Resubmissions

06-01-2025 21:59

250106-1wb9wazkay 10

06-01-2025 21:55

250106-1s9qzayrhx 10

Analysis

  • max time kernel
    995s
  • max time network
    955s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-01-2025 21:59

General

  • Target

    Vbuck GEN.exe

  • Size

    78KB

  • MD5

    19bb02eb4df10edd6af6822a847263dc

  • SHA1

    eef31717a1cedf4ad3628092f2cc0074ad9d5b8e

  • SHA256

    783d046079b0d891a7cceee54a03e292efd2eb5941e90a268a0a6331c9805d03

  • SHA512

    4d523d09af36bc0c24e68c9a093cc51ce44aca766ad228cac8706c34b506fcd438efc6a2d4f2dafde0872d78df0c34e64cfc8548742af913d1864c29562486e0

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMyNTU1MjM5MjUxNDY5OTM4Ng.GSsXF0.2F-rPvyxUMTADJXbj04XJt8RzF459DH9mdIDiA

  • server_id

    1325554226285379708

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Discordrat family
  • Downloads MZ/PE file
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 25 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 52 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vbuck GEN.exe
    "C:\Users\Admin\AppData\Local\Temp\Vbuck GEN.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5072
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3392
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff6f8846f8,0x7fff6f884708,0x7fff6f884718
      2⤵
        PID:3196
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        2⤵
          PID:1544
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2576
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
          2⤵
            PID:1460
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
            2⤵
              PID:4420
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
              2⤵
                PID:1996
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
                2⤵
                  PID:1076
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
                  2⤵
                    PID:4368
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 /prefetch:8
                    2⤵
                      PID:1712
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5012
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                      2⤵
                        PID:4792
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
                        2⤵
                          PID:1464
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
                          2⤵
                            PID:2432
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:724
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                            2⤵
                              PID:1656
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
                              2⤵
                                PID:1256
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                                2⤵
                                  PID:4848
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5752 /prefetch:8
                                  2⤵
                                    PID:3504
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6124 /prefetch:8
                                    2⤵
                                      PID:1100
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
                                      2⤵
                                        PID:4596
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3204
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                                        2⤵
                                          PID:1528
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
                                          2⤵
                                            PID:3280
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
                                            2⤵
                                              PID:264
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
                                              2⤵
                                                PID:2328
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
                                                2⤵
                                                  PID:2772
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
                                                  2⤵
                                                    PID:4700
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                                                    2⤵
                                                      PID:1568
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
                                                      2⤵
                                                        PID:4944
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
                                                        2⤵
                                                          PID:388
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
                                                          2⤵
                                                            PID:3284
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5944 /prefetch:8
                                                            2⤵
                                                              PID:2640
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
                                                              2⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1124
                                                            • C:\Users\Admin\Downloads\winrar-x64-701.exe
                                                              "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:4880
                                                            • C:\Users\Admin\Downloads\winrar-x64-701.exe
                                                              "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5108
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
                                                              2⤵
                                                                PID:2564
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
                                                                2⤵
                                                                  PID:232
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
                                                                  2⤵
                                                                    PID:2500
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
                                                                    2⤵
                                                                      PID:3972
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
                                                                      2⤵
                                                                        PID:4272
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
                                                                        2⤵
                                                                          PID:3352
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                                                                          2⤵
                                                                            PID:1348
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
                                                                            2⤵
                                                                              PID:5000
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
                                                                              2⤵
                                                                                PID:4304
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
                                                                                2⤵
                                                                                  PID:3024
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:1
                                                                                  2⤵
                                                                                    PID:832
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8024 /prefetch:1
                                                                                    2⤵
                                                                                      PID:4836
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
                                                                                      2⤵
                                                                                        PID:3064
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
                                                                                        2⤵
                                                                                          PID:1912
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7812 /prefetch:1
                                                                                          2⤵
                                                                                            PID:4876
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:1
                                                                                            2⤵
                                                                                              PID:3428
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:1
                                                                                              2⤵
                                                                                                PID:2620
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8504 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:1252
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8872 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:3048
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8968 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:3356
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8976 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:4152
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9336 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:5232
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9356 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:5240
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9364 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5248
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9068 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:5672
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9204 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:5680
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9116 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:5688
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:3064
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:5180
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9180 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:6008
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:4780
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9092 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:3684
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:1088
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9100 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                  PID:2004
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7196 /prefetch:8
                                                                                                                                  2⤵
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  PID:5364
                                                                                                                                • C:\Users\Admin\Downloads\7z2409-x64.exe
                                                                                                                                  "C:\Users\Admin\Downloads\7z2409-x64.exe"
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:4688
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:5312
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13148736550005386621,465838366333708383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:3828
                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                    1⤵
                                                                                                                                      PID:544
                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:4636
                                                                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                        C:\Windows\system32\AUDIODG.EXE 0x308 0x2f8
                                                                                                                                        1⤵
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:3084
                                                                                                                                      • C:\Windows\system32\OpenWith.exe
                                                                                                                                        C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                        1⤵
                                                                                                                                        • Modifies registry class
                                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:1116
                                                                                                                                      • C:\Windows\system32\werfault.exe
                                                                                                                                        werfault.exe /h /shared Global\135ed089f7734ebe97ec87945a0578c2 /t 3088 /p 4880
                                                                                                                                        1⤵
                                                                                                                                          PID:2320
                                                                                                                                        • C:\Windows\system32\werfault.exe
                                                                                                                                          werfault.exe /h /shared Global\76871ab329034aa2973d22f00345cf2d /t 1704 /p 5108
                                                                                                                                          1⤵
                                                                                                                                            PID:4048
                                                                                                                                          • C:\Windows\system32\OpenWith.exe
                                                                                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:2020
                                                                                                                                          • C:\Program Files\7-Zip\7zFM.exe
                                                                                                                                            "C:\Program Files\7-Zip\7zFM.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:3972
                                                                                                                                          • C:\Program Files\7-Zip\7zFM.exe
                                                                                                                                            "C:\Program Files\7-Zip\7zFM.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            PID:5960
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2028
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:5236
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1832
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:5916
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:4696
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:660
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:4908
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:5248
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:6088
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:6044
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2628
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:5528
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2692
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:3724
                                                                                                                                          • C:\Users\Admin\Desktop\Vbuck GEN.exe
                                                                                                                                            "C:\Users\Admin\Desktop\Vbuck GEN.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2264

