hxxps://www[.]mediafire[.]com/file/rlt0z41y0ygpprm/Cu3ltotL7ambCE-1[.]1[.]1[.]150-elamigos[.]rar/file

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2023, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/rlt0z41y0ygpprm/Cu3ltotL7ambCE-1.1.1.150-elamigos.rar/file

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\75050284-e14d-4660-afa8-804bd6d0bc63.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230301175953.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4128	powershell.exe
4128	powershell.exe
2796	msedge.exe
2796	msedge.exe
5096	msedge.exe
5096	msedge.exe
5352	identity_helper.exe
5352	identity_helper.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1868	5096	msedge.exe	88
PID 5096 wrote to memory of 1868	5096	msedge.exe	88
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 1276	5096	msedge.exe	90
PID 5096 wrote to memory of 2796	5096	msedge.exe	91
PID 5096 wrote to memory of 2796	5096	msedge.exe	91
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93
PID 5096 wrote to memory of 3192	5096	msedge.exe	93

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://www.mediafire.com/file/rlt0z41y0ygpprm/Cu3ltotL7ambCE-1.1.1.150-elamigos.rar/file
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://www.mediafire.com/file/rlt0z41y0ygpprm/Cu3ltotL7ambCE-1.1.1.150-elamigos.rar/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcb16b46f8,0x7ffcb16b4708,0x7ffcb16b4718
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7a1225460,0x7ff7a1225470,0x7ff7a1225480
    3⤵
    PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7696 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8172 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7892 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16630399062479988470,10581718450341860021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1db53baf44edd6b1bc2b7576e2f01e12

SHA1
e35739fa87978775dcb3d8df5c8d2063631fa8df

SHA256
0d73ba3eea4c552ce3ffa767e4cd5fff4e459e543756987ab5d55f1e6d963f48

SHA512
84f544858803ac14bac962d2df1dbc7ed6e1134ecf16d242d7ee7316648b56b5bc095241363837bf0bf0afd16ca7deebe7afb7d40057604acbf09821fd5a9912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8e097977fdf13a1c5b3c1031c03b802

SHA1
79da16dcf202309516304da0377e55187ec30053

SHA256
f81eadf2855fb06ab53ced6782c63c0f98951ae01c480672d3ca2a278dcacbc6

SHA512
48e3199c372da95dae65fefc3c6f8204be8a404e4698ca54ff404b735ae5937c65beb69a88c83f7bf6cc1a71cba5482b680f5649a628fd6b21ecde18571cb008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
42a0825c49f40fe85abc8608de108db6

SHA1
8d0c6dac60c34935f8306ef62c8a17134347228e

SHA256
b2a8acf270a97c236d77c8a151739155b13fd422088eaefbf059c4349bc8b306

SHA512
af59ae7d59dc2ef0736b53e7183ba19587e810492a384c340876bc848b81fce15e25eefcffb563eb4620d961dcd12de31ef28238dac862f431397449ccd1b86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7287cc0058f3375ab9e6aa6ff46685b2

SHA1
11203b1593cf7d2987d421a2d88d9d8308e6840e

SHA256
45a7686d5bd3d33b2909119cf8e1cd17b98e0cf0fa2da897c6ed67aa20bd99ea

SHA512
66330a53de14ad90608051871df90ed65bd74a7eaf22ebbf091e55e19b484eb3ce896e66a125f7030e0e30a058b94bbe3ea7e25db97586f028de52111e03ff28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
6c5f52fb694e4699e00b8bcab388c13b

SHA1
b3fba09c1e3016b9abbfb9f052eedf3066289fe8

SHA256
1a7e4150aad3d601481560df0956a5b68553c373e86456b684f3ec65f6b8b4e6

SHA512
79c3a175418525020e099a5d024efa509ac109ddc4e20b09cd90aaf6a7a54a27fe53f714804262bd51efb9f02cd13311b14d0fa12070a1adfad1c794e8f46843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
8f59ba2d1a3d2e4394593246c5fddc49

SHA1
4e290c4b67ac813a34eb3e7f58da6b0f338ae844

SHA256
a815cc3946b930391fdf41d01d14fc405fd91574cd74efc2c44c1a3a9e86cc32

SHA512
70a636b7484a477437acad612fdd3ded1be772c0b4e74580e3eb0b41a911b069cde457dcc80a802b3449f4fa62fb26ae88b7747e61715be16698e44567d867c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
23f1345c006ea60533d8f1c60de17aca

