hxxps://fastupload[.]io/en/MGO06lofZZeU7iN/file

Analysis

max time kernel
294s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-03-2023 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://fastupload.io/en/MGO06lofZZeU7iN/file

Score

7^/10

agilenet pyinstaller spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

Processes:

Installer.exeInstaller.exeMercurial.exeMercurial.exeMercurial.exeInstaller.exeInstaller.exeInstaller.exeInstaller.exeInstaller.exeInstaller.exe

pid	process
1100	Installer.exe
6456	Installer.exe
3404	Mercurial.exe
528	Mercurial.exe
5768	Mercurial.exe
6644	Installer.exe
5908	Installer.exe
6548	Installer.exe
5508	Installer.exe
1536	Installer.exe
6120	Installer.exe

Loads dropped DLL 64 IoCs

Processes:

Installer.exeInstaller.exe

pid	process
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
6456	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe
5908	Installer.exe

Obfuscated with Agile.Net obfuscator 4 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/5768-1138-0x000000000C380000-0x000000000C480000-memory.dmp	agile_net
behavioral1/memory/5768-1139-0x000000000C380000-0x000000000C480000-memory.dmp	agile_net
behavioral1/memory/5768-1142-0x000000000C380000-0x000000000C480000-memory.dmp	agile_net
behavioral1/memory/5768-1145-0x000000000C380000-0x000000000C480000-memory.dmp	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

629 api.ipify.org
630 api.ipify.org
631 api.ipify.org
608 api.ipify.org
609 api.ipify.org

flow	ioc
629	api.ipify.org
630	api.ipify.org
631	api.ipify.org
608	api.ipify.org
609	api.ipify.org

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\58f8917f-5d4a-40ce-ac2f-a3f382e00268.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230301180540.pma	setup.exe

Detects Pyinstaller 3 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Mercurial\Installer.exe	pyinstaller
C:\Users\Admin\Downloads\Mercurial\Installer.exe	pyinstaller
C:\Users\Admin\Downloads\Mercurial\Installer.exe	pyinstaller

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
6200	3404	WerFault.exe	Mercurial.exe
6824	3404	WerFault.exe	Mercurial.exe
6960	5768	WerFault.exe	Mercurial.exe
5916	5768	WerFault.exe	Mercurial.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

Processes:

msedge.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

powershell.exemsedge.exemsedge.exemsedge.exeidentity_helper.exeMercurial.exeMercurial.exeMercurial.exe

pid	process
3796	powershell.exe
3796	powershell.exe
4800	msedge.exe
4800	msedge.exe
2768	msedge.exe
2768	msedge.exe
6560	msedge.exe
6560	msedge.exe
5896	identity_helper.exe
5896	identity_helper.exe
3404	Mercurial.exe
3404	Mercurial.exe
3404	Mercurial.exe
3404	Mercurial.exe
3404	Mercurial.exe
3404	Mercurial.exe
3404	Mercurial.exe
3404	Mercurial.exe
528	Mercurial.exe
528	Mercurial.exe
528	Mercurial.exe
528	Mercurial.exe
528	Mercurial.exe
528	Mercurial.exe
528	Mercurial.exe
528	Mercurial.exe
5768	Mercurial.exe
5768	Mercurial.exe
5768	Mercurial.exe
5768	Mercurial.exe
5768	Mercurial.exe
5768	Mercurial.exe
5768	Mercurial.exe
5768	Mercurial.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs

Processes:

msedge.exe

pid	process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

powershell.exe7zG.exeMercurial.exeMercurial.exeMercurial.exe

description	pid	process
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeRestorePrivilege	4712	7zG.exe
Token: 35	4712	7zG.exe
Token: SeSecurityPrivilege	4712	7zG.exe
Token: SeSecurityPrivilege	4712	7zG.exe
Token: SeDebugPrivilege	3404	Mercurial.exe
Token: SeDebugPrivilege	528	Mercurial.exe
Token: SeDebugPrivilege	5768	Mercurial.exe

