ab114e1bddf5fffd3f53641e6584ed4ddf98a6d1e6b97ac782c0362d5b93fbb5

Analysis

max time kernel
158s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Policies__and_requirements_for candidates_during_the_term_of_the contract_Salary and _ benefits_list_2023.exe
Size

70.4MB
MD5

38739fdf925c3176f44c664f8ec36b88
SHA1

c06b8b5224b129f39957d3072c619a52bcabd4e0
SHA256

7579bea10744c76ff0a36331dee902c4b7cad701515b3b20817afa569322ae81
SHA512

3a097e6e06c00201e27e116b64c8b5442591f5afca9c6e75c269614d274fd703c3ebdfac67442d1ace8b8eeebfbbfb56d9edfe90f1565d6716102dd8be3e9fc2
SSDEEP

1572864:9rIQsGtBepKQIQxt4EHSEf7/JLFDf2UkjxCI7LL:RIQsGapY8t4Ebz/ZFDzIz

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2968	Policies__and_requirements_for candidates_during_the_term_of_the contract_Salary and _ benefits_list_2023.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2968-0-0x0000000000B30000-0x000000000145A000-memory.dmp	upx
behavioral2/memory/2968-78-0x0000000000B30000-0x000000000145A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe
2340	msedge.exe
2340	msedge.exe
4924	msedge.exe
4924	msedge.exe
4168	identity_helper.exe
4168	identity_helper.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4868	2968	Policies__and_requirements_for candidates_during_the_term_of_the contract_Salary and _ benefits_list_2023.exe	86
PID 2968 wrote to memory of 4868	2968	Policies__and_requirements_for candidates_during_the_term_of_the contract_Salary and _ benefits_list_2023.exe	86
PID 4868 wrote to memory of 2340	4868	powershell.exe	88
PID 4868 wrote to memory of 2340	4868	powershell.exe	88
PID 2340 wrote to memory of 4520	2340	msedge.exe	89
PID 2340 wrote to memory of 4520	2340	msedge.exe	89
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 3752	2340	msedge.exe	90
PID 2340 wrote to memory of 4924	2340	msedge.exe	91
PID 2340 wrote to memory of 4924	2340	msedge.exe	91
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92
PID 2340 wrote to memory of 2056	2340	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\Policies__and_requirements_for candidates_during_the_term_of_the contract_Salary and _ benefits_list_2023.exe
"C:\Users\Admin\AppData\Local\Temp\Policies__and_requirements_for candidates_during_the_term_of_the contract_Salary and _ benefits_list_2023.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\param.ps1"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Public\INDITEX2.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91c2f46f8,0x7ff91c2f4708,0x7ff91c2f4718
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 /prefetch:8
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5804 /prefetch:6
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15271816153043394824,12920837050297124737,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3960 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
858ea0790a06a3286c20ed20c3c9c4a5

SHA1
1fb0e660955bef84ef5bf43077a3f00c495a58f3

SHA256
3d0055650820c758bf15b7457190be0e45217edac57a122c2723bea21a774c08

SHA512
59b66c84e118a58ff26c1253dddb3ddf4c95f049cedc3e91432d845c1f14db005127d6c260f06c88c4976c0b69514902c526c4431aefa756b05594a23d5bb9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1e702cfc1f0ae7c34abb11fec864075

SHA1
46482c69f83b2579016481459dd8c725b984ffc0

SHA256
3e19e94780b5c187c3d859316237b0253b07f4d4d668668118e3443b6ad26bd0

SHA512
ce0282b3f5d773c480a5e419d8b7c848cf5c533bc44de63505884dc8667e21aa66e7469c6cebcdf3d5e7738dcb57435273e326c0d3d747a37d9ae8c50f8a33fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a0787b15d412a91a7ac2866357fec7ca

SHA1
5d99eba23c42c6b571cbd3c68fd5d3a1caf18f91

SHA256
f57734ff752342a577ea3788fd31e022f8fcea0194de903205c82879bb10ba3c

SHA512
98b8c9cb3be223ccb4db026b417d67369d86f743db9437905505bb023784ecf7636f852ce2e86dda8512145e1fe5b1ef30d722cfd204ee6ecc6aa2ea450124c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
28f9b91bfcc0931192d593c50fc61be5

SHA1
8091068c1e0be8dabc4a0d40ba75859a9800f069

SHA256
6134d746e23abb9b19570a1cba1f29d5f6443fb19ad5490955a5a73a6d6a63aa

SHA512
bf08c505525d0396421b716e10d4a45a5da61cb158171164032682b500a12b196f423f07cabb7414f7bbaf66e88a1d1f77b42111f6c9f5fbd69d9604bf56c30b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wvtygtfz.w5l.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk

Filesize
2KB

MD5
4410a64cc653096b46b7ff84b0fb1331

SHA1
62df3f827d6fd96ac0d15309007d9264f277ed82

SHA256
64b8a7cd184798ed7c608f0b3b1c638108d3b83672452fa30fcf8401728af9c6

SHA512
b84636690a7a5a44265165a7107c477705393258d22ee67f4ef6e7b92db5007002a9c2956532856bd46bba1bb0c01ff9222cb9bee17f81255cf6f66445729d5c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Filesize
2KB