SHA1
1e00331dc20a37b0a9a3e9389cb40c7e5cbbd463

SHA256
d6155343c89d7db111bd940d769c5b7307de60989d6c00849c77e6d0716bcdb2

SHA512
498893083dfad1ac806f6a5ab8a3771e721aa9a7651d8b6bddc01e3588144f902ea4d2cae1f2f25ad8aed4875755bbdb300211333f47599445fa2b72267c308e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2113619d52fe61145ea7a33c3059aed1

SHA1
7a53f788046379678567b2e44e3bb6d3d76c5344

SHA256
2ecec22215be0f8992b63105fda4fb437b25416060b21c85f9478e2327d74918

SHA512
0dba4a2a895af11533ae9e589768a736d0183271f0bb39c0d3c9854a49ac6dbd2c7fa633e725bb93f8210ccdc40d7dfa8541f4ba28cdf9ee189f5ed25e938c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
56c0521a9e03765421dc21a08cc45f79

SHA1
27ef9613b1b04cb2baeb81ccadecb499ec59e7c1

SHA256
9322e19183488596562ab914747977493d04aedd53564e10e17d4d7796815620

SHA512
5bc4222dca5acd4956d9e8778f9d1b01051b7ae3b24a19491a9c9f0d43e16ef2f7492c154afb798966050dd373cbc378445f14c7101ebfb885941ea5419aa616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
f1064a7efcfff9b31587ee53f9267ff7

SHA1
73bb6f66c1e4fde9f276a04dafbdd69b1422f34c

SHA256
2af018316001151dfbe4cb1aae8f00d744731eda35678e5a4804c7b6fdc185da

SHA512
eab4b89ffd7521cd7e1869d1870ebb8131a5c0df504617dabdf163bf2af26a54094a933eebbff6dd52d7929831ec7e832cec5aa9629d9a116472015e2497973a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
90712db8f8b63a6a07df6eed1a443ddc

SHA1
4b3d04c54aa1a0ff6f2a43886f78e7e3999c5427

SHA256
ee7379a06a6befbe402473fcaca4d1f9d8ab7604ee90c264558246539ea6928e

SHA512
6c3e91c794084507df14596a6d1735355b58d206a5f0ef2f77054be36c8362dccf5a7c38caac99b114ea125149aaa0e2cdede5876e2b78e167c9dbd76b3a481c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
d755f509ff484647473467d4f9a39c2e

SHA1
ac1891ff3ca73c9bd8df4d8dd4c953dd53c63d2e

SHA256
8dcb17ffd0cdb1bdbdc62342f6c551d48c91a55a6abfb27e252514cd96c306b7

SHA512
1b03138897d19bf415164c0c5e5a08964cfc69db78484048a3f85fae814d829b96d68941d2b70ea3882c057356adefc95eaf7b748744210dbf72c95b65d2eacd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b00c2151c9bc5566686ce009d5265158

SHA1
62995ba0a54abfa8d31d2ad1dbd86d425ec36b23

SHA256
122b2ae61d6865fd59ec8393c3c5e2d8958bff99565355a4ea06c9a8792f71d5

SHA512
68d0c6917b6924210c16ae430a06e6c621d13edf0d41c9c1f2eb21a89584dc7bb6eb1614097e58d0beb659003317a52dff303ad039684d1f7bc90a94557492da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56ee0e.TMP

Filesize
1KB

MD5
8a908d2865edb731675c7429aecaea2e

SHA1
e1a22ec154b783a9d483a5b7c12ec362ba101df3

SHA256
d0a092377b8ceb93cea11d365aa4b960a370bbadba4734dd60cd2729d61387a3

SHA512
bba4f6d026fb1bbaa9aec8d82790bcef658e98441fc014faef9bbb2702a7bdb01df1c459a6eebad6be2392c3d1b9e6b0122d8d892a4c36276d4769fa5f558fc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
15762c4a05876c0b24c535c9fd0c816d

SHA1
51d4aa659029eca689e943bdc1cb30282757d972

SHA256
e7e0a189e50e690fc8af09f66965b2c0e52a2d10a48d8ce9925e8eb9b356972e

SHA512
d0fbc0745205271e0505b73cff9aa70a6d8219c4a7e726c3207c285fb60c88ef7182f6f7ae1b9528bd908dd5e30acac16483510523f9cdcddfafd55570abe053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
21837b3cc2399c7b69d4347dd8056704

SHA1
3d7abcb07635284bb1111936077adc4dcd83bbf8

SHA256
b791bd2ae28553c9110549f771a62f1af70781339c83c01239592af734578015

SHA512
c34b2d026d8b4fa0989e8ff93f1ab8e13f4b90a8f42c753921f02876a17e189174c4227f116899df477e3a0f8b68e371ec938b1edb23b0a04523d8d93627f9af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
322bed3503ca79d860c2cddf237722d0

SHA1
d295ae8851f9bb875f6905802f84e401fc1f8996

SHA256
0860050b0fc8d50b455a927e6fb00300b496f453ee5a8da11962b9c0cbce6276

SHA512
a4149bc315ef23b9061e6fb7cb8babdbc7a81c1f9cf0923e37dddc7650f72444d2cd33ee7180483690180ccd6d7a93ab1a519ff99fc9ca62c61cc4ec169f2a9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c428f5ea9fc40f0bde471829b53ea6ca

SHA1
b870632875be6d9a3901fc9256ab499bfbcfb3e8

SHA256
c6d1079bcb672bc17795f1600acc0e9ad6579f8c75d1a7b0ad816848fd5a0a11

SHA512
15f108605deafcee8a656b8be436dd744c408a218a0c503adc2642d0833cd3f28ea89a5e67710ad2f69e0702683543b9392828e23b3b97fc9d630b9e0de878ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
14bcffbd7ed66496a3c47fed114752a9

SHA1
6175ae95d3b8cb2b8f682161b3028109d239500f

SHA256
c2c29f72da8af2c9d8b00bc8904a1006a6ebd52b8822cd7fda6d697bf915b667

SHA512
f637c86100299b483af26d19e973771bf0c55770de0ced5b0d86fc94c06bbc144dce2425fb8b6214b711ad51f148da91927424d4f7bc071b7c83bc10aecd1a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e1oft3j1.2ms.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
dba341b397b35c3ce9d975b69f893ac6

SHA1
a02e1f0282b424ea28d2fe41c0b2165b7690cd66

SHA256
9df008811437dc819a24d216b2298ec2d70e28a05b562c503ef6278bc3a09757

SHA512
a9c6652031e88c1d7e49cd54faf99fa8e37e9031244890f63ec3166b2783c9ad31452c3baafda2f803da9232beda3409fe983d5d2e8696dbf96e2d027b2bb72c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 253486.crdownload

Filesize
40.6MB

MD5
55e5d8d618511a6ddac380d4f5bb2e35

SHA1
54c1a2a7ea19daf8fb3b163c5f9ea2fcec10d55b

SHA256
0082ddd7900dd7251c8aa30ad637d01bc743dc7410bea4984b884dd2fd9b4679

SHA512
d59af4dee996d5bbbb14c58c20cb45e249a2542a4e9afe6c3ce6a9152edd518413f545aac6e80006bf3c41631c35eede117d33d447a3bd1bcce159306a3b8273

Download Submit
memory/1276-159-0x00007FFCCD380000-0x00007FFCCD381000-memory.dmp

Filesize
4KB

Download
memory/4128-133-0x0000022F8C670000-0x0000022F8C692000-memory.dmp

Filesize
136KB

Download
memory/4128-143-0x0000022FA4BD0000-0x0000022FA4BE0000-memory.dmp

Filesize
64KB

Download
memory/4128-144-0x0000022FA4BD0000-0x0000022FA4BE0000-memory.dmp

Filesize
64KB

Download
memory/4128-145-0x0000022FA4BD0000-0x0000022FA4BE0000-memory.dmp

Filesize
64KB

Download
memory/5868-445-0x00007FFCCEDC0000-0x00007FFCCEDC1000-memory.dmp

Filesize
4KB

Download
memory/5868-446-0x00000248A59C0000-0x00000248A59C1000-memory.dmp

Filesize
4KB

Download