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                            Filesize

                                                                                                                                            152B

                                                                                                                                            MD5

                                                                                                                                            34d2c4f40f47672ecdf6f66fea242f4a

                                                                                                                                            SHA1

                                                                                                                                            4bcad62542aeb44cae38a907d8b5a8604115ada2

                                                                                                                                            SHA256

                                                                                                                                            b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

                                                                                                                                            SHA512

                                                                                                                                            50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                            Filesize

                                                                                                                                            152B

                                                                                                                                            MD5

                                                                                                                                            8749e21d9d0a17dac32d5aa2027f7a75

                                                                                                                                            SHA1

                                                                                                                                            a5d555f8b035c7938a4a864e89218c0402ab7cde

                                                                                                                                            SHA256

                                                                                                                                            915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

                                                                                                                                            SHA512

                                                                                                                                            c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f4884fc-bdb8-4b62-8eb3-f2db4082e25b.tmp

                                                                                                                                            Filesize

                                                                                                                                            6KB

                                                                                                                                            MD5

                                                                                                                                            e7b9d44ac12fe3fb84664d685f5869c6

                                                                                                                                            SHA1

                                                                                                                                            03b91b5b1e3990c22557a12b769d3a871d10b1b6

                                                                                                                                            SHA256

                                                                                                                                            4e3e38f6612bee218ff4f3c9c3c3a96db164100c91611f358cf996cea92b3765

                                                                                                                                            SHA512

                                                                                                                                            86e1640ea613f5da145e30c7acbd6ee5bb19ce168f4bbab9a6f6ccd5299b7f516ea7c9bdf4d85fe93888e1b27338456776f78e5c953e180ece23be44336dc455

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

                                                                                                                                            Filesize

                                                                                                                                            47KB

                                                                                                                                            MD5

                                                                                                                                            2bbb6e1cbade9a534747c3b0ddf11e21

                                                                                                                                            SHA1

                                                                                                                                            a0a1190787109ae5b6f97907584ee64183ac7dd5

                                                                                                                                            SHA256

                                                                                                                                            5694ef0044eb39fe4f79055ec5cab35c6a36a45b0f044d7e60f892e9e36430c9

                                                                                                                                            SHA512

                                                                                                                                            3cb1c25a43156199d632f87569d30a4b6db9827906a2312e07aa6f79bb8475a115481aa0ff6d8e68199d035c437163c7e876d76db8c317d8bdf07f6a770668f8

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

                                                                                                                                            Filesize

                                                                                                                                            62KB

                                                                                                                                            MD5

                                                                                                                                            c813a1b87f1651d642cdcad5fca7a7d8

                                                                                                                                            SHA1

                                                                                                                                            0e6628997674a7dfbeb321b59a6e829d0c2f4478

                                                                                                                                            SHA256

                                                                                                                                            df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

                                                                                                                                            SHA512

                                                                                                                                            af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

                                                                                                                                            Filesize

                                                                                                                                            67KB

                                                                                                                                            MD5

                                                                                                                                            69df804d05f8b29a88278b7d582dd279

                                                                                                                                            SHA1

                                                                                                                                            d9560905612cf656d5dd0e741172fb4cd9c60688

                                                                                                                                            SHA256

                                                                                                                                            b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

                                                                                                                                            SHA512

                                                                                                                                            0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

                                                                                                                                            Filesize

                                                                                                                                            65KB

                                                                                                                                            MD5

                                                                                                                                            56d57bc655526551f217536f19195495

                                                                                                                                            SHA1

                                                                                                                                            28b430886d1220855a805d78dc5d6414aeee6995

                                                                                                                                            SHA256

                                                                                                                                            f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                                                                                                            SHA512

                                                                                                                                            7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

                                                                                                                                            Filesize

                                                                                                                                            19KB

                                                                                                                                            MD5

                                                                                                                                            2e86a72f4e82614cd4842950d2e0a716

                                                                                                                                            SHA1

                                                                                                                                            d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                                                                            SHA256

                                                                                                                                            c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                                                                            SHA512

