metasploit | hxxp://google[.]com

Resubmissions

19/01/2025, 18:23

250119-w1m5qazqfq 10

19/01/2025, 18:04

250119-wnk5layraw 10

Analysis

max time kernel
434s
max time network
435s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2025, 18:23

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

metasploit revengerat seon backdoor bootkit credential_access defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/yBQkQqfh http://goldeny4vs3nyoht.onion/yBQkQqfh 3. Enter your personal decryption code there: yBQkQqfhzmAgnaSaYpnCbdPiUa3SuHCxjwVWkbocAEJ9c4Cc7hXiRPHrVS9EuHjQCg8S8rkVgbhtWSVoYEy5gjaupfGFkNPG

URLs

http://golden5a4eqranh7.onion/yBQkQqfh

http://goldeny4vs3nyoht.onion/yBQkQqfh

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat
Seon
The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
trojan ransomware seon
Seon family
seon
Renames multiple (352) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0007000000023e29-1308.dat	revengerat

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	VanToM-Rat (8).bat

Executes dropped EXE 10 IoCs

pid	Process
2940	VanToM-Rat (8).bat
3428	Server.exe
4852	VanToM-Rat (8).bat
4212	GoldenEye.exe
1340	GoldenEye.exe
2484	GoldenEye.exe
2872	runas.exe
2548	getmac.exe
2588	netbtugc.exe
1064	GoldenEye.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\Downloads\\VanToM-Rat (8).bat"	VanToM-Rat (8).bat
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\VanToM Folder\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\Downloads\\VanToM-Rat (8).bat"	VanToM-Rat (8).bat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
161	raw.githubusercontent.com
162	raw.githubusercontent.com

System Binary Proxy Execution: Verclsid 1 TTPs 16 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
860	verclsid.exe
4344	verclsid.exe
1376	verclsid.exe
4060	verclsid.exe
3328	verclsid.exe
4120	verclsid.exe
1220	verclsid.exe
932	verclsid.exe
4144	verclsid.exe
2972	verclsid.exe
3248	verclsid.exe
1884	verclsid.exe
3212	verclsid.exe
2272	verclsid.exe
2248	verclsid.exe
1768	verclsid.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	runas.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
2872	runas.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoldenEye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	getmac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoldenEye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netbtugc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoldenEye.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe

NTFS ADS 24 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 328814.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 630945.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 53483.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 8921.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 885448.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 115193.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 641859.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 839747.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 180590.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{a969765e-7180-442a-871d-37d8bc3821f5}\netbtugc.exe\:SmartScreen:$DATA	GoldenEye.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 644727.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{cf386180-1717-429b-9109-83cd974d0326}\getmac.exe\:SmartScreen:$DATA	GoldenEye.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 537862.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 530065.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 31472.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 306826.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 363872.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 734696.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe\:SmartScreen:$DATA	VanToM-Rat (8).bat
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 262095.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 495417.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 710192.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 50980.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{975186af-2010-4b92-bfd3-b383ad46a911}\runas.exe\:SmartScreen:$DATA	GoldenEye.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
876	msedge.exe
876	msedge.exe
1344	identity_helper.exe
1344	identity_helper.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
3504	msedge.exe
3504	msedge.exe
2240	msedge.exe
2240	msedge.exe
1448	msedge.exe
1448	msedge.exe
4824	msedge.exe
4824	msedge.exe
1600	msedge.exe
1600	msedge.exe
2900	msedge.exe
2900	msedge.exe
4216	msedge.exe
4216	msedge.exe
4816	msedge.exe
4816	msedge.exe
1544	msedge.exe
1544	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 48 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2872	runas.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2940	VanToM-Rat (8).bat
3428	Server.exe
4852	VanToM-Rat (8).bat

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 4656	876	msedge.exe	83
PID 876 wrote to memory of 4656	876	msedge.exe	83
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 5068	876	msedge.exe	84
PID 876 wrote to memory of 3748	876	msedge.exe	85
PID 876 wrote to memory of 3748	876	msedge.exe	85
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86
PID 876 wrote to memory of 3432	876	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe662046f8,0x7ffe66204708,0x7ffe66204718
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1656 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1188 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\BabylonToolbar (1).txt
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Users\Admin\Downloads\VanToM-Rat (8).bat
  "C:\Users\Admin\Downloads\VanToM-Rat (8).bat"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:2940
- - C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe
    "C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:3428
- C:\Users\Admin\Downloads\VanToM-Rat (8).bat
  "C:\Users\Admin\Downloads\VanToM-Rat (8).bat"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8668 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7656 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8636 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1476 /prefetch:1
  2⤵
  PID:2364
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:4212
- - C:\Users\Admin\AppData\Roaming\{975186af-2010-4b92-bfd3-b383ad46a911}\runas.exe
    "C:\Users\Admin\AppData\Roaming\{975186af-2010-4b92-bfd3-b383ad46a911}\runas.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Access Token Manipulation: Create Process with Token
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:1340
- - C:\Users\Admin\AppData\Roaming\{cf386180-1717-429b-9109-83cd974d0326}\getmac.exe
    "C:\Users\Admin\AppData\Roaming\{cf386180-1717-429b-9109-83cd974d0326}\getmac.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2548
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2484
- - C:\Users\Admin\AppData\Roaming\{a969765e-7180-442a-871d-37d8bc3821f5}\netbtugc.exe
    "C:\Users\Admin\AppData\Roaming\{a969765e-7180-442a-871d-37d8bc3821f5}\netbtugc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9886859085140456879,4031145053745108812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:408
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\system32\verclsid.exe
  "C:\Windows\system32\verclsid.exe" /S /C {088E3905-0323-4B02-9826-5D99428E115F} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
  2⤵
  - System Binary Proxy Execution: Verclsid
  PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:464