Suspicious use of FindShellTrayWindow 15 IoCs

Processes:

msedge.exe7zG.exe

pid	process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
4712	7zG.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2768 wrote to memory of 4108	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 4108	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 5104	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 4800	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 4800	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe
PID 2768 wrote to memory of 3148	2768	msedge.exe	msedge.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://fastupload.io/en/MGO06lofZZeU7iN/file
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://fastupload.io/en/MGO06lofZZeU7iN/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdac4346f8,0x7ffdac434708,0x7ffdac434718
2⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
2⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
2⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2492 /prefetch:1
2⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
2⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
2⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
2⤵
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
2⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
2⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
2⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
2⤵
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
2⤵
PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
2⤵
PID:5724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
2⤵
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
2⤵
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7932 /prefetch:1
2⤵
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7944 /prefetch:1
2⤵
PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9324 /prefetch:1
2⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9464 /prefetch:1
2⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9348 /prefetch:1
2⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9816 /prefetch:1
2⤵
PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10016 /prefetch:1
2⤵
PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8968 /prefetch:1
2⤵
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10140 /prefetch:1
2⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10640 /prefetch:1
2⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10636 /prefetch:1
2⤵
PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9620 /prefetch:1
2⤵
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10628 /prefetch:1
2⤵
PID:6172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=11344 /prefetch:8
2⤵
PID:6400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11352 /prefetch:1
2⤵
PID:6412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11644 /prefetch:1
2⤵
PID:6528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11668 /prefetch:1
2⤵
PID:6544

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
2⤵
- Drops file in Program Files directory
PID:6900

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7e33a5460,0x7ff7e33a5470,0x7ff7e33a5480
3⤵
PID:6944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11784 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11904 /prefetch:1
2⤵
PID:6604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11944 /prefetch:1
2⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11952 /prefetch:1
2⤵
PID:6728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9804 /prefetch:1
2⤵
PID:6748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11896 /prefetch:1
2⤵
PID:6808

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10916 /prefetch:8
2⤵
PID:6820

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10916 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
2⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14806772625227881811,10407740448373424213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
2⤵
PID:6344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6660

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Mercurial\" -ad -an -ai#7zMap16491:80:7zEvent5914
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4712

C:\Users\Admin\Downloads\Mercurial\Installer.exe
"C:\Users\Admin\Downloads\Mercurial\Installer.exe"
1⤵
- Executes dropped EXE
PID:1100

C:\Users\Admin\Downloads\Mercurial\Installer.exe
"C:\Users\Admin\Downloads\Mercurial\Installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6456

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Mercurial\READ BEFORE DOING ANYTHING!!.txt
1⤵
PID:4252

C:\Users\Admin\Downloads\Mercurial\Mercurial.exe
"C:\Users\Admin\Downloads\Mercurial\Mercurial.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1688
2⤵
- Program crash
PID:6200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 2480
2⤵
- Program crash
PID:6824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3404 -ip 3404
1⤵
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3404 -ip 3404
1⤵
PID:6772

C:\Users\Admin\Downloads\Mercurial\Mercurial.exe
"C:\Users\Admin\Downloads\Mercurial\Mercurial.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\prexnbqf\prexnbqf.cmdline"
2⤵
PID:5084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES15FF.tmp" "c:\Users\Admin\Downloads\Mercurial\CSC32045EB3F3934E93BBC04312D74F5577.TMP"
3⤵
PID:3572

C:\Users\Admin\Downloads\Mercurial\Mercurial.exe
"C:\Users\Admin\Downloads\Mercurial\Mercurial.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 1468
2⤵
- Program crash
PID:6960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 1468
2⤵
- Program crash
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5768 -ip 5768
1⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5768 -ip 5768
1⤵
PID:1400