                                                                                                                                            7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

                                                                                                                                            Filesize

                                                                                                                                            26KB

                                                                                                                                            MD5

                                                                                                                                            5dea626a3a08cc0f2676427e427eb467

                                                                                                                                            SHA1

                                                                                                                                            ad21ac31d0bbdee76eb909484277421630ea2dbd

                                                                                                                                            SHA256

                                                                                                                                            b19581c0e86b74b904a2b3a418040957a12e9b5ae6a8de07787d8bb0e4324ed6

                                                                                                                                            SHA512

                                                                                                                                            118016178abe2c714636232edc1e289a37442cc12914b5e067396803aa321ceaec3bcfd4684def47a95274bb0efd72ca6b2d7bc27bb93467984b84bc57931fcc

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

                                                                                                                                            Filesize

                                                                                                                                            40KB

                                                                                                                                            MD5

                                                                                                                                            3051c1e179d84292d3f84a1a0a112c80

                                                                                                                                            SHA1

                                                                                                                                            c11a63236373abfe574f2935a0e7024688b71ccb

                                                                                                                                            SHA256

                                                                                                                                            992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

                                                                                                                                            SHA512

                                                                                                                                            df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

                                                                                                                                            Filesize

                                                                                                                                            53KB

                                                                                                                                            MD5

                                                                                                                                            68f0a51fa86985999964ee43de12cdd5

                                                                                                                                            SHA1

                                                                                                                                            bbfc7666be00c560b7394fa0b82b864237a99d8c

                                                                                                                                            SHA256

                                                                                                                                            f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

                                                                                                                                            SHA512

                                                                                                                                            3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

                                                                                                                                            Filesize

                                                                                                                                            20KB

                                                                                                                                            MD5

                                                                                                                                            fb546a6c504e92ad96e3e9c38b0da765

                                                                                                                                            SHA1

                                                                                                                                            019b9f5e2a0f8595360f791b535f91c7826dd01e

                                                                                                                                            SHA256

                                                                                                                                            6943303e85bbcdcd8d915b6b0cac8bf2947a15fdef09748f4547222113bc2cc7

                                                                                                                                            SHA512

                                                                                                                                            b62551a08583612841a1f8f648f29b834ec33c566e750728bcc7af62e0ae33da6e2abac786b0ea3779c7bb94038e41c074eeeccb0445cdd11c1e66ea7f301176

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059

                                                                                                                                            Filesize

                                                                                                                                            215KB

                                                                                                                                            MD5

                                                                                                                                            d79b35ccf8e6af6714eb612714349097

                                                                                                                                            SHA1

                                                                                                                                            eb3ccc9ed29830df42f3fd129951cb8b791aaf98

                                                                                                                                            SHA256

                                                                                                                                            c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

                                                                                                                                            SHA512

                                                                                                                                            f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005b

                                                                                                                                            Filesize

                                                                                                                                            41KB

                                                                                                                                            MD5

                                                                                                                                            ca9e4686e278b752e1dec522d6830b1f

                                                                                                                                            SHA1

                                                                                                                                            1129a37b84ee4708492f51323c90804bb0dfed64

                                                                                                                                            SHA256

                                                                                                                                            b36086821f07e11041fc44b05d2cafe3fb756633e72b07da453c28bd4735ed26

                                                                                                                                            SHA512

                                                                                                                                            600e5d6e1df68423976b1dcfa99e56cb8b8f5cd008d52482fefb086546256a9822025d75f5b286996b19ee1c7cd254f476abf4de0cf8c6205d9f7d5e49b80671

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                            Filesize

                                                                                                                                            72B

                                                                                                                                            MD5

                                                                                                                                            f9aaa380eabde4e762d7b1d0ec604ad1

                                                                                                                                            SHA1

                                                                                                                                            bf37276567ee1bf0668d0b37ee8c5372fd8a919c

                                                                                                                                            SHA256

                                                                                                                                            21a2d980e2e790ac15c94dcd7a2d6d1f54d91830cbe87a1ec2095e5b2c9ad792

                                                                                                                                            SHA512

                                                                                                                                            4a372e34adf9a38fbf2b6aea9da726d686204281c83a352ceecb288a447afa0ff7807ce87dfdf5c903b739f5e1a8e229238fe444f03d9105e9cd0345b6e308b0

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                            Filesize

                                                                                                                                            1KB

                                                                                                                                            MD5

                                                                                                                                            c30291b5e39adc1897d2270201379983

                                                                                                                                            SHA1

                                                                                                                                            1cb0e45a29f08a41046770cab35e8d135441f9f5

                                                                                                                                            SHA256

                                                                                                                                            3004fce3517c7894aeb2b54698ad85f622b595343d9051329cfe8696436ac088

                                                                                                                                            SHA512

                                                                                                                                            5390591debc287ec90fa9fd133fd7430a8ea26ec9aa54572df75b3610e42b458d707ded941a7227a9df2c5f8e8117519619a54d2b5b3e89ca10e598831028a8f

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            44373e8cca857ef1e117c91fdb47c9bf

                                                                                                                                            SHA1

                                                                                                                                            b0f51e994646b8dcd9e64b8180a927af03dcb7bc

                                                                                                                                            SHA256

                                                                                                                                            8445b6fa93866475534a9c651373f546961331eecf132273785a922e7e41d853

                                                                                                                                            SHA512

                                                                                                                                            40642268a9ea8dd2ed27bc086af4d7bea8011618afef28067505c8779c319a2a5f892f9543b5df5764591aaf5fc37f185c13583d132d7331754be0713cf98ff5