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\VanToM-Rat (8).bat
1⤵
PID:1552

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\VanToM-Rat (8).bat
1⤵
PID:1692

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {A8CDFF1C-4878-43BE-B5FD-F8091C1C60D0} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:3212

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {3ADD1653-EB32-4CB0-BBD7-DFA0ABB5ACCA} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:4344

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {3ADD1653-EB32-4CB0-BBD7-DFA0ABB5ACCA} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:3248

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {374DE290-123F-4565-9164-39C4925E467B} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:2972

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:2248

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:4144

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:932

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:860

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:2272

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:1220

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:3328

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:1376

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:4060

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {088E3905-0323-4B02-9826-5D99428E115F} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:4120

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {088E3905-0323-4B02-9826-5D99428E115F} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\VanToM-Rat (8).bat.log

Filesize
860B

MD5
f1ed5952b50bb5aa68c7be46a60072cd

SHA1
bd45f7ec75c9f5ffaf58eff7223811e99eb5d3ac

SHA256
bbf8ef0ad6e21011807eb655526bb6580988dd37e8e8fbe49873c1dcfa783eab

SHA512
c0c8046c1452699edd4e902be38b35d1a07f8aa340e55cbc16874392baabb9255e62df739b39775021e43731903b41c0ae34d9514128c8f42d0feffed96306f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
d474ec7f8d58a66420b6daa0893a4874

SHA1
4314642571493ba983748556d0e76ec6704da211

SHA256
553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69

SHA512
344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
20KB

MD5
7247e91eedf36d653790d6d0a1c8a4e7

SHA1
88281d63857f377a82426d9ab6963249c37443c7

SHA256
bd6e42e520f77a213daeee8749872b2ef6b220f7864e72c90f78fdb916861e5c

SHA512
7780717bfbb9661b6715f46c89b81e0241d2a7305893ffed317b0ad5ebf57548552b6ad11ce1518f6bf20aa5671bcacb77dbd86f9b484abe4b7dc2071c4c42a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
27KB

MD5
6b5c5bc3ac6e12eaa80c654e675f72df

SHA1
9e7124ce24650bc44dc734b5dc4356a245763845

SHA256
d1d3f1ebec67cc7dc38ae8a3d46a48f76f39755bf7d78eb1d5f20e0608c40b81

SHA512
66bd618ca40261040b17d36e6ad6611d8180984fd7120ccda0dfe26d18b786dbf018a93576ebafe00d3ce86d1476589c7af314d1d608b843e502cb481a561348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
cf56c5af7b81c5342c09affe6de0f55b

SHA1
aa0c3947719aaa7a0e7ee9b30899c1e26e66daa2

SHA256
8a55971aae25579b454991bb138681d41c67ed8c43fc9b8e04cdd71ce4e0905e

SHA512
62e9680590f269994b63556498bfad7a1606fb82d08d99cca922f7c051cce9b229520e80c0455679c92570517aabdd5b5de28dd779d1fdd65c53108ab3eaaa91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
7933ae4ff75ef93172166885a098f94d

SHA1
89dbaef2f3f248cb654dc57db1d737c4a86469d3

SHA256
993dcbdb024a5cebc62b126820619707e7a69b716c345386716b8565e9c8f294

SHA512
8b0bb73c1d17e7b2911c296ca9981343b7d0e3d1cc84ab66de52a906e616b0e4c4bed081a8e1e001e1835e40fdda87b90c81da03d3b12bb3cf730cc62f758cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
06f5dedb105b9f8fb5d619fb4d6317b1

SHA1
2fd3dd7548f530d25e9c4a15e4f164c58f5779fe

SHA256
a273a1e255d1a18ef2a7d7e210115a1366e5e21fa50ffd519ef0c7ecd7cbb021

SHA512
ca69e238640303bca7ce45905826b2a9c7cbf49ed57e579d557b63d3acadc7d762f62eded9ded5c299aeffe3c89417093753a4835f5c8550259f415cce567a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
deba93441ca5b5d3c3cfb05ffea14010