MD5
c95b5e58a3a4eb8f1486412e6ac1ee9a

SHA1
71de17ce057730c56e3114aba983013ee5263c5f

SHA256
de77b1b1ad2d364df72890448804b8f827873b1720856c1948735595d318661d

SHA512
6ddf204dd27c4cd1779919a9395db233b8ddb7c0a639c24e06f9250f77033794ca37ec39a2e53af86a508b39ab0e80e2161dcbca0dad75d52bd8565fc07b3be4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

Filesize
2KB

MD5
4913b9eb0ae0d7c76f4932abbd16549e

SHA1
145c5b760a83c86d23c9beef9944bf2abe88a1ab

SHA256
55428c4780bce07b0e4e6088cabe18ebb11602e30068321a738e8719f4d78c04

SHA512
6515bd66db201d758401916082902f71636c0583a376b3a998109beb2628bcc95c65bb0fe23d1e9e7db2f22e1ece2a42b1d0711e9bba2758baf8b9b94bdfade0

Download Submit
C:\Users\Admin\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
7d7753dcda8d89eb7aafb7210e55f094

SHA1
bcd1f221db6be19bbf290afd6d0fcd8d34058a6b

SHA256
bd99db79b986421ea2a4fa950f5677f7a41634b37bff9f485cd18fcc3b6ed340

SHA512
be7adb56616903ebf2fbfe456b1e00e2e1bd9493fc9f4f041aa31d604c868f81452a45a4a299625aeec8686501442725f0dc5e05963f25ec60299356d15aff57

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
6007f4be718e200baa558c65d4ca8e8f

SHA1
5c78b0c50f318be63c5fa10aaacca063cb950522

SHA256
1372a70daa90faac26915121e673148ec216b4b3c2991f19aebe903eb890e1e4

SHA512
86d5032dd6e2a0f9a8a6f05e7b48ab181addcf934a2f319017a1cf7eb6ac1c795300f55cdf7bd1e377e06201975b22a1568fe097fdfb5f65048456f8615d96a0

Download Submit
C:\Users\Public\INDITEX2.pdf

Filesize
72KB

MD5
fcf4e0ff23405e66ca3b84ab492f4cd3

SHA1
b37572379db0b7cb97ce14ed53e64e78b2d0366e

SHA256
864ca03a33d39d206a848980b9ed7418f1a1ec474b94c76046c9ed1ea348ed1b

SHA512
5791aa2eb35fcee4140874443c7f5782f313e44bb765e2d90fb1c47b75325597aeeabdca6c5aedfb20d78dffcd1b27a2f7dda11e7db0a2127da8747eb63de398

Download Submit
C:\Users\Public\Libraries\libEGL.dll

Filesize
5.0MB

MD5
84b785b443b44521f02576019a56392d

SHA1
9ce93d97a8f88d25c27cc1f45605a9d5ff793c41

SHA256
e4f1e119c92ca070a8620302573cdf59b8591dca30fdeee70e78ec1c29832ab1

SHA512
6ad9e84595c249cbafcfbe4e1c06206fce69ddbcab97011fa2b407de93686387a5373d61e17144032c7d095684bc8491d4436a1073cec2b08d8a485adcb6972b

Download Submit
C:\Users\Public\param.ps1

Filesize
148B

MD5
49e913c2174205f601ed77ffccaeeac8

SHA1
156c9afd6f0d15f54c1d296dbc195b51abacdfc7

SHA256
ab95f377bf7ae66d26ae7d0d56b71dec096b026b8090f4c5a19ac677a9ffe047

SHA512
f5b6ea396ace58345c4bde831b0249557b7cbea77f799bb6c2b1c35c080230d98b98e12ee6d8938655e047d0b0f2f6ecb7466d36e7011743b83174fd8650d369

Download Submit
memory/2968-0-0x0000000000B30000-0x000000000145A000-memory.dmp

Filesize
9.2MB

Download
memory/2968-79-0x0000000059330000-0x0000000059840000-memory.dmp

Filesize
5.1MB

Download
memory/2968-78-0x0000000000B30000-0x000000000145A000-memory.dmp

Filesize
9.2MB

Download
memory/2968-1-0x00000232A1360000-0x00000232A1361000-memory.dmp

Filesize
4KB

Download
memory/4868-109-0x0000020BF7350000-0x0000020BF7360000-memory.dmp

Filesize
64KB

Download
memory/4868-81-0x0000020BF7350000-0x0000020BF7360000-memory.dmp

Filesize
64KB

Download
memory/4868-82-0x0000020BF7350000-0x0000020BF7360000-memory.dmp

Filesize
64KB

Download
memory/4868-108-0x00007FF921D30000-0x00007FF9227F1000-memory.dmp

Filesize
10.8MB

Download
memory/4868-83-0x0000020BF7350000-0x0000020BF7360000-memory.dmp

Filesize
64KB

Download
memory/4868-110-0x0000020BF7350000-0x0000020BF7360000-memory.dmp

Filesize
64KB

Download
memory/4868-111-0x0000020BF7350000-0x0000020BF7360000-memory.dmp

Filesize
64KB

Download
memory/4868-80-0x00007FF921D30000-0x00007FF9227F1000-memory.dmp

Filesize
10.8MB

Download
memory/4868-14-0x0000020BF9A40000-0x0000020BF9A62000-memory.dmp

Filesize
136KB

Download