C:\Users\Admin\Downloads\Mercurial\Installer.exe
"C:\Users\Admin\Downloads\Mercurial\Installer.exe"
1⤵
- Executes dropped EXE
PID:6644

C:\Users\Admin\Downloads\Mercurial\Installer.exe
"C:\Users\Admin\Downloads\Mercurial\Installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5908

C:\Users\Admin\Downloads\Mercurial\Installer.exe
"C:\Users\Admin\Downloads\Mercurial\Installer.exe"
1⤵
- Executes dropped EXE
PID:6548

C:\Users\Admin\Downloads\Mercurial\Installer.exe
"C:\Users\Admin\Downloads\Mercurial\Installer.exe"
2⤵
- Executes dropped EXE
PID:5508

C:\Users\Admin\Downloads\Mercurial\Installer.exe
"C:\Users\Admin\Downloads\Mercurial\Installer.exe"
1⤵
- Executes dropped EXE
PID:1536

C:\Users\Admin\Downloads\Mercurial\Installer.exe
"C:\Users\Admin\Downloads\Mercurial\Installer.exe"
2⤵
- Executes dropped EXE
PID:6120

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
Filesize
160KB

MD5
7f27adb1216e4ddb02884fd68a1ec297

SHA1
a33a85dfc58ca995fa184035b8fdb896866c361f

SHA256
aeea36b977f073b902c2c5536b21f43e931fc2ac5ba3601db228e686457e9bc8

SHA512
c1327064f05a62fe28f99830a33ad72b36f9345bb1c7de779461febfae5eea985aaf4a67f069f0e2cfec74b72b3f2d61822a4ff6689ff909c0b9d13ece5ba724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
188d0dccab486cfade996e5d92383d13

SHA1
0d1189f0c3a8cb9f9d30096259970e94dd341f0a

SHA256
ae02c0c19601d8f353db50164939f93ad517415e76c19f65f59766e774ce3bfa

SHA512
bb2c235dea076199153ab9550766d75530f4ae152d072cb7406025b12bbaecbae8d1bad221b68f31d9f2b1ab02522a0dfa2442cedc5eabd1ef433b6fae7ff30a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe56fb3d.TMP
Filesize
48B

MD5
fd43b98a6f9339474d78de8868dcddd6

SHA1
9817448bdc9c60c66f8fafef20cab2682b3bcb3b

SHA256
18604d172550c898edc0cf5a2c4a3c29259dd3bec8ce84bcd36ddb56f600ba7f

SHA512
2e17aa6ca530e00b5d5dcbd25151797cc4a9548b4da0ede5693fd1a2bc974aed8d5eb2c4a9fa47f9be927004219bae850a5bf72fcbc41933605e40a2ad54cb9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
3b0769d478d38628918affbc428f7801

SHA1
1fcc974ae301ee4e2bd0eb149291ad4d369ebc97

SHA256
9cb8c70613a13b43726c568cba763d16b1845b1466c8661e337117633b0998f7

SHA512
33392a673b08cbe0b38a9eca98732d82e3afe3b5b232fbd87464534c911ce09d5b860de1b344177158c1599cc4b786572a3528df48a9ccef4e290f72b3ed58c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
10KB

MD5
9276522e18fee0a2e104b4d16af91f1c

SHA1
0a54e8d9a428df9e1843a273fab587f72123f35e

SHA256
c3c74953fc8846dc8e32175380b200e7dfb0c0eeb436d5c6c2b4b0cb67a1a80d

SHA512
a1e568272e0e1dcb67508da111e2342b673063b778bb5956d120f7cb8c50ed29b5762c1110fa4d44df8c322fd95340c707cd3d232e2d5efc7524bcc93fd6e557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ce0136af58d89be16fef099048bb808f

SHA1
20dc36a29f9ff2644135c386097341bc114de5d7

SHA256
9b7c410d86367af08e01556b45dec275db61f588ffa9c5fe0730fe910bfee1f6

SHA512
44553afba831da7463bf8441e05de7506df8e657c05c162b838cd9d230f6385f504f6b5988c331c0eab9cc1e1bbff70d0e14777997f904054eacf95622978a23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
13KB

MD5
bc0365e3eaa391ff5c8f028082fd72e7

SHA1
90b6b52ab1efe06fd042636ae8f26d47bee04c41

SHA256
becedd9f717dd4b684c96c88e1b360af1faf9dd7ccb12763fcc5830fb4e22b60

SHA512
dc4698f36a8678c783871ac59e78ba40436dbd536a4d3bfd3675784159d6ee9dfa750854772ccccb24c7a0bb5378c72aec1ba08a259c56e4d10c72c0eb9a8541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
f98f34aa8fbcb353cd9985b5408422f2

SHA1
f761c3a191afcafabe7aebc7d6c8c7202d47b25a

SHA256
acf85a22563089d1ce31da9174a5634591cd1edeae19974ff098ff5772fae086

SHA512
f2dc649254eaf478430076a7525dbf891816201904c3c0d0c81732f2d1bbe2044944115f575cb5288ce1aa7d7ac41cc64497e82933f4e3fa8bec35b5b805cd6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
17KB

MD5
1041f0470ece83d318c30cc58a72aa1a

SHA1
fd21a22667e3ecf230cb35abac17bc70c6cbda64

SHA256
7d4da7c987f8d0a76901153bae63a1a76da094781e45e7b7e06247603985d551

SHA512
91180035959f2288794f55e6cbdf53b5e7c06b7f9e4077affd4e6bf3ff8ea1fb147a83d550cef6f9b37a735177ede4dca30a65a8a1cf365d4ffeb52776f50f30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
bc0f042a1cf5a035889652e22ad46d3f

SHA1
10e09652f8e42c83d146c5368e971d47776ae9a0

SHA256
677a807e95064c3c728f66e9c38865c6f6bb3f079e5f0e36632a7cf2697ab7b7

SHA512
e37d11aa04d4b5a63b5aa3a3be41021f2005cd4e9bc864d4a5e21086569e182aa472504d588e3e0f9c409a21ce13d5ac27bbf5d6f81c847c9039cb19fd62f9f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
c6d3a0201b401a88eb9ababd620f5b33

SHA1
8853a29ed376913001025fde3b19783d8f3ef03d

SHA256
359400be5e1a0d0f4f367af47f82bba93b8db73c2fba4cf99aa2e954129819fe

SHA512
05874894d1ddce206dc886010f41d3168005db56fa713cb81186ef8dabfd9bca6aa9c20d1560564892b1e333ce3b8cf354bc77f406a70678eedff28aeaeadcc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56ee5c.TMP
Filesize
3KB

MD5
d2526c1e570157e43d1a90321a4d09dc

SHA1
25408ca94ef0f70706f3eff113ec54fe132cfef2

SHA256
fd7b9a177a95cce37b39d5fe626d56cefec3cf483258396fd02ed291b31e8a57

SHA512
56cde0b5e5a0af56e5796b622384a9aceb3c952ee5a01764357a17233406242db7922c8c6c631d93350692740dc720a5cfe0fdeaa93aeefc11d87b0959fd57ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
f1bd11a5b24577f35412e603b3a6154b

SHA1
3c7f4c87ab455f686eb496873e05551f8721b27b

SHA256
fb54b7c506745c6d0d5dfdb3f5bb10277c6ff35bc11e9ccecb25deb9628152fe

SHA512
6c345331e3bfb379ed91f1ee2231f91a912f37459c6621a63033cceddbcd9dec4f7d53c91cb5e45a41c5f5e8e7820f9c14c1992f38351758d2daaa73d7b5c098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
fa0323e218a4c1557b24b295f243dd47

SHA1
9538479710fada24745f2be17a335babe1befa6f

SHA256
ff41f1aa24fe489599bd56e1164748f5757702f12fcfa23d6d35227cf599f6a7

SHA512
00b6aef56c869d0ff65ba09e05150b86b2c1fbcb95cdc6761aaa3278b92e53f747a1a016ac33c64c665a2d7837d372bad45b468ee5df1d780632d6ec4f018f50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
bb3aa3a7ca974a9c146b748b18394d8e

SHA1
2440e22632572182740d8bd859ce9295caaa3974

SHA256
071c983d5c4b59f785ca398032397291edbe6242885dd65ac1d626802ef438fe

SHA512
b0ae76391e0e5b81b60937e21ba456e8230b058b76313eff7f143531ddf56bff7ba2bdd5325208df311b676ce5069475f25d2e7290ac7754d8ab45e9625206c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\VCRUNTIME140.dll
Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\VCRUNTIME140.dll
Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\_bz2.pyd
Filesize
81KB

MD5
bbe89cf70b64f38c67b7bf23c0ea8a48

SHA1
44577016e9c7b463a79b966b67c3ecc868957470

SHA256
775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723

SHA512
3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\_bz2.pyd
Filesize
81KB

MD5
bbe89cf70b64f38c67b7bf23c0ea8a48

SHA1
44577016e9c7b463a79b966b67c3ecc868957470

SHA256
775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723

SHA512
3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\_ctypes.pyd
Filesize
119KB

MD5
ca4cef051737b0e4e56b7d597238df94

SHA1
583df3f7ecade0252fdff608eb969439956f5c4a

SHA256
e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

SHA512
17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\_ctypes.pyd
Filesize
119KB

MD5
ca4cef051737b0e4e56b7d597238df94

SHA1
583df3f7ecade0252fdff608eb969439956f5c4a

SHA256
e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

SHA512
17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\_lzma.pyd
Filesize
153KB

MD5
0a94c9f3d7728cf96326db3ab3646d40

SHA1
8081df1dca4a8520604e134672c4be79eb202d14

SHA256
0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31

SHA512
6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\_lzma.pyd
Filesize
153KB

MD5
0a94c9f3d7728cf96326db3ab3646d40

SHA1
8081df1dca4a8520604e134672c4be79eb202d14

SHA256
0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31

SHA512
6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\_socket.pyd
Filesize
75KB

MD5
0f5e64e33f4d328ef11357635707d154

SHA1
8b6dcb4b9952b362f739a3f16ae96c44bea94a0e

SHA256
8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe

SHA512
4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\_socket.pyd
Filesize
75KB

MD5
0f5e64e33f4d328ef11357635707d154

SHA1
8b6dcb4b9952b362f739a3f16ae96c44bea94a0e

SHA256
8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe

SHA512
4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\base_library.zip
Filesize
1.0MB

MD5
c9c13fb3880562e11028bdd5727720b4

SHA1
7afd1d916cca703125bba42578029ef723c967e3

SHA256
72f03eff9aeaf6b9c25918637b064f8d4780c67362bc7f2e5dc9e4f735d166b1

SHA512
bc52f3749e2c72a5864e12a6a6374f8a4cde4a2378a41e9d4e42c5552c3af3ec7326d769b6fb52edc4bcd886b163c859a2fa41115731e6b5b9c6d29277dc27d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\python310.dll
Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\python310.dll
Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\select.pyd
Filesize
28KB

MD5
c119811a40667dca93dfe6faa418f47a

SHA1
113e792b7dcec4366fc273e80b1fc404c309074c

SHA256
8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7

SHA512
107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11002\select.pyd
Filesize
28KB

MD5
c119811a40667dca93dfe6faa418f47a

SHA1
113e792b7dcec4366fc273e80b1fc404c309074c

SHA256
8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7

SHA512
107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zzxswk0j.eug.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3mcd6uyw.sqlite
Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7eakva6r.sqlite
Filesize
32KB

MD5
98927a2c8c37358d4eb9f3f5b891b1c1

SHA1
dab5eb455874882f220538e245d260a99b4e6f3a

SHA256
af0259452b5630997326008fc22258fc95654f8b63bda70695223895aed1ac42

SHA512
c2f16a0c0fb008ba6890cebcff6fae0b1a59bcc3f742568d81c980c415cd3eabe535395be56a1d2743b06b38a2b1ac6b8778a82961f5d5e5cd4779f3318cc5d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpp9sa7o19.sqlite
Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
5902c38c5395ad0d4f138e3d859b6427

SHA1
97d39825e5049995deaff2ec59ed2f063a992aad

SHA256
715ae8088dee010aa37543ccbd5c403554eae11deca504cb295aafe85969535c

SHA512
335d338e27e52c6bfd223fd402e238197dad539aff6cab2c6518e6e72051bbb2ac4aaa25f211731729b58e85956ca9d0076d498847d40f217913275c912d344f

Download Submit
C:\Users\Admin\Downloads\Mercurial.zip
Filesize
11.0MB

MD5
306dc14e1174b904439dc30866f6ed2b

SHA1
869791fc4ebcaabe3d9ba6c9895c3c21c366a72b

SHA256
8ced29552a2adff610c3c42188a1d2df9784823fe56e33feba523d26922b701d

SHA512
b542b95825b3da4e801b67aea7246e5a128544f352d4ba02207f933b6ed12b381856ba46b99372bc9d14d7eba6a4863a61b0da0423b1570969ba5c7b9a40b4ca

Download Submit
C:\Users\Admin\Downloads\Mercurial.zip
Filesize
11.0MB

MD5
306dc14e1174b904439dc30866f6ed2b

SHA1
869791fc4ebcaabe3d9ba6c9895c3c21c366a72b

SHA256
8ced29552a2adff610c3c42188a1d2df9784823fe56e33feba523d26922b701d

SHA512
b542b95825b3da4e801b67aea7246e5a128544f352d4ba02207f933b6ed12b381856ba46b99372bc9d14d7eba6a4863a61b0da0423b1570969ba5c7b9a40b4ca

Download Submit
C:\Users\Admin\Downloads\Mercurial\Installer.exe
Filesize
8.3MB

MD5
7a821b56edae28a720e8278575100125

SHA1
9e17ebac0a79684efc562e047654d5d0d8313f98

SHA256
9e122b719c83b085c936df665b5b299d689143d9c9d08d42a9a2cc1258e495f8

SHA512
713ebe22dc5d689c9db19bf341620178b19abde180f63105b2f69c67562d60ad6377880eee7dc66a1ce8a52af5ff9a0e1fc18c32531bb13f5ea75fb3677e0128

Download Submit
C:\Users\Admin\Downloads\Mercurial\Installer.exe
Filesize
8.3MB

MD5
7a821b56edae28a720e8278575100125

SHA1
9e17ebac0a79684efc562e047654d5d0d8313f98

SHA256
9e122b719c83b085c936df665b5b299d689143d9c9d08d42a9a2cc1258e495f8

SHA512
713ebe22dc5d689c9db19bf341620178b19abde180f63105b2f69c67562d60ad6377880eee7dc66a1ce8a52af5ff9a0e1fc18c32531bb13f5ea75fb3677e0128

Download Submit
C:\Users\Admin\Downloads\Mercurial\Installer.exe
Filesize
8.3MB

MD5
7a821b56edae28a720e8278575100125

SHA1
9e17ebac0a79684efc562e047654d5d0d8313f98

SHA256
9e122b719c83b085c936df665b5b299d689143d9c9d08d42a9a2cc1258e495f8

SHA512
713ebe22dc5d689c9db19bf341620178b19abde180f63105b2f69c67562d60ad6377880eee7dc66a1ce8a52af5ff9a0e1fc18c32531bb13f5ea75fb3677e0128

Download Submit
\??\pipe\LOCAL\crashpad_2768_OLNNYWNHTSIHTNCE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/528-1117-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1091-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1120-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1119-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1118-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1099-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1098-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1097-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1096-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1095-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1094-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1093-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/528-1092-0x0000000005A90000-0x0000000005AA0000-memory.dmp

Filesize
64KB

Download
memory/3404-1082-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1078-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1080-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1081-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1068-0x0000000000F30000-0x000000000126A000-memory.dmp

Filesize
3.2MB

Download
memory/3404-1083-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1084-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1085-0x000000000C870000-0x000000000C970000-memory.dmp

Filesize
1024KB

Download
memory/3404-1086-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1087-0x000000000C870000-0x000000000C970000-memory.dmp

Filesize
1024KB

Download
memory/3404-1088-0x000000000C870000-0x000000000C970000-memory.dmp

Filesize
1024KB

Download
memory/3404-1089-0x000000000C870000-0x000000000C970000-memory.dmp

Filesize
1024KB

Download
memory/3404-1090-0x000000000C870000-0x000000000C970000-memory.dmp

Filesize
1024KB

Download
memory/3404-1079-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1077-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1076-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1075-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1074-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1073-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1072-0x0000000005E00000-0x0000000005E10000-memory.dmp

Filesize
64KB

Download
memory/3404-1071-0x0000000005C20000-0x0000000005C2A000-memory.dmp

Filesize
40KB

Download
memory/3404-1070-0x0000000005C80000-0x0000000005D12000-memory.dmp

Filesize
584KB

Download
memory/3404-1069-0x00000000063C0000-0x0000000006964000-memory.dmp

Filesize
5.6MB

Download
memory/3796-139-0x000001D2EE9E0000-0x000001D2EEA02000-memory.dmp

Filesize
136KB

Download
memory/3796-143-0x000001D2EEA40000-0x000001D2EEA50000-memory.dmp

Filesize
64KB

Download
memory/3796-144-0x000001D2EEA40000-0x000001D2EEA50000-memory.dmp

Filesize
64KB

Download
memory/5104-159-0x00007FFDC9190000-0x00007FFDC9191000-memory.dmp

Filesize
4KB

Download
memory/5768-1123-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1124-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1125-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1126-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1127-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1128-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1129-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1130-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1131-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1132-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1133-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1134-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1135-0x000000000C380000-0x000000000C480000-memory.dmp

Filesize
1024KB

Download
memory/5768-1136-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5768-1137-0x000000000C380000-0x000000000C480000-memory.dmp

Filesize
1024KB

Download
memory/5768-1138-0x000000000C380000-0x000000000C480000-memory.dmp

Filesize
1024KB

Download
memory/5768-1139-0x000000000C380000-0x000000000C480000-memory.dmp

Filesize
1024KB

Download
memory/5768-1140-0x000000000C380000-0x000000000C480000-memory.dmp

Filesize
1024KB

Download
memory/5768-1141-0x000000000C380000-0x000000000C480000-memory.dmp

Filesize
1024KB

Download
memory/5768-1142-0x000000000C380000-0x000000000C480000-memory.dmp

Filesize
1024KB

Download
memory/5768-1143-0x000000000C380000-0x000000000C480000-memory.dmp

Filesize
1024KB

Download
memory/5768-1144-0x000000000C380000-0x000000000C480000-memory.dmp

Filesize
1024KB

Download
memory/5768-1145-0x000000000C380000-0x000000000C480000-memory.dmp

Filesize
1024KB

Download
memory/5768-1122-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/6400-587-0x00007FFDC9680000-0x00007FFDC9681000-memory.dmp

Filesize
4KB

Download
memory/6400-589-0x00007FFDC93A0000-0x00007FFDC93A1000-memory.dmp

Filesize
4KB

Download