SHA1
d33b706e53a87b6499b6b6bd266f74ff861412b1

SHA256
f2d3d3d65c7bf5b07a665602da63ffb814c0505071eb3ba0d131b90786c15be2

SHA512
c911c2f19de84a7ff4b9d202fbd254390ef6b9b4d60a797bf79ab22ca0545ea9b457c3400239d9aecec75233fa2c76fcba6e8f4fe248e5583e1c268f18c66fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
9e4c2d0082bcaa758e726e944e911266

SHA1
f75d85415ba88c7ef4549bcbdd322b0c39f3e6b3

SHA256
989f28cfecfb2cc715aaa9f8eb2bfb528bd53d4a272bd24ab7868ac769bd9fd9

SHA512
68acf22ce5ecb971a625c2dd44f63a8a935289e3aa27ed9a88f84e644308612a23888660a98f96e9cc8ee209cc1a8c6b3a7021709d24321d029490118afdd3d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
09288cfc05e19bbd26eb3c66b31f1bfa

SHA1
1ef2997ea8484477d30e1bd51dcead234cf9e0c6

SHA256
9039bc7d7c897fb34cc6c9956b1a45333c3842bfaf76cde5da3a22bfc5c9716b

SHA512
1c852c88067734d10486924800578a4aa315c9326784d23ff5c900147248bc11c85859274049e613efb45b3440710f96fa433bfc1d895717d36fa896780ae871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
74708338e9c721d9a6b1d6a60704283d

SHA1
61fe57837119111df969526c2a46071cadbb8dc4

SHA256
735b6b563a0a9135d778e178c031abc1ecbb647b220a6324dc7fc3ea92569d21

SHA512
ae75e2c94bf28f8026fef7f903ec13d593b2f52f6684a207722757ce3fd10b9ce85ad566a1261886505b9a7c46a602fd90d1bb74671d2cb1142c4eaa61196a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f7482af64662f20f9b14d127707b929c

SHA1
8ab02c3bed7757e3d399db939aa36874f3e4fd0a

SHA256
6353c642898d40a3c68ad4d8a3a9cf17532a37384f2e883165697abaa27d7b11

SHA512
f454b3eb33eb71f8d432fe7c959e90bed563af1bcbd701bb6dad253cdbde31e72ac9bd92f157c2bb4b4f2f91489ac118e0062932961793e1f6b39e3072077f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
355b357d940ec3492cd15744781cff9c

SHA1
9add53048df3bd0097056a17524f2a296196fc03

SHA256
527523dbb8a07f70850f0cf2850fd5f3c0ffa03c194c7217a358a2bd53b79379

SHA512
b7741d3476d94a532f7e0c9703b013361c1a1af9a906b0162c4890cfb91998c4784005c7dbd12f02975734cf407ce97a530759604bdfd8374bcbbfec07833720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4680075fc985877940f1db1fe310ad80

SHA1
c680b3fb83da57648b6ae41ba3f4db78fe60ee77

SHA256
f7fb8e951cef5524c4269533053b503e1e2aedba2a6374a734d0429dcc3b21c5

SHA512
4607075d072553eafd8d78b1ca8d124484dbee41f357bfc101576b46d2ff33347b06c319fe76e3b91ee73c170cfd65a6283415b2f54e64abe8a54b51b696e087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
df69825e08b5d0c832dfc028a8bf587b

SHA1
8cdf07b1ab8cbbc8bac9e47d4fb6a19db5b0e1aa

SHA256
8627e3a12004f6c89b7f50077d136ba4cf13c4974456ed1d93fc5e4ca9a4bb9d

SHA512
8c6231b1196f6538d2c5aead8bb76fe50cbad79ca0f74f7aeeb04492cecb633bf0f2189f7f52698acca5abbd719a9a7ed6d31250ab619c9f02ca6d81d3322cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ad1af7a7894e2b986808083f9d8ed8bc

SHA1
f5ef6787ff59ac066edec84b1e1d5b420b684494

SHA256
4faa4c9b845a410fcf0289918f59442de47480f7e8a80440641fca71451d1147

SHA512
2411f43a0cf1de613a3810374fdaa92c4de0b7b05a6c1555603c75716cd182d77be58c3f371a8078c54c8d79040b04db5d42cc0ad92cc944c9ad606a95ca1943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
aae0d163b423172723cb7b5142864487

SHA1
651b75b6995592582ba370df339ab022bc0c119d

SHA256
3147925a58a8700082d8aa20a36a90b72260d9fc36b69c8684e893ef4268fddd

SHA512
a93124da82fe4ff1a766bd58bca1a65daebc99d9f30fa30bc1262372dd3dcc4beb783a92d6835399026818816877ed945a206b7676d042c7169e98c31b13d098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b66d483a6d0ebd7fde5d46d525963a2

