb7a6d0377275ac75bdf3c90d970f602b

SHA256
ed814cfbc918e84c58eb2960a564e4c69a81efdf3fdb361f3ecceb9fcbaf4d21

SHA512
152553cc7dd345c8b8478b75a1cedc15ec92aebd42f3cdb68377dee214110d7be78779ff33c317976242eee9cb2f96bd8330a89578e5f2b6a4348ff93a0ec079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
092407c16bcfaa0d6dffe5b1494ed649

SHA1
ce68ed286a0c7e642564c6d487708aecf27303be

SHA256
07e175fb0bc6cdd6c86e67e49cb51f37579b6489d68c1ce6f0c1b84983cedc82

SHA512
be496174ae671ba4c73f28f21fd796a344c66cd794b5f009e32601e8d55637a5d31cb799c245268cc03711b25bb0765201d98224d8629fa54d7e158e3479eb0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9f3639a163f09942584ee14063db9bc3

SHA1
14eae72060ee51d011e69991d1e8710bfb13b6ff

SHA256
65ef1c82d90eb49d26913c73fbac8e2f3b0c5a54a15d9da74ee722d6dd3bcd14

SHA512
a6cf805665d4ee40787b1a465d0e835bed18508b076cd637378aa608c9ea7ba38ae3c35ec50e5981e3fa6ee916ea3002d85a88d70a6be8c17541b15b180cd580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d22426ad237609aae18803d1bbd07bd9

SHA1
8d965063c747c66bfcc016e2ea919a3a66e3768e

SHA256
06b9497713b2de25fb4c27a9d3e2ebae1305765513673f533b48efacdbd27d2a

SHA512
d4e5e8767e00918bb68ce56a942237ceb83c0938c94621921b5cbb42371d59240d10ee3c934de4ef6dbf4fbd0512e9dc36deba1277fe40ea888de8881b8fdb18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3699ab27bb1fda22b3a1427b251150ef

SHA1
2bb370e6d3ba48ca21cdd16e725715d53dae0e4d

SHA256
2c2898d61b120067321e706cee8fa630c9bb289093b32cb480287ab469efb474

SHA512
d187e91fd23e0f7703fac05c58e5b32ab004982fbde08c7d5e8736c605ea049ca0d50a811e7abb70413a899820fa24808b30815ae96448e2245c373a8a2d8fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e60151992c5510e6c4141d3574a274d9

SHA1
0cb01c972d3573db790505afd104fa3c5acd4f0f

SHA256
24663090af5c04ab6ae365ae5dea1e4e79ed566f16e33f195d621b18fa9c9436

SHA512
01f1c33fb63fc0685ecbe95ac59d1eca6f0762539d7dd9a444e7a1f9d9d9cd78dff2e3a0eaba20392e4e3c1a6b3df40a35fa4872eb3cd0ac6fe1d1afebd64d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
818ca5d5b0392f4a52b9fe93bd98acac

SHA1
ccee0939020f1c26bf3a58a3875f05b31d26974c

SHA256
89998c369e8424b84af28bf62b7dfff40cb9d92d0e9af7742e1c2fef9dcbaeb7

SHA512
3e3e1157705e1d4893f099072adb70401b9a9bbbd3c48d9a6c9cc1283814458942b54258a442312b0a9afca8e1e1483802f41c52f0ee956295119c406154878c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
72779a11ed66a30dab8ebc23580bc715

SHA1
eba0c3536c265873682fa596e69bcd93d4d6d68f

SHA256
ae0e9631028490bd834c9d789b8ee888e23ec36a11eb2aff1d999164ceab8305

SHA512
5880670c1eb4e6f11042e3a7018e49cadd9ff9c38ca44282121ec095d0ba164277e972edc58fcfa862a93f87809f104ab868df6295e68e626f999650b2189fd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6d099b1dcc0d78e3934db409964b342d