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

                                                                                                                                            Filesize

                                                                                                                                            16B

                                                                                                                                            MD5

                                                                                                                                            46295cac801e5d4857d09837238a6394

                                                                                                                                            SHA1

                                                                                                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                            SHA256

                                                                                                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                            SHA512

                                                                                                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                            Filesize

                                                                                                                                            180B

                                                                                                                                            MD5

                                                                                                                                            00a455d9d155394bfb4b52258c97c5e5

                                                                                                                                            SHA1

                                                                                                                                            2761d0c955353e1982a588a3df78f2744cfaa9df

                                                                                                                                            SHA256

                                                                                                                                            45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

                                                                                                                                            SHA512

                                                                                                                                            9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                            Filesize

                                                                                                                                            691B

                                                                                                                                            MD5

                                                                                                                                            6d2b1a1944d03b0dffe5d1182d60167e

                                                                                                                                            SHA1

                                                                                                                                            ee78ef3576c82902a4a2266bad5cd7b62d32440b

                                                                                                                                            SHA256

                                                                                                                                            e3a372009ad759c4e785674dcc68d91d0fd8719648f85fd375f4ea9b526a196a

                                                                                                                                            SHA512

                                                                                                                                            7445a97cdbaf8a7e30332e34274657f4dbb57a2038cb17955840f83d5a52e861ffac1b5f33f2244c50cf98102c89af329fa4b6c5e3e4354083b8267d11aa1093

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                            Filesize

                                                                                                                                            12KB

                                                                                                                                            MD5

                                                                                                                                            19e54ebfe506b148d9f89f64b7e398b5

                                                                                                                                            SHA1

                                                                                                                                            0921d8c46a2b6ffb350e100dba952aca180f4e5c

                                                                                                                                            SHA256

                                                                                                                                            ac61921f21ab50b0747526c38ef61f645bb1e17fa3ba5f8af27ea35c6a6f5480

                                                                                                                                            SHA512

                                                                                                                                            257c484be98ae29319cf7bd021581782357142e650575b3a455794b3129387f1cace357005f6a6225257cb4a927e06c7612e6da4a9075c7f5b1059c075836817

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                            Filesize

                                                                                                                                            12KB

                                                                                                                                            MD5

                                                                                                                                            ec00bf47b359247663d6a12e2ed7436b

                                                                                                                                            SHA1

                                                                                                                                            32993d58456f0931b43de00c23bf3ee6a2464f7d

                                                                                                                                            SHA256

                                                                                                                                            66964f64a09311d1d00441966cb4eb0b0b2409c4b2b4a98d85cb2baec9323ddb

                                                                                                                                            SHA512

                                                                                                                                            2980fe79b235f1ea45c14e8084ac2265c0031712d313188445551764163dc4a170671546f5534c9819f5d2dc73967650ecde7955941c18eedeb84d3f099c4bec

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            5KB

                                                                                                                                            MD5

                                                                                                                                            621dee6e9d43bd044c59bbec09318dca

                                                                                                                                            SHA1

                                                                                                                                            2922460b54f54e09d63502d3cd6e6f2f35f2663d

                                                                                                                                            SHA256

                                                                                                                                            34a25f014760c7dd91d7e5861b89377f948ffe3c3ca034ba68b79cdf574d1f69

                                                                                                                                            SHA512

                                                                                                                                            5ac5b3a236951e168fa72a171b3af68e5ca3e36b66dd99b2279c808593f386503dd021b7cf1071f622b0cc799d60f879193de2b93f1e469c766b57b2e9821319

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            6KB

                                                                                                                                            MD5

                                                                                                                                            2157079cd5eaac3b62f5e1e038482456

                                                                                                                                            SHA1

                                                                                                                                            a34edfc6f172631f47ead8cdb9430ffa2efc734c

                                                                                                                                            SHA256

                                                                                                                                            824a7040a6370f518161a1ce5b7d948a56a78cf63ec17ed529d62752ac752158

                                                                                                                                            SHA512

                                                                                                                                            002932011f2f75483b4cb9b36fafe34937eabf70667db5fe3b6170f3f396b16a9cc3470a495ee9686a2084c4da8a8689ebf7edef1c189a84b07d948a83cb13c3

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            17KB

                                                                                                                                            MD5

                                                                                                                                            1cd55bda33248ba2889ae555065bdc0d

                                                                                                                                            SHA1

                                                                                                                                            2527bece88f58636f4cdf3f33dd15cf2dab2bf6a

                                                                                                                                            SHA256

                                                                                                                                            6a5d5ae405595f21171d91239bb1f8d601d5df9ffdae8bae71471fd6513b0349

                                                                                                                                            SHA512

                                                                                                                                            de39540bac98e65ddfe39889728df0e5f5fd1d51c80855ed193d6802c71e9f46c222d72f8dbf588d1e4ea55a7ea3abe3a20f5b6c25c148da30a6eed1de9611a4

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            6KB

                                                                                                                                            MD5

                                                                                                                                            cd6fe03ad6316df1f00d5d8eee951c35

                                                                                                                                            SHA1

                                                                                                                                            a1cf6fc8c8d823fc638c15d14900bd3c875cbbdd

                                                                                                                                            SHA256

                                                                                                                                            d786e67b9e4ed6158b37f740f28b344c55b86c55498aa2233032321f2c28599a

                                                                                                                                            SHA512

                                                                                                                                            b200b141ceebd27de12f9d7b004845f835a8a744006aec9de500157ac2cde9eb749c9ba8c4cd7560722305e60d88646d8bab26f31ae4a1d1ab8de94a6603dddf

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            7KB

                                                                                                                                            MD5

                                                                                                                                            fa1315e459233f17044ae5f59345dbe5

                                                                                                                                            SHA1

                                                                                                                                            27f6bf51d432e147ec1c508b648153d84d712400

                                                                                                                                            SHA256

                                                                                                                                            ff30276a0d01716ea3c7043db256fdfde5cbaec85d629a5e29af7d57746b1269

                                                                                                                                            SHA512

                                                                                                                                            fe3a69847e785bd790dcd88590d7445ae9caff57e5340b5ff7559805ccc99f89d4c2a1c293202080e366294686231b0c351d5dd67f6716e1d2e32901f571dd04

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            7KB

                                                                                                                                            MD5

                                                                                                                                            d00c7e98fbe5d476b39f8a2163e8e777

                                                                                                                                            SHA1

                                                                                                                                            a476fd5c403ff8ab55cc86d37abb8084261f17ce

                                                                                                                                            SHA256

                                                                                                                                            6ae7f570b2c1a51b3e2d939d0f9ba86f3efb8dc3ca04d968b10a11fb7eae8e20

                                                                                                                                            SHA512

                                                                                                                                            6e6142ca16a58196eb7488cf1b2cd73b2743a6a7b8b11571ad577c1c9abe90f06136469d080ad98707d00963d08b01c98a6907080df253950accf11fae56e460

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            16KB

                                                                                                                                            MD5

                                                                                                                                            790bd229eab870dd5be93878e860a694

                                                                                                                                            SHA1

                                                                                                                                            d4560413aff6f7e113f9d104ee81a0b6d1b7e8db

                                                                                                                                            SHA256

                                                                                                                                            0f4a2bb6f3dbbc84a14d5108c44129d9282a648a4cf9ca59ec3be7c7da941f2c

                                                                                                                                            SHA512

                                                                                                                                            9acdd42cffa6a8e829d38a7cbb643c1741a352e3bfc26bb1938f2cbd5a0e2e975412bc8edca9113f6e617078fb2a9cf600b637e641343fa612a2ba3330242236

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            7KB

                                                                                                                                            MD5

                                                                                                                                            384a7e06cf53f1f1404c426ed124e011

                                                                                                                                            SHA1

                                                                                                                                            3c1b2e45c1cc67e4a58fb3b3590dab3faa47aa81

                                                                                                                                            SHA256

                                                                                                                                            79c5e92c08a683f2de92c75714f0719d2d4dafe7c4c0f2b2e8605231d4a8f34b

                                                                                                                                            SHA512

                                                                                                                                            a7bed395a8924879f74ffa20fd9d0b203aada58430083632be1040e4896c1b67ce4db204a6f7d65b33e05725ee0bb38af63051bc714fce134c1ec0c1047288e6

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            7KB

                                                                                                                                            MD5

                                                                                                                                            fc6b7afc3ecd726dfbabd7813cfc8c25

                                                                                                                                            SHA1

                                                                                                                                            318a0ef627d716e79c7230d687d3eee45c3c5467

                                                                                                                                            SHA256

                                                                                                                                            58f4bf51ffaf411ae819bae30cbbacab2d5f0cdbb3b06989ce037993f2647800

                                                                                                                                            SHA512

                                                                                                                                            e5cfa07038446644fd044f59db2b2a01abc5d3abef8f7a6d33916d9923f982a89839a184352b158da39959c0ff12c26ae155243fd6fef08546102163d0b0cc9a

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            16KB

                                                                                                                                            MD5

                                                                                                                                            d9fdd6eb050f2648017e953e9fe467b6

                                                                                                                                            SHA1

                                                                                                                                            f67eb2981299d56e1098d3fc603ed5f1d4646eee

                                                                                                                                            SHA256

                                                                                                                                            66ef160e9e3dd5cca07cb9f81955d0b0e848caf81bac322cb3492b56107b69b9

                                                                                                                                            SHA512

                                                                                                                                            be7e9b9a20f7a55b2ea3fb8c547d103c37ef198de6999f3b74c92dfd61784f65de1a2cd22b199d9b100b9c205524671d567bf8a5f1a8b0c6a1a3574970ee71eb

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            9KB

                                                                                                                                            MD5

                                                                                                                                            c03794ea2fb366753f5e022a89ae01a0

                                                                                                                                            SHA1

                                                                                                                                            ba29ca170c381ebebdbeebfbd6ff0c55f41221fc

                                                                                                                                            SHA256

                                                                                                                                            93e96790c4e39a45ce6caae4bb6b56981776c639f26318d46cf255e58d6873f3

                                                                                                                                            SHA512

                                                                                                                                            5529af8d0416fe686bb4768f40ab4deac0c2b5211bb620e896cf35facdaff082fe9c29206e5403651ca01bc927f79f2ef31f3285eb843775eeccac16431408d1

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            16KB

                                                                                                                                            MD5

                                                                                                                                            05b7634470ce59187c9f907554c07a2d

                                                                                                                                            SHA1

                                                                                                                                            0b3735c0cbe1ee8b8172326f2095602eaf908f5b

                                                                                                                                            SHA256

                                                                                                                                            29e87e9325a44a0ff9044f459487a14a2add0c8bf48f341b1feade55aea8c165

                                                                                                                                            SHA512

                                                                                                                                            12121346da942372ab8b7851e7de4e01e61fc727d473302298ecf2723091a5b435c6654b4d00e5e7437123149d25de68b64fa2588f5acc7b98129df55018d5bf

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

                                                                                                                                            Filesize

                                                                                                                                            41B

                                                                                                                                            MD5

                                                                                                                                            5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                            SHA1

                                                                                                                                            d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                            SHA256

                                                                                                                                            f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                            SHA512

                                                                                                                                            de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                                            Filesize

                                                                                                                                            72B

                                                                                                                                            MD5

                                                                                                                                            92027440592889e759d460caf5c6b8b9

                                                                                                                                            SHA1

                                                                                                                                            6d2c4670296bf6d2c28d56308cacbf59133dc4f8

                                                                                                                                            SHA256

                                                                                                                                            f0ff1783fec04c333b5a905285339eb742e102c213790bd9d07ec5f9d4201f8a

                                                                                                                                            SHA512

                                                                                                                                            d0a2212793d2f979d2f9873856feabb3c4f9e257ccad11a71d628d764dc949048cd214a4e538069d58fc0354f497e652378c99d3c393464c236b7ed1e4435cec

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                                            Filesize

                                                                                                                                            96B

                                                                                                                                            MD5

                                                                                                                                            714e7ffd953cbf0a3e51495e18773458

                                                                                                                                            SHA1

                                                                                                                                            0b94fa2839417b82cfdfb1e03bbb94d4893a8706

                                                                                                                                            SHA256

                                                                                                                                            89b2c3a8c3fc2872683654b8cf410bbeede6b1dc278ad47462244a2e3173d8e2

                                                                                                                                            SHA512

                                                                                                                                            5bc70ef2febbbb5638363f4c94129a87ab719671a4a1a4cdd810ee32593a967a30606338a451f93062a1b2d5e1810630e5bda60259f02d56a79505cc8f2b0ed6

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5be50d.TMP

                                                                                                                                            Filesize

                                                                                                                                            48B

                                                                                                                                            MD5

                                                                                                                                            43341047af03c720d2e7c1d77a8333b3

                                                                                                                                            SHA1

                                                                                                                                            1624d175b3d1757ba5bbcb43399ac4ec7ee063bb

                                                                                                                                            SHA256

                                                                                                                                            6bbca79e21445f162e8932f0fbe5364c4bdd598b18b89f9256cc253e3581c985

                                                                                                                                            SHA512

                                                                                                                                            80564f2cfe5cd11f639d1698a31515930986944ada16984b54b7a6af70341df7efc472fef39974f7a71a168202fe18bdc9685d7174a96cfcce754a8b5393e52d

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            872B

                                                                                                                                            MD5

                                                                                                                                            11263fbfce0cd5415cfcb6aa43ca52b1

                                                                                                                                            SHA1

                                                                                                                                            e7377dd3dd59616ee1fc18b518c830cef88e3792

                                                                                                                                            SHA256

                                                                                                                                            10fe56af477ec3577da7dc5c1f3951482bcd8b4afdb1d1cdcc79cc364a6e7232

                                                                                                                                            SHA512

                                                                                                                                            0754ce71e96ace153106176a704285b8dca5b8badfbaae9e045d099483d14641be78b2238ceef92a3643addcb67a3d08a7d636faf6e48da5caf912d82a2061f8

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            1KB

                                                                                                                                            MD5

                                                                                                                                            ffdf6271dc50d038845a34438f038b13

                                                                                                                                            SHA1

                                                                                                                                            9a6376124e7b1abf30aaa005b1ad1cb3e8ce8b9a

                                                                                                                                            SHA256

                                                                                                                                            3f3e8bf3c5d96da920faa142de4e9678aa35549e205878396604df738f48a0a2

                                                                                                                                            SHA512

                                                                                                                                            291172715f6662b9ab004c0c58a68844406d26a256ccbc1eed9a1390d4bc22d51607334b8e3b516ba6e71ea5c71b95ecb2533bb08aa7069ec7f18d0a9d744633

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            705B

                                                                                                                                            MD5

                                                                                                                                            0802765b43dfe68ae79bbb934fa1d39a

                                                                                                                                            SHA1

                                                                                                                                            c26725672644bfbe6b880b3f3dc1b486010dbed1

                                                                                                                                            SHA256

                                                                                                                                            5131e99f8a6d9c609cf9d9fc697cdd45b00155109f738abb69d34a32623ce7e7

                                                                                                                                            SHA512

                                                                                                                                            ce730a79e01d85813aa1815772b7f7bc25eef6fb8c747d04b557c923bd90e518c8d86ad5aba40dd79a5687ed1a71484a38b31727a963b709b95ac803c5a80e7b

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            872B

                                                                                                                                            MD5

                                                                                                                                            0b7d82ab2b1168407145c61c41a00ee1

                                                                                                                                            SHA1

                                                                                                                                            6948b8cf9b4da53206ca8b927a34e8a9754e050d

                                                                                                                                            SHA256

                                                                                                                                            227a82183c47be36722fb521360046d64712a88fa83ee958188ffeae9bc2cb41

                                                                                                                                            SHA512

                                                                                                                                            d8cadea19db83faa9042cd57685e71a03b9fc48a9a59936ebda989904f5e3b5ed50f7369ab50c24f563d529aab66553d9b322dc40e62c67980ed0b435d4c4c07

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            MD5

                                                                                                                                            da977b17cef27d67622b10738fd5811a

                                                                                                                                            SHA1

                                                                                                                                            ff63b9f8c49780c97ffc361d9eb7070c7cf86344

                                                                                                                                            SHA256

                                                                                                                                            6f5055e6bf30f935f2a6e30c7848529c5eea87e81aaae6d4c04242df4894995a

                                                                                                                                            SHA512

                                                                                                                                            f07ca584e3fe0d13aba2200f37b3332b1ba364becdcdc21300e4c2414fd91d2e3938a9cf372570cbfc61403f591c09839a76fa15261f86aff23da0c3b6786867

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            3KB

                                                                                                                                            MD5

                                                                                                                                            c13e7d9afafcc0e4f8696f630d89e1ed

                                                                                                                                            SHA1

                                                                                                                                            4206042f0b8ba1f7a5bdde1e752312dbc5533c07

                                                                                                                                            SHA256

                                                                                                                                            1e083d24ae65e21595d42ade45746c4d0262c6c998e64c740ba037ca208aea16

                                                                                                                                            SHA512

                                                                                                                                            64c02f5d98e1e74f3d20d5bdc0c1fd5714b869c3327d44aeef8728aa32148f20195e3c8365741d05076d9b15ded2fa07c403d2821b42439a16401faee6432e73

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c28ec.TMP

                                                                                                                                            Filesize

                                                                                                                                            203B

                                                                                                                                            MD5

                                                                                                                                            ccaaed901d75d019def7a927edfef25c

                                                                                                                                            SHA1

                                                                                                                                            33ea76a37ca83a7531859873426980e324430eb3

                                                                                                                                            SHA256

                                                                                                                                            1b5dc1eedbfba6188eba8899d86b9df1d4f4287641102c116c496499410d48a9

                                                                                                                                            SHA512

                                                                                                                                            96c1692e4bd9522d4933e9ee9e8751a4775730d5b1a9ae7312dc79482afbacc0ef25fd6a1d30d4a351fa4a23b407370964287989c2bbfad823a8c9ce487260df

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                            Filesize

                                                                                                                                            16B

                                                                                                                                            MD5

                                                                                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                                                                                            SHA1

                                                                                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                            SHA256

                                                                                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                            SHA512

                                                                                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            10KB

                                                                                                                                            MD5

                                                                                                                                            a00c54c5734016099bdd4e65f92475aa

                                                                                                                                            SHA1

                                                                                                                                            bf7115196388961fbb2b2d042c514a6319830c55

                                                                                                                                            SHA256

                                                                                                                                            62cce4a73036ecea41bd43220b9e5a8a71ff8dbb20c201be4217850f0fffe919

                                                                                                                                            SHA512

                                                                                                                                            15226af246ba22010e1dbfb850b1635c046c832b2e7e5d37f22507cdbe43c7bc4712697c910537dc81ac1fbc050de546f617301618ed016c53f62aaaa5461edd

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            11KB

                                                                                                                                            MD5

                                                                                                                                            4718845f6375a6bfbb4d4fb4fa7f631d

                                                                                                                                            SHA1

                                                                                                                                            22a2f376970e130c0af141ececd0166d73561d5b

                                                                                                                                            SHA256

                                                                                                                                            4e1ff8283899a594f757fe3f6b7f39941d8bf42fba3dfdde65aea1bc8210fa63

                                                                                                                                            SHA512

                                                                                                                                            971b15bc5d0102888e4de87beb85f4fbfe6ee06ba64df595999a3fd96c363ecd99b955722fb0a67ed63875edbbd94a6d9302b00a8b1aa68d001ae315438107b3

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            11KB

                                                                                                                                            MD5

                                                                                                                                            dfbab5c67c30047c38decc17ad428d02

                                                                                                                                            SHA1

                                                                                                                                            5533be3070deb00f99464acf3d317f28776cc7ed

                                                                                                                                            SHA256

                                                                                                                                            f561ae2dcf9893f18479827ec753c505a56fd6022eb8045ca907ea4118a444b1

                                                                                                                                            SHA512

                                                                                                                                            1c317c37a6baab79d2ff4a55116b1ec2b71ac16e155b91ff1755cfe832a4ca858e7851f514281cedc7e8d0eeb90116de0005e650fcf3e69f8fccb10794eee1cf

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            11KB

                                                                                                                                            MD5

                                                                                                                                            02f3bd3b211433a5e0bfe12ddebf7ed1

                                                                                                                                            SHA1

                                                                                                                                            d95f8e69bb59dc4e56425e21da4787ace0211771

                                                                                                                                            SHA256

                                                                                                                                            beed3aa283c3b551f9a32f8f46fea2f188a1fcf42ce3b687dcb6209582f1b70b

                                                                                                                                            SHA512

                                                                                                                                            1c9520771bd7ea374f26182d11af9b1d86b57e26b94f5179252a63e99ffc8444e695b5d57d869585653ace808d157ad529dcd141875e43e8783400a28e71d165

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            11KB

                                                                                                                                            MD5

                                                                                                                                            c1032aefb7f22c45e4de0f59a0892cd6

                                                                                                                                            SHA1

                                                                                                                                            7169f65154c1c34a3418118393b3d1e76a7e5953

                                                                                                                                            SHA256

                                                                                                                                            24a9e4f28594bc224cb179e57584e5c7cb3c98f72883fe408a4b9967e5382dc1

                                                                                                                                            SHA512

                                                                                                                                            2e7ca30ffd061d47d058037b2563c9bf01a263a8081af31314aa6f0a3fa64d971a99e7451da7a747de61b1dcc990d0e3e816d0a3efe8ca3d468fa224c29f8e46

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            11KB

                                                                                                                                            MD5

                                                                                                                                            10f43658a02330406065fb9e066d8cfe

                                                                                                                                            SHA1

                                                                                                                                            7ae26786f938e1115cae366fa48d358a72b36891

                                                                                                                                            SHA256

                                                                                                                                            3d65771061e6358c28d5d7686d34538aa476be5b3428880adf8b3fea1df75e16

                                                                                                                                            SHA512

                                                                                                                                            e833e4f0a440625b9a1d5c71ca379ddf40e26438ad49cf98092d097aaeb02e74f7ccdbbfc1b0ffffe7343ec814fd0adacc2de10aa1b97e523e500ee63d7735ae

                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                                                                                            Filesize

                                                                                                                                            10KB

                                                                                                                                            MD5

                                                                                                                                            eb8262100b1a2b1d3313643dc66c24d9

                                                                                                                                            SHA1

                                                                                                                                            96126db6d9b4d6ffb4f1f857a58cb4cd78630172

                                                                                                                                            SHA256

                                                                                                                                            caf478f5d01909e149fe99d89e01b2e81a2a5ecce9e501b8493d7fd099537f15

                                                                                                                                            SHA512

                                                                                                                                            f9cb0122eb994ec720a50ec4bafb125898c762e51a93961cad14e5abea827702d78fef46c6d278a94d5b16e26a3e54d2baa4703a3b7e5f618d90c33e5ce29c33

                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                                                                                            Filesize

                                                                                                                                            10KB

                                                                                                                                            MD5

                                                                                                                                            2b73aee0e66691c12506f3210e42ded7

                                                                                                                                            SHA1

                                                                                                                                            efe5f8fcdc30b69c64f91dccfb949a4d2ed4950d

                                                                                                                                            SHA256

                                                                                                                                            cb3b5fc98d68f25223cbc471643324a882c7030bff41ac4dd6a0a3497d1b400c

                                                                                                                                            SHA512

                                                                                                                                            bd6160d485ecdcef60c463d9d81d3e1fd31981c2833bb0ef1d262feec5170aa01c7679fc51a85c49619a494d9151a458e781ec3bfcefd0fc88e15532af18159a

                                                                                                                                          • C:\Users\Admin\Downloads\Unconfirmed 257567.crdownload

                                                                                                                                            Filesize

                                                                                                                                            3.8MB

                                                                                                                                            MD5

                                                                                                                                            46c17c999744470b689331f41eab7df1

                                                                                                                                            SHA1

                                                                                                                                            b8a63127df6a87d333061c622220d6d70ed80f7c

                                                                                                                                            SHA256

                                                                                                                                            c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

                                                                                                                                            SHA512

                                                                                                                                            4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

                                                                                                                                          • C:\Users\Admin\Downloads\Unconfirmed 634964.crdownload

                                                                                                                                            Filesize

                                                                                                                                            1.6MB

                                                                                                                                            MD5

                                                                                                                                            6c73cc4c494be8f4e680de1a20262c8a

                                                                                                                                            SHA1

                                                                                                                                            28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

                                                                                                                                            SHA256

                                                                                                                                            bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

                                                                                                                                            SHA512

                                                                                                                                            2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

                                                                                                                                          • C:\Users\Admin\Downloads\Vbuck GEN.rar

                                                                                                                                            Filesize

                                                                                                                                            26KB

                                                                                                                                            MD5

                                                                                                                                            ac17ff6c4a7b5284285f0d68ddff9465

                                                                                                                                            SHA1

                                                                                                                                            53c6e7b3ee030a6356e8fe5596e4f4e377f40fe3

                                                                                                                                            SHA256

                                                                                                                                            a8b2a13cdfa9383b7828a6b98cf5f592948251f590d98e14ee417925114baf34

                                                                                                                                            SHA512

                                                                                                                                            4108f7e7054f150758eb5a90d26288df4d6f669262c8adb5e95e9d64716b768b3b1104fe2841f0d69bb48465f84f2ea4a9aaecd2c4f6edffd3f6824969ec224c

                                                                                                                                          • memory/5072-4-0x000001B4B7900000-0x000001B4B7E28000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.2MB

                                                                                                                                          • memory/5072-0-0x00007FFF759D3000-0x00007FFF759D5000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                          • memory/5072-5-0x00007FFF759D3000-0x00007FFF759D5000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                          • memory/5072-6-0x00007FFF759D0000-0x00007FFF76491000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            10.8MB

                                                                                                                                          • memory/5072-3-0x00007FFF759D0000-0x00007FFF76491000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            10.8MB

                                                                                                                                          • memory/5072-2-0x000001B4B7100000-0x000001B4B72C2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.8MB

                                                                                                                                          • memory/5072-1-0x000001B49CAA0000-0x000001B49CAB8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            96KB