SHA1
eaff0d30de497983fe792d99a2debfe5c6dd9c0b

SHA256
451630873f19badb1dfe6240fbd5851b19258805d50a7045d0f1e7552d661087

SHA512
5a9c0d5a453f0cccc29252bb2ad7c3162584c62939a39342bdb737bac7761f607947637ed20f99332512635c9651c98810afd0044e2d674a0eb0158babad1994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a923014f8ca9fe6c89c5beb708b47710

SHA1
0e5d013ec09a91d005cf8b6075cc0fcd0bb2ff0d

SHA256
99a59fe7bd25b6240d2d9b3f033e8ca21ce40415b947ed810bb1fea474e8bed5

SHA512
f098d080d139397ca5ab5222709731762b0c86248d2bc9f40a2551115d3991e5b03694c861486b55561b9933a2e1f40e6316e46ed5602e3de115ee73790f9445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2a35ab41b8fc5772d6aacd390bd652c1

SHA1
eb2bb8def2f2d10f188c898d33e04e013581f217

SHA256
e0e4df3f119884abfef852f480aa405c8b53a90dd92857d18631ef0fe732228f

SHA512
6ea42a5b11eab6e8873ff5f8f2c794c2baca63f6da783243be916b99d574fc3076085a1ecd85e959a1d6e216bd47a299b266f6b1b36a25138649448e7e132e9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
14d0e3ad6e232237ffcf4a90d6b24f2c

SHA1
5e2327b775dc4ef824804f3a8645a8968a3795b8

SHA256
588896f73c78729980a26c26744b617c6967a3cd3aaefb2ec3d7a37279393853

SHA512
aff0c2e7d89eaf5655dd4178f93b6851d160b5e7fa52c56b0537d9a599919df4c8eff010f7e585f56ed1fe52a35bb099c87541cb44fd101546951713064e8857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5940db702e4d0cf6fdf341bd8eb3a2a1

SHA1
af2288b909bcc6cc28910d05b65bbfc487d47420

SHA256
466cb3b25244841205dd25a4e6801a61d74b2182e36bc2310e525e95ce367f44

SHA512
0c6a269cd15e9b8e42ff8eb8ad01b72c269991b644e60405276a775133c8c2ffc75a31932bc231741b3ce6e16d5d82c7486bfb861b0d697b1a6c599ff3dc1bc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
cf05abfc971dcbb9be7ff5612dd52262

SHA1
1c94ada0af3ce8c20fa9e523762a49d711dd4576

SHA256
1953ffbd29c7ac9b6244bc0bbea53b318a27a87aa1a69371cb21bf86ae6e9b36

SHA512
9aae4c4501c72f28ac285ef72bdb06fab9f55797b4697368f7a76c612a7d7763e2265c4556a1b95a0c1c2ea77bf83f5626012da1bcf22c9c92fd017383271812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8067b1a19e14a92d23f4fadf4750658d

SHA1
188759dc0340da727a076b110fa35b9c105881cc

SHA256
2f522d9319fa05f9cd95dee03858e4e56aa73995c165e87f19b152e733c9e218

SHA512
f2a0a108bd8969fd8495e49177dfa91b2c07f7c6787fa93ce052768cbbe9d2a5d16f6211228509c0bb14bdce139c16e1b7b328efde08c6881ada31c0344548bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d225f893e85919906893397b70ccd890

SHA1
c59e7cf0a94544176b37aa8cece6ea105967bf87

SHA256
743f2c232940c478d4564bcdd04b813a563b9054c4d5e6b38388938adaa5494d

SHA512
b0ce7349324cc106ba6a4590c41b921bb65fb9d6f1aa6d389792f32d51d93fc7679b72e56ce157f6e0f9a8e8242ef8c0b4b1460bb9b63043bd9def414d3016be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d6a0883bcec2d9bbff3586023c1e40b9

SHA1
1d4f7b8057d4ba67e1284d213a1e0580a51ecc48

SHA256
286104baae99b6b8038e82a336ece2b04aeae037a4bab8bf0659bbd877e6fdd8

SHA512
02132ef615fd283888428657c57f84056ee26c5091dae160996742e9b6369946e5e55545be6cded9e7b2cf3fb4fd31344b27c411c7c56c43ca10977f12afd981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590c99.TMP

Filesize
48B

MD5
d663e5e75d0c857368fe7182d8f16c13

SHA1
c856f7ac60e4abd559d06dcec37f54444c64cc0b

SHA256
d664e4eca49b237083a4200726f4882d3f69456b1d88f0c7706e28cf51ed808d

SHA512
3501eaec6d49727b13da270a3f990c2dbf584101db809e6402887b20157b2f5c9be8626b132dffa92f63589c262719f9506c9f614616e2df3a83ac2d3ef69035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
914971d509224d0db852392a44b42c6c