SHA1
a6448634a2e42e90b965ead6a8c458060db124fd

SHA256
425e0313cb19670e25f5e05b66f1cc26a2cabf346293d73ff5c0bfc1b19e1826

SHA512
2df0311cf5d634464c90f4255fc3f1da9d3bdb6107111668292c67c808bd95a4884c23999bd7d5be03254104dabd9f5171a697d4eb0f39cbd2d199f1bb0a1f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581028.TMP

Filesize
705B

MD5
8479f2281aad0f5d863becdfcc9af90f

SHA1
7c3e8ad678bc074f8b435329076ef738788b0ffc

SHA256
45dfb6aceea3020a74ac0f93de994ce45e835ec164883662eeeb32a95cda7f70

SHA512
7131fb8c9846823d4ecedd3b24de3845de2c9d97c8a789065f88337b4b0efd0d8b5764f120c26d1f73eef883d18dc984ca9b66c3bf5fa46d638084dd988cdb59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
3ef6e5d546a7bfa47aad61e88d71fb45

SHA1
58c2881ce36877358cad17bdb317cb4ca9cd3877

SHA256
64cabac4b48e706650b5444a3698c97459ea9f43c962762e71602eca002ec5ef

SHA512
ee9c831f525838ed8ed6dbb3efc2890ac5da4a6281f5ae9e019408403ef9d86a94c14cf8228c9d96ae674b5de61dd0abde0cd88d145c10c072e618ee5959853e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3d554eb3e592ce9903b59832e06aafc9

SHA1
08a041e831ce273b157d99d432fc122e01e65d0b

SHA256
00c187cd5e2024b7bc5040cc174b6d9b8b3cb47d0c2104dbb7a53383da398281

SHA512
9f5867469453336be0d62e8b8fd9792bcee3c7cf6df5e0d0bae0fee384fde6a2cfb1951145c563d605846b8cff5178bcfe0168d91d45dea306cf127631460132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb2abc5582d89a3f0ef9a93ad90feee1

SHA1
b9b2e142f1d894d36b788d95ab5861522fdab4a0

SHA256
761742fa7f97fbf819e6ce62582758655f8bdaa2a8bb4961c3a31e1e4873812c

SHA512
8eb2c6fda3b6727aa682d4f0d1762faff59e8d548033c781d92333395e0be862e4c56650af8ad5cbfdaa9ab10a8334d7cbd3fcf0d405d63768e2cf9cbb57cbc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOCD15AB99\version.txt

Filesize
1KB

MD5
88d0b23373e388c3e9133d8dfed06c66

SHA1
be0b9bfc6ee4aac646fcd45aec8e4049279e3c8c

SHA256
28d93bfeb4b68fdcc7edda7c73a38ce90564bbc14cbfb23f8178467db56c1798

SHA512
ba283685ee3a9ce7ede67a2bdc0939b2379ee8ab9014c24257cc9c4421450714ff5b3832b98ca69e055c70f3e5d3675b07a79e83df1639975a9f72e8a74ad104

Download Submit
C:\Users\Admin\AppData\Local\Temp\stub.il

Filesize
1.2MB

MD5
632d26e17c9e043575288e04a7f3510a

SHA1
8d2b7d85ef949109a5e96150b3fb89324403eb15

SHA256
ce4ede33a9a7988f56e0ae345b87661d49502006374b36e010d2110f7f386c0a

SHA512
8cc403838fe79ddcd55749d83ca7cd7380930358394b5dde6b3938c84323f40a78746f1ba05f745b4baf0e5338509ddefe5d742314dee424bfea433a9b9446a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1A75.tmp.bat

Filesize
100KB

MD5
6032ce8ceea46af873b78c1f323547da

SHA1
8c5bd4a70e0f21aeba41c07976ace2919b64fd80

SHA256
19dc8c66d04d1a1d781e59107e2a1db5fd6288761c9dfd0c6909e533e79d04e7

SHA512
3ada1663cb730f43b44e32ceade5d0b9cae20d1c20001691a1d226d99c82510e001581f67f5131d6c21e0e0cf98e5089c3d0f22a6a1e3347053ed73304ccc6fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6F0F.tmp.exe

Filesize
61KB

MD5
f4407493019fe05f34b074539519ebc4

SHA1
b3f5ff69ff4fee493440c133f033a0d05a6edd43

SHA256
a5c1bdc7b8c0e456edac031568c8acca0524eeec7e91977d63c41c0a82c608c5

SHA512
24668bd17617e038544ed5cc92385cba01ec1b70725930457a5deb6f4ef1a079e3af8d7f592dad851fb1685387daaf47cc02a6c406042dc7ec1f406d2ab3bfc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp84FC.tmp.BAT

Filesize
60B

MD5
94070806e01c1ae7fe2aae46d929387a

SHA1
0fcd747b0fd81b01ea54fbd849388b6e49ff1698

SHA256
4f553023c9fdfea5f806c86d6bdd40d94348843d4a4efd91dc952a53229a4358

SHA512
1334b73fadeb074ea1f31f379bb76f4274af5ddfc48a5c28139e766202c373a8b25e0ba2105537673bdf5de9df625dcbd870ef0b8a4506f9674c88bcd2595e08

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp91D0.tmp.BAT

Filesize
923B

MD5
456c3e1669d900ebe41355349deb28e0

SHA1
57d3afa70c9cff74b74366fb6d34bc57cf01312a

SHA256
e4125f396993ea0876f3ffa9bffc46134dd20d7c8e4d077ddadee67b6ca33abe

SHA512
7300fa661115e8606a766093698ee5c760162293d65216a26ba54fc83cf866bcc16da6e84aa304c917106eb94c0f5cce5c95b1d0fb1ee2dc1c1b2f0c631d02df

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA0C5.tmp.exe

Filesize
29KB

MD5
2407032a11e906cb7eb171d4e8256992

SHA1
f6dfc9b6632435136167a16f8a5b23fa624246aa

SHA256
b9347d22eab0264a0253aebcfb735ea687453fc85d9a906933673017abe4285e

SHA512
55bed6d2c026c2f29a13f9d17e9c3d0594158cd8caab8a8fe9dd6fdbc5816efddf2c006489c062b7c191d5f6b40541f7d51d58da0353f5c9853162b13c8b325b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC500.tmp.exe

Filesize
28KB

MD5
6c2210ba180f0e1b9d831c3c6c14c8b4

SHA1
00bebdf704f4cabf254583c6ad87c6e72872b61a

SHA256
501c36ac282029ccf7950a4957d4c10ea72fe18f0ad8d6daeabfe628fa4070a7

SHA512
26a63ad05199cf45acd7519fbc63945097b4c4a89bb2cdfa4f87ba004e1ce106220b0b99419e656de26d164265b3868a9ce541c71b05d4e4db1a9a1343130e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD9B2.tmp.exe

Filesize
29KB

MD5
685c1eade930e2b40f02f98328fca44d

SHA1
e42f950e1dbed069d7c337c9ff09f55fb90afdf6

SHA256
ec85087f6830b71f106871c59dc8ffa0de91cc3d8ce8c269b7264359d9b4e80b

SHA512
aceb433536f6f8f684219c2d62b64604175d1eb8fb0c3d0aba819c81b6793f2f96b2c8b13d7311f7513234d8d9e62dbb61750156d9ee8d8fdfdb7b5ec69262fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE12B.tmp.BAT

Filesize
83B

MD5
cc795c9c4a83aa1ede067f96f1eb8d15

SHA1
32b8e1c43787353f7d87514e279288aff5f7d4f6

SHA256
37d23694738615464be8a3234bcc59592987432c8863db67e30385b8bb3ef450

SHA512
ec0b8f6600b2b0443ea6f271fcf16804e380b6f51f3f74997dc5c53ed28ece8ece58a12686b451532ed31941a67fa075305314fba7fa8555a7fb8cf6424c6fc5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
8a5523122da57162bf93526ab87297b5

SHA1
f46b34a014551e64c2fa0a30a89edf103d35a0f9

SHA256
d09e0ca925a5e34af04a031b8538d79df1af6faff8195b6b537fa5c54f9034b1

SHA512
070fb802acd1eb257dfc7714e916b3d0a2668a01244633503d2b229a040c6e8a13ccb8fb1d2bb7303443cd87b0aaecb144335f5208c4144195b25c0e06fb7db9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
3fce0f4a453b2322f5b3ece0bd7cea23

SHA1
6342ec76046d5035bad9cbf7c0774a1630431761

SHA256
20da2a40c6d44c09aa94908ce2bae15f218ab1358de6291e7fbe06a54ce0f831

SHA512
2849fcf900128cebb5b9c3b69442cb91c49e55f434c7948969c426f3eae31f5a62840ffac8b1b3b323683f79856b98fc59fc9031f19c49295da4c3bb2c03abdf

Download Submit
C:\Users\Admin\Downloads\NjRat+0.7D+Danger+Edition.zip

Filesize
15.8MB

MD5
50078221b0d66813006e1a43319c400e

SHA1
35bfced1a10926e013bba00dbf794d30adf88212

SHA256
b632def9037b551e1ee90fb321e87cfbc2e15537c78f0749ce7e8eed15b07562

SHA512
26bf9d0c901e806139040fe14093ffbb076f0cc990527b90603b488d6225951db59858a0ed45d47e9c9dacc756d1577542a525449d395d6d5e539cabde944360

Download Submit
C:\Users\Admin\Downloads\NjRat+0.7D+Danger+Edition\NjRat 0.7D Danger Edition\Server.exe

Filesize
93KB

MD5
75b170e17862394b0648b062253129ae

SHA1
c576cc9f2a003692f52975722706ee0888d0ed12

SHA256
0a780250816c6943cbc9f4ce24f563cce9c7d179810d6bdce78ec9f5f5705d6a

SHA512
04f7c217c7dbc54731d8310f8ddf899d438e3b3dc8bc9d390d59091d8257914fb775d8d4925825b78464acffc64e532b7cebb9fa4972f5dfc2123a2dd0f29f46

Download Submit
memory/5468-697-0x0000000004B10000-0x0000000004BA2000-memory.dmp

Filesize
584KB

Download
memory/5468-696-0x00000000050C0000-0x0000000005666000-memory.dmp

Filesize
5.6MB

Download
memory/5468-698-0x0000000004A60000-0x0000000004A6A000-memory.dmp

Filesize
40KB

Download
memory/5468-694-0x0000000000060000-0x000000000006E000-memory.dmp

Filesize
56KB

Download
memory/5468-699-0x0000000004C10000-0x0000000004C66000-memory.dmp

Filesize
344KB

Download
memory/5468-695-0x0000000004A70000-0x0000000004B0C000-memory.dmp

Filesize
624KB

Download
memory/6184-2744-0x000000001C300000-0x000000001C7CE000-memory.dmp

Filesize
4.8MB

Download
memory/6184-2747-0x000000001CB80000-0x000000001CBCC000-memory.dmp

Filesize
304KB

Download
memory/6184-2746-0x000000001BC90000-0x000000001BC98000-memory.dmp

Filesize
32KB

Download
memory/6184-2745-0x000000001C920000-0x000000001C9BC000-memory.dmp

Filesize
624KB

Download
memory/6184-2743-0x000000001BD80000-0x000000001BE26000-memory.dmp

Filesize
664KB

Download
memory/6624-2780-0x00000000008B0000-0x00000000008D0000-memory.dmp

Filesize
128KB

Download
memory/6848-2760-0x0000000000CD0000-0x0000000000CDE000-memory.dmp

Filesize
56KB

Download
memory/6992-2773-0x0000000000DD0000-0x0000000000DDE000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads