Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    256s
  • max time network
    255s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 16:34

General

  • Target

    https://cdn.discordapp.com/attachments/1095394818596810783/1330575945802977391/BBYeSM0WhOb.zip?ex=678e7aea&is=678d296a&hm=dc834524ee4d68970aabe416478c98f98a63ea3b6b87e9136e28b26da6bf5a68&

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://deedcompetlk.cyou/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Executes dropped EXE 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 6 IoCs
  • Drops file in Windows directory 12 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1095394818596810783/1330575945802977391/BBYeSM0WhOb.zip?ex=678e7aea&is=678d296a&hm=dc834524ee4d68970aabe416478c98f98a63ea3b6b87e9136e28b26da6bf5a68&
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe662046f8,0x7ffe66204708,0x7ffe66204718
      2⤵
        PID:1328
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7378264610645828063,16720658032261668517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
        2⤵
          PID:3664
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7378264610645828063,16720658032261668517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:216
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,7378264610645828063,16720658032261668517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
          2⤵
            PID:4632
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7378264610645828063,16720658032261668517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
            2⤵
              PID:916
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7378264610645828063,16720658032261668517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
              2⤵
                PID:2908
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7378264610645828063,16720658032261668517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
                2⤵
                  PID:4816
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7378264610645828063,16720658032261668517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4440
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,7378264610645828063,16720658032261668517,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5044 /prefetch:8
                  2⤵
                    PID:4528
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7378264610645828063,16720658032261668517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                    2⤵
                      PID:4560
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,7378264610645828063,16720658032261668517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:700
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:2236
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:3960
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:3852
                        • C:\Users\Admin\Downloads\ryosa\Bootstrapper\Bootstrapper.exe
                          "C:\Users\Admin\Downloads\ryosa\Bootstrapper\Bootstrapper.exe"
                          1⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:4308
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c copy Briefly Briefly.cmd & Briefly.cmd
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:892
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist
                              3⤵
                              • Enumerates processes with tasklist
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3204
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr /I "opssvc wrsa"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:216
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist
                              3⤵
                              • Enumerates processes with tasklist
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3640
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:548
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c md 347157
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1892
                            • C:\Windows\SysWOW64\extrac32.exe
                              extrac32 /Y /E National
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4992
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr /V "Cheese" Difficulties
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2636
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c copy /b 347157\Folding.com + Saddam + Visa + Bowling + Rt + Chapters + Advertise + Continuous + Accessibility + Destruction + Architectural + Any 347157\Folding.com
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2832
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c copy /b ..\Basement + ..\Florida + ..\Passenger + ..\Msg + ..\Welding + ..\Terrace + ..\Stretch j
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1396
                            • C:\Users\Admin\AppData\Local\Temp\347157\Folding.com
                              Folding.com j
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:2216
                            • C:\Windows\SysWOW64\choice.exe
                              choice /d y /t 5
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:388
                        • C:\Users\Admin\Downloads\ryosa\Bootstrapper\Bootstrapper.exe
                          "C:\Users\Admin\Downloads\ryosa\Bootstrapper\Bootstrapper.exe"
                          1⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:4828
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c copy Briefly Briefly.cmd & Briefly.cmd
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:3204
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist
                              3⤵
                              • Enumerates processes with tasklist
                              • System Location Discovery: System Language Discovery
                              PID:2432
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr /I "opssvc wrsa"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3084
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist
                              3⤵
                              • Enumerates processes with tasklist
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1388
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3436
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c md 347157
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2748
                            • C:\Windows\SysWOW64\extrac32.exe
                              extrac32 /Y /E National
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4324
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c copy /b 347157\Folding.com + Saddam + Visa + Bowling + Rt + Chapters + Advertise + Continuous + Accessibility + Destruction + Architectural + Any 347157\Folding.com
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4528
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c copy /b ..\Basement + ..\Florida + ..\Passenger + ..\Msg + ..\Welding + ..\Terrace + ..\Stretch j
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3020
                            • C:\Users\Admin\AppData\Local\Temp\347157\Folding.com
                              Folding.com j
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:2792
                            • C:\Windows\SysWOW64\choice.exe
                              choice /d y /t 5
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4712
                        • C:\Windows\system32\NOTEPAD.EXE
                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\ryosa\README.txt
                          1⤵
                          • Opens file in notepad (likely ransom note)
                          PID:1500
                        • C:\Windows\system32\taskmgr.exe
                          "C:\Windows\system32\taskmgr.exe" /0
                          1⤵
                          • Checks SCSI registry key(s)
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:2820
                        • C:\Users\Admin\Downloads\ryosa\Bootstrapper\Bootstrapper.exe
                          "C:\Users\Admin\Downloads\ryosa\Bootstrapper\Bootstrapper.exe"
                          1⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:956
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c copy Briefly Briefly.cmd & Briefly.cmd
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:3632
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist
                              3⤵
                              • Enumerates processes with tasklist
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:652
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr /I "opssvc wrsa"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:464
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist
                              3⤵
                              • Enumerates processes with tasklist
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:460
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3636
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c md 347157
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3148
                            • C:\Windows\SysWOW64\extrac32.exe
                              extrac32 /Y /E National
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:608
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c copy /b 347157\Folding.com + Saddam + Visa + Bowling + Rt + Chapters + Advertise + Continuous + Accessibility + Destruction + Architectural + Any 347157\Folding.com
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2588
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c copy /b ..\Basement + ..\Florida + ..\Passenger + ..\Msg + ..\Welding + ..\Terrace + ..\Stretch j
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3772
                            • C:\Users\Admin\AppData\Local\Temp\347157\Folding.com
                              Folding.com j
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:960
                            • C:\Windows\SysWOW64\choice.exe
                              choice /d y /t 5
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:372
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=Folding.com AutoIt v3 Script (Beta) (32 bit)"
                          1⤵
                          • Enumerates system info in registry
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          PID:4556
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe662046f8,0x7ffe66204708,0x7ffe66204718
                            2⤵
                              PID:2684
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
                              2⤵
                                PID:224
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
                                2⤵
                                  PID:3028
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:8
                                  2⤵
                                    PID:1992
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                                    2⤵
                                      PID:536
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                                      2⤵
                                        PID:4736
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
                                        2⤵
                                          PID:3860
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
                                          2⤵
                                            PID:1376
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                                            2⤵
                                              PID:1980
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
                                              2⤵
                                                PID:2956
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
                                                2⤵
                                                  PID:2296
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
                                                  2⤵
                                                    PID:4452
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
                                                    2⤵
                                                      PID:3944
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4826412387737138899,1850217091242132612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
                                                      2⤵
                                                        PID:560
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:3020
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:552

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          fab8d8d865e33fe195732aa7dcb91c30

                                                          SHA1

                                                          2637e832f38acc70af3e511f5eba80fbd7461f2c

                                                          SHA256

                                                          1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

                                                          SHA512

                                                          39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          be8842caba48dcb8a02aa560da852cae

                                                          SHA1

                                                          2b696279fb773b0203a23179a44d1570642418dc

                                                          SHA256

                                                          2130a10cf26ee5cf50fda25e19e0ad2992bc399dea33ea7ec20dda589d53cd0e

                                                          SHA512

                                                          21dfdf64b51459d0767801966b05b14b072712dd490bed18ccfc386e4da2f47dd7f4317994dd5bc84ed8daf668ce826c21d05e8ce95633f98526202d06ca7ac6

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          9db2a0594df297bf53c2c7a01c33cad4

                                                          SHA1

                                                          d2a815ec895516ea6b7cf3bff26b77383cdc901e

                                                          SHA256

                                                          33730d3aa056b2f0f6cebaa88c2082cbfe65b0a4657566140a022cd8a9b62c44

                                                          SHA512

                                                          e6349846db38ea7aed3338ca32dd022cbd84e6ae40ff252301020ba7b41a984907dad63d49cac44a854d4fc2c06d9b848582df953429191b211efceefa515043

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          36988ca14952e1848e81a959880ea217

                                                          SHA1

                                                          a0482ef725657760502c2d1a5abe0bb37aebaadb

                                                          SHA256

                                                          d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

                                                          SHA512

                                                          d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          dae777cd0384d8fba2f1a767c5d5be1d

                                                          SHA1

                                                          9896f0bd459da9e513069cc4977e3d863a3596e1

                                                          SHA256

                                                          c6e540dc864d99deff5528be2277a7a373dc4a1b0d61a950c40a8191b9571ef9

                                                          SHA512

                                                          41df9902d6d4cc482e9cf8cb0fad9ac7f8db079632038b2b332648cae42c3f76b2110355aaeebbb60d849564f8a1b3538eaa7bcb441708deca16f201783aaa9e

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                          Filesize

                                                          186B

                                                          MD5

                                                          094ab275342c45551894b7940ae9ad0d

                                                          SHA1

                                                          2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

                                                          SHA256

                                                          ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

                                                          SHA512

                                                          19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          e2c38593d95a8dcd0e0254f69a897943

                                                          SHA1

                                                          701458f8809ce45a7bd3c40fa12a465d79550ac1

                                                          SHA256

                                                          db4571a7ad1f39e28ad4a50b1ef531f28deb5feff3a481305bbc31722f8dd72f

                                                          SHA512

                                                          1da55bf2f615a7bde01733d4e0f58e869481df1ad9c0468674b139a3d64f4accd13bb67bc8e2a82b5f5c50e831d07f2cef5f7541c8113e24eebe13c80e11e40a

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          5KB

                                                          MD5

                                                          849d8f4a62d5bad0ece50b0814e5bf08

                                                          SHA1

                                                          74876da952c98f5472bbe5bed3b4cea6defe1b3b

                                                          SHA256

                                                          803e25532f8dbffb9b511890698395aa066622db0684d77ce9b6bccf869d91dc

                                                          SHA512

                                                          655e6768941ee4db2e0b518212afe8485d7d2c16feb5975703b0b72c81b429ee57430ca280d1be7a800d0e4a4660cec9f1779f92fbd90ec013d6dbbea71ce8a3

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          b2074cd49fdf71e3ed93e9ff213d840a

                                                          SHA1

                                                          05580ded0687c6af8ce63af6605b49fcc251f1f5

                                                          SHA256

                                                          07bb4eaa7daae1cf28a465811aa2bc82621bf5bb925468800191bed736d139ec

                                                          SHA512

                                                          94497f7b37a0006fc14ef01e4bd3bf3bbb417d59cb7cad45956d14970337208bdd112fd58d98a4d2090b220bba838cc6e722c7c3affb75b4a861072344717f7a

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          742284d25058fb6cc6942167dfa16972

                                                          SHA1

                                                          9eda32de206228c17e7427dab030c5b66fecaa3f

                                                          SHA256

                                                          bd9897e41016c4d88f8e77884849fa1f038b6fa929fa05f8e9f008d370c469a2

                                                          SHA512

                                                          299b24d66dfd22eb62070cabe383c413be46fbbed852de02e85a9c91bb9def069e9d926c5b2e13ba540e05362cd43560f82007f8a503f959de09b2a4004edd53

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          777c631c6aa155cd2e335b81eb5b3259

                                                          SHA1

                                                          19cd8a0f997ca4870b3b6a3f9750ceaa2ea85fe2

                                                          SHA256

                                                          70d1fffe4243858ce1bad4dd2da4798612f077c78dc673b961c7ab1b87901f1e

                                                          SHA512

                                                          8efeb5a44f0b42a8ec3dca325a58bc38dcea24461fae15b358c530496f0a6afb414ff9cd409ef4485578cda0a5795e765986b3cf7af23633ba103b52eaf2563e

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          d38e637c4be1456e6c65c1e866d3a434

                                                          SHA1

                                                          1b5e097f8e33de0514ca1e309c4c876a243488d3

                                                          SHA256

                                                          a8c03e6b6bbcb0f7763d368f0c8bdb4a462c8b0185ac4b3c3e8ac4b7c71df863

                                                          SHA512

                                                          816412674bbd7e65e45c0e72ad62106b33faa91c50641b06f64d82af90aa767481a4aca819e50c5ab2661e1786f31bd519bd571507f09d3f07118440af4f2865

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                          Filesize

                                                          16B

                                                          MD5

                                                          6752a1d65b201c13b62ea44016eb221f

                                                          SHA1

                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                          SHA256

                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                          SHA512

                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                          Filesize

                                                          16B

                                                          MD5

                                                          aefd77f47fb84fae5ea194496b44c67a

                                                          SHA1

                                                          dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                          SHA256

                                                          4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                          SHA512

                                                          b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          7e2637e5503eb4e5e6421312258a2f68

                                                          SHA1

                                                          3cd3d2266bc0151d055f70f7fa59ed5713acf970

                                                          SHA256

                                                          63d4abb083af9c7836de61d33f0b611cd90cf60580bb0ebe3339f63eb2ce9d59

                                                          SHA512

                                                          11a9d2009abfdf3e04e25fe401076afd4b6cdd180e4d5dd3c5a2978f7ed3a0f2f37ebb12f30d53889aa11fe87f30ca0592f819145230fe79b18daa52dd4dfcd3

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          83d686abc10390e15434ffa6f6d94b1a

                                                          SHA1

                                                          a94204b35d49066545c9c24d802a9295dc720b50

                                                          SHA256

                                                          0441f88d0a5addf4f418ac2ae95d016c3caa2c7acde12dded7839692508374d4

                                                          SHA512

                                                          2542057f7de45a2a65700f9db9d1bb8bf00423ee55efd5f4c3bb77462d2faa4b431a8cea0db8f7ea06c8aade05481d6bf95c6ec42686b52db58b3a3134ddcd61

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          6d626425251e6766581fc260081594b1

                                                          SHA1

                                                          be3e7f8cf38550a11ab599d17368d269c0c25328

                                                          SHA256

                                                          6f94f1caf29193b668d4fbb4fad231e92354c1fb49202571a11a2bd168ae4b91

                                                          SHA512

                                                          bd84a057671b87f81752ca1f3ee32f4cabf7d99dd21406bf3b47565335226b9114d72bc2cdf905eda746bb153aee109a46bf559e42a6e2369f88783178e9b91c

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          11KB

                                                          MD5

                                                          cab1375c976debe994b8a553878e92eb

                                                          SHA1

                                                          86320b4bddbdc32ecad374e55799a8b0e1afb93e

                                                          SHA256

                                                          7887cb2cd511e5efa9077a39b795470602af2725db8272701f649f5891091320

                                                          SHA512

                                                          6d1828a81dff6fffdf6eb4a233f65759dada1706c6562794d29eea4c49d51b3efc1846142a975388b5b0a4960351bb7c6df2087363f66e222877c2dcf1d98f2b

                                                        • C:\Users\Admin\AppData\Local\Temp\347157\Folding.com

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          bc0c466ea461f70dc2bab92020f1e643

                                                          SHA1

                                                          f17c66912508e95eac59bda2e773849600471a88

                                                          SHA256

                                                          f3c6eb4b4f81b5e1aa458d46225dccd651a2d44d1367a14718b6bb76beec1de1

                                                          SHA512

                                                          b1d03c359b8fcf46e7f07536004f7d11ab7bdd0cb044ca7bcfe63501428c4c93e43591e8367e5676478da8d554e4bd579cb6e37dc617f97f8a54a372361073c9

                                                        • C:\Users\Admin\AppData\Local\Temp\347157\Folding.com

                                                          Filesize

                                                          925KB

                                                          MD5

                                                          62d09f076e6e0240548c2f837536a46a

                                                          SHA1

                                                          26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                                                          SHA256

                                                          1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                                                          SHA512

                                                          32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

                                                        • C:\Users\Admin\AppData\Local\Temp\347157\j

                                                          Filesize

                                                          494KB

                                                          MD5

                                                          549720d78c44a4ca96f98a02d7376be0

                                                          SHA1

                                                          c18a7ddd59ea61df41acfac5544aadc72bb6acba

                                                          SHA256

                                                          37204d5c24cd97f012e61ba6c4aab3f6bd8778237ecbec3080fa54bfa5dcaf67

                                                          SHA512

                                                          392674f314a993f0eb2e22354a9922b006e28b01cb2abdf416a188e48b8fbbea8df93cb793cefd6e91259b7de71c502ac1e5c33273d94e1a3671ee1147cbdab4

                                                        • C:\Users\Admin\AppData\Local\Temp\Accessibility

                                                          Filesize

                                                          118KB

                                                          MD5

                                                          539587208032af4b529a60d530f100a4

                                                          SHA1

                                                          ef39ddfa82f53bde5a674e51318aa3ce9a8789b2

                                                          SHA256

                                                          bcee5e27e34159419173575bf6e22e23f0dad46cf6fa6aa84a1bb01c96516662

                                                          SHA512

                                                          4c261199485e6a40ce46147c98e244f1297446115ebd6c944a29e4242b361816980ccb6096286c8f9dbec00f13ea9fdfa417648980bf06721abc866630c5e53f

                                                        • C:\Users\Admin\AppData\Local\Temp\Advertise

                                                          Filesize

                                                          55KB

                                                          MD5

                                                          eaab0c7db38adca2364923dc1bb8bacf

                                                          SHA1

                                                          182819623bdee90678ae233b8094d05e51d48d68

                                                          SHA256

                                                          5a5c226453b9c7c7f7bdb980ad2a02838456f9420d182d14c7336f8264a894f0

                                                          SHA512

                                                          53d2c6559e2d1e71b62f91444608f1e61a246433499b75d6e3193cfd645ac4af3c4e4e1359da02b522d1e121de31f51d0010d96e8ef435a92328cef69aba4910

                                                        • C:\Users\Admin\AppData\Local\Temp\Any

                                                          Filesize

                                                          15KB

                                                          MD5

                                                          59051edf957c7f4fec5e278f07cfdaa9

                                                          SHA1

                                                          409217185334c187412941583e5814753d3f670f

                                                          SHA256

                                                          71cb36f1506fa645a90a6f06619b67c4f2f0e1e0140bac2e6f8a91ed1988446f

                                                          SHA512

                                                          f1897fa7dcc38c845cc3862f1eb33d493ca6c09338a6a7817fac6e99a72ecd07001a84e1935eccddf58e163fd8396c3333fad4c365cd5c8ade281dbc84735aba

                                                        • C:\Users\Admin\AppData\Local\Temp\Architectural

                                                          Filesize

                                                          102KB

                                                          MD5

                                                          ac3b8c0b9d965801a696519bc3bce457

                                                          SHA1

                                                          c2fb54f9d7ffbbea6e5db175ca214eccc0b8ee7c

                                                          SHA256

                                                          fbc3b647efe255870931d9dfa77a43c7248a7d8613712bcf0663862a4e97fb66

                                                          SHA512

                                                          0aeeb7d05c46063a892b3aae756bfb92f245aae66c2fcd4c34610a348ad0c0904addabb99d97ca0c9c3cba3df7e8e96500f084b840487a9ed2582d1badf638c6

                                                        • C:\Users\Admin\AppData\Local\Temp\Basement

                                                          Filesize

                                                          63KB

                                                          MD5

                                                          44a805a4e5ba191661485ef167275506

                                                          SHA1

                                                          45c2594c944f02e5260bd97a185c2f21ab232182

                                                          SHA256

                                                          e394dccd197c59fa4e2da7146174485a6681946d34faa3007bd5c1419d7125e0

                                                          SHA512

                                                          a3a8f7283ca0a0ae16b21f2b81b9cd48b953112c50e64b99daba378cd0e098108512566208365db4bb7b78355439f94bbcace6f5169091fab0202cf7d55f1952

                                                        • C:\Users\Admin\AppData\Local\Temp\Bowling

                                                          Filesize

                                                          106KB

                                                          MD5

                                                          7cbcc0fbb084bead6d5bbb8a00cbb997

                                                          SHA1

                                                          75bfaaa5232ab2cf9f2291ee1ce08f2acb076ebb

                                                          SHA256

                                                          e0a98926b1e0968481640078ac6b833af96773a7f715851634346379f282795d

                                                          SHA512

                                                          6b33f8afe19a28e5b300e8a32c3ec98a0365fc1594c693c4527d9b0275f46f6558c50e29417499650d9c1ea7091ea7af340c4111b90af06c5ab4277170170c9a

                                                        • C:\Users\Admin\AppData\Local\Temp\Briefly

                                                          Filesize

                                                          23KB

                                                          MD5

                                                          bb009bb1ab11657dd763b3a85e90f26f

                                                          SHA1

                                                          32fb786e48105f1574e8d345e66d2b16fc051d6e

                                                          SHA256

                                                          e7b3f1da61a207080f7859d12764b1243ce5c84beaf1a7f026b3d0da5f9dec4c

                                                          SHA512

                                                          ac73396967c496b93f8d4084537a286b4d5fe1315b0fd5992b03cc019521c1c25bafcb9826f85af59495a01ec711a2ec789c43af5befa46557f99224d0ce92bc

                                                        • C:\Users\Admin\AppData\Local\Temp\Chapters

                                                          Filesize

                                                          56KB

                                                          MD5

                                                          19f399e75e91c4917cce10422db7b0fb

                                                          SHA1

                                                          145fb431681a91d64a77b0ca99ba31b4ed7457b9

                                                          SHA256

                                                          bbe32640a1be9b9dc5570043a2c72bd3d1da1e3480e61e41a1dc8daa42b07bd7

                                                          SHA512

                                                          25b85fe872e3e9fc5e70d3dfd1647a6bbf2919d67126bb9007dcc61aae549d64a9b79fd3c05bc996202b03630420ecb4eb5b5613d0a1adeab0d2670e6a5aff6f

                                                        • C:\Users\Admin\AppData\Local\Temp\Continuous

                                                          Filesize

                                                          119KB

                                                          MD5

                                                          87cfc9cbddca81f037640e23869fd727

                                                          SHA1

                                                          e71c0a8106944e238edba3b2d6194cf5cb383168

                                                          SHA256

                                                          f648aed5047fa8e5b99ce81cf85f05f4cfb193b8b349e6e5656e5c6dd0917cb2

                                                          SHA512

                                                          2a3c9bbdbd222f9328b1379de025bff3f8d2c693fe68558cdb24a516ee7c9ac6615a9d1d62e4682532f8567138e67e6c26b6c7068d87b00415fc915172928e4f

                                                        • C:\Users\Admin\AppData\Local\Temp\Destruction

                                                          Filesize

                                                          75KB

                                                          MD5

                                                          e9ed56e42470ceb7a46263c49b9d8110

                                                          SHA1

                                                          13794b6f705be789af214a4f81585dee3710512b

                                                          SHA256

                                                          d97494026b70f37cabc0ac614f54206ae2c5a5ab601b71888ae6491241dc2b20

                                                          SHA512

                                                          ca1c0f00a68267274e9d31f3a2de0fb34ccfce0a57d67ffe76633fe1a156c05f1381b0c696f75898fd8b370cb8a6e56174bdfb43729ab2668e444ee6748d8040

                                                        • C:\Users\Admin\AppData\Local\Temp\Difficulties

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          d2ac6356ed5ed3a32e46acb2f47d68f5

                                                          SHA1

                                                          e41205fe32c1ed0cc4a265e942dd472a76a22592

                                                          SHA256

                                                          6b6a43352b0b87107609d9c91992b30069200b308e5a2a50ed5a931315f82bdc

                                                          SHA512

                                                          47bafca4c789c7fad4db0534a93b8c7b659abb999393425f58d9b28ba553be1cc45b9001da1d5820e65b107034f48cd441c6855c7d7fc08117985d81054394a0

                                                        • C:\Users\Admin\AppData\Local\Temp\Florida

                                                          Filesize

                                                          81KB

                                                          MD5

                                                          35ee0a5fee1964bd57f2c66347d726df

                                                          SHA1

                                                          d37bb5ba2456a310891f93d8e9ae1ad196dabcf6

                                                          SHA256

                                                          9b8ab89609b074479bc9fe749e12792c34ab4799ea7ea5ac67cdd3758a1c1181

                                                          SHA512

                                                          2006b993a36599a56131d744ea750a3de3d5eeb629d111d751d552e86cf3a4ea1c7d9b9dbb727e77b65ec8684cf0f22476840aed73df15186041b087476c0689

                                                        • C:\Users\Admin\AppData\Local\Temp\Msg

                                                          Filesize

                                                          91KB

                                                          MD5

                                                          478eae0d2d8bc46181226c275688315d

                                                          SHA1

                                                          674d1c954b6ba8bc77ea6e112912b2fbde64fbeb

                                                          SHA256

                                                          aae6d5fc0e80a6033d55b81e05db13c66604f5fe453f78440de3912a44c553c1

                                                          SHA512

                                                          9833ef8d0d29cbf1b1738eefd4c175a169c770f70f2699bde703092e5102439c779e7474866534bba6b58f49d160a49be0750b686c171415191ddb10469eb26d

                                                        • C:\Users\Admin\AppData\Local\Temp\National

                                                          Filesize

                                                          478KB

                                                          MD5

                                                          f5406ccecddc6c9bd30ed30343c756ab

                                                          SHA1

                                                          080ebf3593ee3c272e7e4f7c98fee6d326da45f8

                                                          SHA256

                                                          a46bd5c1472f8b655ace3314ca667d39b10d989b6f8ed17b6c753b8b947a6938

                                                          SHA512

                                                          a25eba5ea58855e65c529b858399b1574ccbed89038e90d50170562eceb11efba4f16242d54ad3b5232edc11f3f61109bbafc4398124c1bb45e43693657b1e81

                                                        • C:\Users\Admin\AppData\Local\Temp\Passenger

                                                          Filesize

                                                          68KB

                                                          MD5

                                                          355fafaeefdaaa291b3f48356e24216c

                                                          SHA1

                                                          c675a50bffcf18f357966ec51e0adaf05a25b86b

                                                          SHA256

                                                          d3210c22706049ab7ca2304fd17507bfa4a842af579a00b60644e09178f9fddb

                                                          SHA512

                                                          f2fb4e46b4d6b24cba584e51c6a43e8ed1174a5048a69bd61a6e24e2772f389e55c2f6384d1ffe7c6f44eab8a6fe059608e39a0a60ad30f06eb63589c723ab4d

                                                        • C:\Users\Admin\AppData\Local\Temp\Rt

                                                          Filesize

                                                          86KB

                                                          MD5

                                                          fc6c4e0bdb11443834c6af5b2ff6e6bb

                                                          SHA1

                                                          3c4bf0970e36371844c9a27a041fd09cbf65cf56

                                                          SHA256

                                                          445d2c74ae1ba5af2eba4cc4a4deeabbda1ef920e272ce9f54a7d9374eb23402

                                                          SHA512

                                                          9588272669bf2ecf277c83c836be28d4757a21b033e9919747fc11a7767abaf5d3af002d3379626b65e537aaa8fd2e30113994353592bcee577f3fbdd02dea5a

                                                        • C:\Users\Admin\AppData\Local\Temp\Saddam

                                                          Filesize

                                                          54KB

                                                          MD5

                                                          7b8c4652937f053027395d23ef6c5b93

                                                          SHA1

                                                          3e203439da403069184a56d40d00b51e8a03a2cf

                                                          SHA256

                                                          733b3e2f49984688e345d1acb07d22c9d5e44742f572fd610c114c50c04c3024

                                                          SHA512

                                                          67b5aac27923f00fa7e39cefb6adc6714845cc9e3db51aa2fe8c910e09f95b2fe46ddc901257afa63ede0988792ee6245089ea419bd257e53f05c926793de929

                                                        • C:\Users\Admin\AppData\Local\Temp\Stretch

                                                          Filesize

                                                          58KB

                                                          MD5

                                                          110f9b2d470e415d55f8a0d78ae1f8a1

                                                          SHA1

                                                          eeb9c0bf82f9a797fceed7d9725221348f45dcf1

                                                          SHA256

                                                          fbafdc9359e5294e8410d3862aee050c5cc03aec557bd83345bdca27981c0138

                                                          SHA512

                                                          1a8bf9fe93ff1b8cff52191bae71fed8822f4d99dd59ee6420709d037e26a185695e819535c793ffbe849e63637725e9ebdf487b57bb8f1ec3b4852e93954551

                                                        • C:\Users\Admin\AppData\Local\Temp\Terrace

                                                          Filesize

                                                          50KB

                                                          MD5

                                                          6f3b4f30afb0c2fc164daaee95348815

                                                          SHA1

                                                          c59e8d78f11d5af9aca282d52752c0846292d5e6

                                                          SHA256

                                                          987fdfe4cb214563ecd4ba6d1990284e485a7701c323c1564d9d4afd3554c890

                                                          SHA512

                                                          ce51ba253dc008b82ae51ac797362f93515b1ef481d6189f596f74c1172379bfa4bb86aa713ea62520a11c24281047aaee0d203d48fa1f3dcdc5121fff385809

                                                        • C:\Users\Admin\AppData\Local\Temp\Visa

                                                          Filesize

                                                          137KB

                                                          MD5

                                                          0fffca2125ec2d790c02b2bcd12ec8aa

                                                          SHA1

                                                          55883ab44b36fa0efe4747e2653786fbda5b60a5

                                                          SHA256

                                                          9dc03047dec2d31586916298828447b291b3eadae317bab07f8917e4bf4dde96

                                                          SHA512

                                                          53d6bb959d2d5ad5b3be4dde2b6c877eee4ae65e411f095bad980fc6ee58f49437dc8503186d544ab60aa6824cd70e616bf79cc13b713e27c5f75640db8ed70f

                                                        • C:\Users\Admin\AppData\Local\Temp\Welding

                                                          Filesize

                                                          83KB

                                                          MD5

                                                          9a2d8d245f55c0918e6a7e8b9e22ed25

                                                          SHA1

                                                          827ace99c5e1570e3ea912e67dcf7ef6851c3ee1

                                                          SHA256

                                                          e252cd74c35df37627de02488911ecfc1d57320be7dec21a7de03ccb9664d84b

                                                          SHA512

                                                          076fba85e84cb31486a947e31c39464e08faacdad7b26645699f39fbe6f3d6bc6a7b926f46909f227e9c78f2ce8d9c2af0871e057db10345504db2226a2272c1

                                                        • C:\Users\Admin\Downloads\BBYe#SM0WhOb.zip

                                                          Filesize

                                                          1.5MB

                                                          MD5

                                                          77165621a4479597106e6d17565a2388

                                                          SHA1

                                                          3dc5ecf8051171845921e60dfa4bc6596c17744d

                                                          SHA256

                                                          2579410e9f316e3eb80181813f87edab1b80724845b9c4fe3c3f2b065720d10b

                                                          SHA512

                                                          1e045d4850899be53f760d87a715b13052c3cb4f8695ba4fc6badb2440039a1d938cd16c7e77ee9675309058dc7c53a07b0f7e070537d419c925c7e044d91e32

                                                        • memory/2216-1308-0x0000000004470000-0x00000000044CB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2216-1307-0x0000000004470000-0x00000000044CB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2216-1306-0x0000000004470000-0x00000000044CB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2216-1305-0x0000000004470000-0x00000000044CB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2216-1304-0x0000000004470000-0x00000000044CB000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2820-1331-0x000001F31ACF0000-0x000001F31ACF1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2820-1325-0x000001F31ACF0000-0x000001F31ACF1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2820-1330-0x000001F31ACF0000-0x000001F31ACF1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2820-1321-0x000001F31ACF0000-0x000001F31ACF1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2820-1319-0x000001F31ACF0000-0x000001F31ACF1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2820-1320-0x000001F31ACF0000-0x000001F31ACF1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2820-1326-0x000001F31ACF0000-0x000001F31ACF1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2820-1327-0x000001F31ACF0000-0x000001F31ACF1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2820-1328-0x000001F31ACF0000-0x000001F31ACF1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2820-1329-0x000001F31ACF0000-0x000001F31ACF1000-memory.dmp

                                                          Filesize

                                                          4KB