SHA1
94013409875d790cfe55c45cd4c4e5a1167ca37a

SHA256
b9fa11deff2be515886a19e2c56e747f44c79524591e972ae99bd46ee6c9535a

SHA512
b9a09a67bfe7ee1c0c0dcff9ea2dc25be12fa41745551cc5cf6276d32ec8658c76fd8167410477ae7e4dba8ee181b0ae443adf973ccd7509bf6695c122853d0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3f1b5af199a60fe8b348218655a32ba9

SHA1
bc4d96c46ae91c68f91bc4b101a13c8cab27e303

SHA256
056715e2c3ea80a79c6d40f8e25b43e115c77753edd2a7cfddf5763dd73e3dfd

SHA512
e66c6cdbf180cef1a0d7dfb65e59c2c746eaf5e9f14f07161c847aad75d9a945d43cbdd0ec9a1c3c4248667d2d481576aac57c0553b7ab3615f8c993c238b278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
73d4a6311301443f2a57ae6157df52b6

SHA1
6e778eeca39a1fb4269c5c6f44766e0d0c0d560a

SHA256
495871f6867345f97c72fe163aab4069b34854fcb2efc0d551c38ebdd05e672a

SHA512
d4e05cb6e1f344c44246f7889227103f6eb3c2a9baf9f2ebfd1e5ff138d0817529beb6388fc7f18615f0de725293aeddacb71eb5c2068a769130b6f0e578cc68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f888a3f999640a9a0544b68738bb4747

SHA1
93348ecff9fc100b9297399cc522a434d6b326d5

SHA256
577967c3419ee873efa51fed7c346e76f1b1e86d61df49c8b7691b8504c8b14a

SHA512
2731c0c83122da1a68b2fb2260b2f73b08606ac38dc4392a7fc8c84537ee34e0723c02d7cc17f846b628988687c073db6806b26131ef0e2b3e53fbe4725d21a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7cbc364045c4bb9edf7a9a0e2552a993

SHA1
2f6cfe271910698707e61cbcad5f50e3416cb12c

SHA256
cc289011d617adfa708f70e052bb5f1d384006cf8c49c2b7843cf7d403657e1c

SHA512
c2b6b821eb28f21446076f9abe805a3aecca76b31cd84d99e3d38915a1d28598d5162b77f80739157e60397ff72c579c6e1d51796246217ea141609cbc8edb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ef260729fe214d243180d4cda879e9a6

SHA1
fa942329a5b684d97f36171d661be68c27df8ed7

SHA256
29358eeb9966b6465a4d82026c566b4e868f137db9fb73aa75aa8d462c729534

SHA512
168143e0b71f1c69b8ed1a551e10192c4bea030358590d4226e188582f06f816dead83a10326e05813efa42473050b190543206ec39e77f9cd6aeb71bd420a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0c2d67fe75e9abb1afb0ea74ca86442e

SHA1
892b6155e1afc8c9e1ccfbe0797c40ce9635524d

SHA256
9f9687183dc58eff923a4c3982cfc85cd288a8bb4be4d0d32b53562590b2f8f0

SHA512
224d56a98fe53f45a768d919e3e474edf257243ba0ccdd80e34cc961a2e0e9ed74fa2ba4b86390586bf5783a663909000216d4d98187fbf685c5f38ad8722856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b65d99bc1b1203fc695d01781b6a4e2e

SHA1
60e4ec8390c12f4fd25c5e320d4eb3293cfadbe5

SHA256
b250a01312b8c48335b699079e7c9a45b9a01f5acd70c22316fb011af1db3eeb

SHA512
76aafce97fd263c1bdf27c7fc35673359499b812185e63f21b64f2a5763057f3d466295d9c48e419de9fa158351ffebe56788a579540bcba5c6a5ef5b054f91d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b16d1c17bf0afcd929873b4d6e6b15e0

SHA1
f5fb154764a39eaf5495ce48216a037cd6a9cdd6

SHA256
9ccf5ffd6daa434014a7d382cbfcc6aa597bec0af6ad989fc3634d8bace8301e

SHA512
9c368cf1d0ae2e64cf31489a8260c3779384ed5eedd56deb4f31e986f9f147d1a8e9df6a357af6b53e1eb814f01bb520237f6f514a267dd17f027b2a7c691168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
547eead922db09e410d2877b30cc61ad

SHA1
98d9973f1c5327b8549f967e3d6f70ab42f958b2

SHA256
9e5fc5fac6c1a0fbdac4a642bbdc5be56aefafcbcc1dc1b04c21810ed6e14944

SHA512
0106989ba98fd52f0c0c85e57227e88c0336a21737f28efbfa0a9ce09e774d1b462132b516d159844323b4867b8db95ded0fcfdc19477d936216b9be8fa38ea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
14428be1292798948f0fdbc26971368c

SHA1
506795c49812902383c256aa5c09810bdf6c2145

SHA256
68f43f8c4c32e0b0636dcf638f1e46257424dc461c820556c2e7f4bf21880c94

SHA512
3309a233961319369f48a8909c2711444913d8f6eae19d9d03a0c3992e89a102edb42bea2b610d570febe4f021771f5297569f303583424399930f254a8269dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
63b1fbddec655240d16d0f7f819e7bdf

SHA1
c75c6062a0a6151ed94f59eecf30c4721a8c0329

SHA256
3c39a53f73dc0ac6e005b4c4afa4542cecd4a56bf45a12cf445d1a2ac2c4c156

SHA512
cb0c29961ecdf6bafd16df0de51bb2a8f876ad21e47073dafc03025533fb4df2b728e23ad9dcd584007ae9d57854f67fbf342f3f740d4f13f641dfaa9c88d831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ddf1f9336f0a9bf8315a0e32a673f026

SHA1
e6fdec0b05984e60a5d51cba7004db3a973d8978

SHA256
9d325d5ec3c4335900311de9dc4868c42ee2ac92d0a479503757afec7d3738e0

SHA512
caa39460d7936c67b47d9e8ae731d7a3dd0e7c11289a84dcd4f9c3530e4d3f94785eb31eb3e90e2497bc4eea9fdf13212c50ed43f3c376bc4042e47dbb1b8b5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f59bae12996690867a0e15326bb981d6

SHA1
7d45fbaa76a8aa4448eac6a93946451c216dc4d3

SHA256
65846527208d6ad78c1e1488771a0ad0d4d138275bf0664c102ba168b6ccb26d

SHA512
9561f4ddbe6388392cbb4084ee8646674872bd8d9240c8eeabf15227a903c47184eee406b5837c03310c58cc8118cc4355ba9c3957f8303544dda51ea483ba64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587fab.TMP

Filesize
1KB

MD5
35a2bfa46fae5e8359e99ff631cc6706

SHA1
5075b86ea1cda286106576ff8ffcdfdcc7785487

SHA256
2ed2ec6c11cd04cd7588cdd322ab10bf55a81e722dd3e820f82a85a6537b3dc4

SHA512
0393f3655c307e8bb3f347f59fa3490777fecc25b077e437c78ab543a5eaac7d8c1e3c5b2039bcac345e89fd5025fc8dbfb05cbdbae3ff25cd345abd5b5eedbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5710aa6c2af79bd79771d016bf7b7210

SHA1
320201560eb127b5676224e91da244fcca63e9d5

SHA256
1b89ab2923de697c827536e02ee22faf6e6440aee2f1e28716f87680f30075b7

SHA512
a58ac44894371f78e57ac73680e79fbb1bf70c09bb7af173b71e29477f6be06786cf650b9fc7f3586068e730f79ad0b947a50046015cd898890c80be56645b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7c94f13abf95d378bd66e76c92957e78

SHA1
bda868dd1ae168ada1304ba5129a9c9f5e4e7d58

SHA256
e95988f2e73aec00d5484c91906b074c08d0d71f291c236cb43ea50766c5a491

SHA512
3424e10436208ec8fbde320443339aad118a52f1956562d2068f4fd377fad043566cb279d63eae296351057dfd59ac42d59153c3475e1d3d6b561973af18a106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
917786e64671fc5d99371e07a813a9aa

SHA1
f3d681de083c5f00c47e95c2bfda5f1a62433ecc

SHA256
70373d5546edf7ec026052ec0660524a7bac4fdd911da0bbeaa2d1bace27bdf7

SHA512
b028249c168e1083348da1ef164c177e22c297cd06bf6e78e643371e53b104e2401c7fe2e6a65d3f385a1f50675f7c3fd5d9cde421ae58d1f0ab134741f3a423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e02b220998978e169797be328ed010e6

SHA1
1d395d025538724244450467784c8b8581745e4c

SHA256
b12bd5ebd28ff91416c90f0380bc5f6aa230ce55bf33c0770da14e7f1e77b993

SHA512
9c49ca5bb0bdf0f17e6ac0077d36430be4841dbb3dfde2920d4d5a1c61b2bf8731cd3bd94403cf6a62c9954f2bf5a60f3fd0e5cd897281d7f69872eff9fa61af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

Filesize
333KB

MD5
a5efcc7d92193d184f6737ba55aecc4a

SHA1
0d9f9a04ac91fd87ae8e761f5f786b0495f375bd

SHA256
ec84e54fc8dda9997a592527324c2342430bd41e55e13c04b7e944fbc1a82939

SHA512
7da4c0088869848eb157ac922fc21460b1fe516607207b97144c9bfb9005775586485065a04e7f78727688449b0c7997e3dfd34473e1252517579c926db0cafd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\container.dat

Filesize
118B

MD5
faef7b19980e0e095987c28d01706e98

SHA1
38d0db210c52ecd32014579418c0e7bfa8fe553c

SHA256
cbf01a3411273c3b88a173a5a978b46a5faa340893814fc29279050f1d6e7bfc

SHA512
7300b178a36a1ba05ca9d3b3768f8e2b2198d606b99e690b16a7514c56c67e70895dc60b0f00a7f8a12492afb2cf75d5f3bc3851576367bed9419763b28f6feb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c918e292-493b-4a4b-beda-9ac97b1e8a9a}\0.1.filtertrie.intermediate.txt

Filesize
1KB

MD5
fec2e59f6d021058e93aaee6b3348671

SHA1
24af63e9fcd6439d007f2dd95a3e1725ef139017

SHA256
1cfa72ae8f2c074bc54fc321889abbd48e67bbe3f8f2083c34577886b7e72446

SHA512
bfeb7dcacfcf8d25e3080789431a9177b06542a87cf480c0f1a593b02dad4693d177e3306a48c9533d4277d062c1e9a345dc2d720cdf34fb52da6e8ce6e584a8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c918e292-493b-4a4b-beda-9ac97b1e8a9a}\0.2.filtertrie.intermediate.txt

Filesize
1KB

MD5
8f5a5703fa53ebce270dc967bc039bd0

SHA1
a931bb9b3cc268507e6eab0089ac8aa2ed520084

SHA256
2c5029b02603c7deb200f821b79f849a73e8f25768bd1a487fe7ec0f31169d96

SHA512
d1e89885cdc62b3de652300d335806d76d9eb3fa783dd2ac59c7498fee7e278b9beaef3a0fa26eae4a42ab66a618be091191e81ce0eb12bea62959dddb71dc6a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656226049089.txt

Filesize
78KB

MD5
f24ef35f774c807cdb936dd41f028970

SHA1
4c0670202268d176c20744d9b04a1cabfc3d694d

SHA256
766583a0fb73ba29632d59166a76815dc05b322b82956790c44a5aa38bccfdce

SHA512
00f759984122b7059cb9ee9bf99dabfa2f101071e2631e2227c1c8a99adaa06ffcaf5e0424fddd78d15eb325d8bf41b993e9f2b98a0b5ca9e2de8c72346d57ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656623420834.txt

Filesize
48KB

MD5
1195cde8180b66bfae49ff72413a3fdb

SHA1
017fee44017c162aed9bf6a0426265020527f355

SHA256
e605c67b8a6e5d13dc61ca1fbb1c4c71ab9bc8bcd87fc13b4d6cb69cd8091391

SHA512
da2011523df07a34d462806509addf3b7bdf58e62476c8ee89e49c4b47c991bb1e447220336e06e882a469e274ae5c8b790aea7272d53933c6ec6d5707cf9782

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663536793873.txt

Filesize
64KB

MD5
9021e77594523aa5b56e1e5dc4baccb7

SHA1
75926ea9be08cda04d0fa00a4f7eb58284f446d0

SHA256
a41b9a7311488ca50fd6efae0729f2bb0d1d2c8e638ee0819ff95ab47fe31c66

SHA512
b1df46c7a4d88c4bf9f49a2a0868b8cb4cd02966363fbdb12f27798562ad6c227e4d99ef6897f2153e41dc67496036f3444f5d32d5c6b52b710f1257e6eec2f6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt

Filesize
75KB

MD5
8e10583a566899e906f8cb733dfe1c58

SHA1
58a5dc6d10deb00a57d7c8b9c5bc81b4b0627b14

SHA256
4e4cb4f2bf11abd73193a08d312a8d2eb5c728ddf9221fcf936e08b421b0c582

SHA512
ca345dee5c5087c4ae39e977568f57e85d689500308a8b11234b836ab11c9b6f8513f00866d508b1839695a82d998f8534c0d18b591763c7321e9753456fc4ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\settings.dat

Filesize
8KB

MD5
4cf87ee62a4acfb1473677084d90ce27

SHA1
4ace86e6c0c14f0a4e6297a4fa2db9af46e78af3

SHA256
b17d8033ec6af226fcb93a6bfbac4b757faf0d04db88ba66432ac850a146110a

SHA512
91c834edbbefd8fda59bbea7b5e8172b1dacbab1cbe72ba4dd7a75743754080cd116e6449b28b13dde574ff489dfe4e9edeba91a385801c827f2d0b319365a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\melt.txt

Filesize
43B

MD5
5bfe1cacebe89b8345439d826187ed01

SHA1
e544d6b74ea8333709c9b94b4407fafeb9d4c73e

SHA256
db30f97a80fef0c27c11c2f390b431bc5d5839171c97d77fa7a1bbb0d9626bcb

SHA512
ba2203d3a95f0c301efd819604427a46de8f01060cbf54d4c3f85eaf3753193a9ffce48bbc20bd21338accc160585f3cb9c5a52c0507d1cdfaac79225f2f81b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl

Filesize
246KB

MD5
695af7a6241efc31bf6f268d12beb587

SHA1
6c9a8a70670268058494428670561921e1146201

SHA256
6deb36a2946d602aa7295448781862d92b7afb14c213e9fc5da73973b22b429c

SHA512
58768c41e0a176d8a34a2fe97da06c8f944176599a1b0deaa0dc89851a011412a508fcb0e5618c0641dc725f47b2829ee5b36978ea0ed3fe8d9f89864b6c1dad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

Filesize
48KB

MD5
44ba394d103fafb5eaf50da90e1ac468

SHA1
599e33114415553a0571def8d8f3491690424a95

SHA256
832d26e78d1407eeacb27cde00dff77bcd6578ac8300998e43299b6483af134e

SHA512
4d440b84fa0c4a86330d141bffd1a8f887581a1511905f902f50157824f34ee1c8c314f5e316fddfc86c40ef41506fed70f58dea93cd4ec6c0daab7f84b697b9

Download Submit
C:\Users\Admin\Downloads\761064f2-9524-4df9-a470-2fd693ad640b.tmp

Filesize
4.0MB

MD5
1d9045870dbd31e2e399a4e8ecd9302f

SHA1
7857c1ebfd1b37756d106027ed03121d8e7887cf

SHA256
9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

SHA512
9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

Download Submit
C:\Users\Admin\Downloads\BabylonToolbar (1).txt.crdownload

Filesize
57B

MD5
2ab0eb54f6e9388131e13a53d2c2af6c

SHA1
f64663b25c9141b54fe4fad4ee39e148f6d7f50a

SHA256
d24eee3b220c71fced3227906b0feed755d2e2b39958dd8cd378123dde692426

SHA512
6b5048eeff122ae33194f3f6089418e3492118288038007d62cdd30a384c79874c0728a2098a29d8ce1a9f2b4ba5f9683b3f440f85196d50dc8bc1275a909260

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 262095.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 50980.crdownload

Filesize
254KB

MD5
e3b7d39be5e821b59636d0fe7c2944cc

SHA1
00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88

SHA256
389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97

SHA512
8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 630945.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\VanToM-Rat.bat

Filesize
184KB

MD5
8cc6ce1c914192e9afefb53e6edc2ec2

SHA1
f2c1243e975e0051161f0ddc4123208fff88ef81

SHA256
4abff6b6af6eeae6f18b28e7bd9e5831794309ce2bc2df4a6dcd92952efa972d

SHA512
acfc143806f88b89a2dcc38d5a1cffdc622558e3de214702a19f818e21fe539da469b3aa12ea51defb07231d8428b226e843fd887e1da768fbedda4114a50f83

Download Submit
C:\Users\Admin\Downloads\c5787670-c382-4ac9-8f5e-c8b7d0463772.tmp

Filesize
183KB

MD5
3d4e3f149f3d0cdfe76bf8b235742c97

SHA1
0e0e34b5fd8c15547ca98027e49b1dcf37146d95

SHA256
b15c7cf9097195fb5426d4028fd2f6352325400beb1e32431395393910e0b10a

SHA512
8c9d2a506135431adcfd35446b69b20fe12f39c0694f1464c534a6bf01ebc5f815c948783508e06b14ff4cc33f44e220122bf2a42d2e97afa646b714a88addff

Download Submit
C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Filesize
778B

MD5
5710a0b6f8bf6f0fdc7f197df8aa732c

SHA1
77abf5ff1ead609920bbe32074ec8bc9027aa81e

SHA256
a64ead410fb7cb7ec2c3e28206192460b83dbd7275f27888f3f35bc31ed0594f

SHA512
9a4615c7d202b7bcf4aa2fffb7e26412c9fd32b51c70dce1b7d1886d857d864ee13038b1e007db159a6ac16d32ab537beba61a1ee3a5cc2afd60fd5be04af9cf

Download Submit
memory/2548-1765-0x00000000006F0000-0x000000000070A000-memory.dmp

Filesize
104KB

Download
memory/2548-2480-0x00000000006F0000-0x000000000070A000-memory.dmp

Filesize
104KB

Download
memory/2940-1422-0x000000001EFE0000-0x000000001F2EE000-memory.dmp

Filesize
3.1MB

Download
memory/2940-1421-0x000000001C780000-0x000000001C7CC000-memory.dmp

Filesize
304KB

Download
memory/2940-1420-0x00000000015C0000-0x00000000015C8000-memory.dmp

Filesize
32KB

Download
memory/2940-1410-0x000000001C620000-0x000000001C6BC000-memory.dmp

Filesize
624KB

Download
memory/2940-1409-0x000000001C020000-0x000000001C4EE000-memory.dmp

Filesize
4.8MB

Download
memory/2940-1408-0x000000001BAA0000-0x000000001BB46000-memory.dmp

Filesize
664KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads