80ddc435a98e1a997d85612fc81bf877012fbfb4148cc6ff99d13483e5981c3a

Analysis

max time kernel
274s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2023 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Image-Unstitcher.jar
Size

22KB
MD5

ee925f46306fdc8e19265454a9aa1f83
SHA1

2b45cef9750ebca29840cd9894a6a60dc2310352
SHA256

80ddc435a98e1a997d85612fc81bf877012fbfb4148cc6ff99d13483e5981c3a
SHA512

455df83badd4e61e3c60657139a43042268a3fe3c8d2dc55c4f0ad3681a6295a34aba641a9f2f43c695e54684928717c5a666b34603655d134f2e5c4628e217b
SSDEEP

384:ctU2f6c0B7iipFcQyN2GuIAydwBhhwHm69LwQoa7UKz:cia0xf+lr9a+do1Kz

Score

8^/10

discovery exploit pyinstaller

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Consequences Of Your Actions.exe

Possible privilege escalation attempt 42 IoCs

exploit

pid	Process
4444	takeown.exe
2320	icacls.exe
1876	icacls.exe
4628	icacls.exe
3944	takeown.exe
568	takeown.exe
3764	takeown.exe
4904	icacls.exe
2412	takeown.exe
1292	takeown.exe
4796	takeown.exe
4580	takeown.exe
3884	takeown.exe
4748	takeown.exe
3716	icacls.exe
4688	takeown.exe
4308	icacls.exe
400	icacls.exe
1296	icacls.exe
3260	takeown.exe
1180	icacls.exe
2740	icacls.exe
2072	icacls.exe
236	icacls.exe
1668	takeown.exe
4732	icacls.exe
3004	icacls.exe
3512	icacls.exe
1156	takeown.exe
2056	takeown.exe
4376	icacls.exe
2052	takeown.exe
1272	icacls.exe
1280	takeown.exe
1248	takeown.exe
2384	takeown.exe
1852	icacls.exe
3272	icacls.exe
2748	takeown.exe
1684	icacls.exe
2940	icacls.exe
4632	takeown.exe

Executes dropped EXE 2 IoCs

pid	Process
2012	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe

Loads dropped DLL 37 IoCs

pid	Process
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe
3644	Consequences Of Your Actions.exe

Modifies file permissions 1 TTPs 42 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1292	takeown.exe
4688	takeown.exe
2320	icacls.exe
2072	icacls.exe
3884	takeown.exe
4628	icacls.exe
1684	icacls.exe
2384	takeown.exe
1852	icacls.exe
2052	takeown.exe
1272	icacls.exe
4748	takeown.exe
4632	takeown.exe
3004	icacls.exe
3512	icacls.exe
2412	takeown.exe
1248	takeown.exe
2056	takeown.exe
1296	icacls.exe
2740	icacls.exe
1668	takeown.exe
2940	icacls.exe
4904	icacls.exe
3716	icacls.exe
4796	takeown.exe
4376	icacls.exe
3272	icacls.exe
3260	takeown.exe
1280	takeown.exe
3944	takeown.exe
568	takeown.exe
1156	takeown.exe
3764	takeown.exe
236	icacls.exe
4580	takeown.exe
1876	icacls.exe
4308	icacls.exe
400	icacls.exe
2748	takeown.exe
4732	icacls.exe
1180	icacls.exe
4444	takeown.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	Consequences Of Your Actions.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File created	C:\Windows\System32\CDlFaz7AegHXW89WrK6J.ovc	Consequences Of Your Actions.exe
File created	C:\Windows\System32\21kb4DUIbByaqhCq6OZH.JHD	Consequences Of Your Actions.exe
File created	C:\Windows\System32\a3U9yIJAGcf2CkmhwWdc.vC3	Consequences Of Your Actions.exe
File created	C:\Windows\System32\mQBvTNkatFc5xpuPYBjw.ZcW	Consequences Of Your Actions.exe
File created	C:\Windows\System32\XnEpejjF4nygjZ22jJAn.nFp	Consequences Of Your Actions.exe
File created	C:\Windows\System32\oVAiVjfu9ZyaiKCAeouL.nGv	Consequences Of Your Actions.exe
File created	C:\Windows\System32\kOeRHwkM9DZJVBwtVuLw.wYk	Consequences Of Your Actions.exe
File created	C:\Windows\System32\oIB0tMVE5F5z2eJl2Lsw.8wR	Consequences Of Your Actions.exe
File created	C:\Windows\System32\vAr3sitnGGvKaya6Xg7D.bTM	Consequences Of Your Actions.exe
File created	C:\Windows\System32\r4flLwZVr6WuhAPnUeB1.Din	Consequences Of Your Actions.exe
File created	C:\Windows\System32\ZwZdBvX6G7kV7hIOFEWq.8W8	Consequences Of Your Actions.exe
File created	C:\Windows\System32\Vg6zHgYeb2NtKQYhQlRQ.3AY	Consequences Of Your Actions.exe
File created	C:\Windows\System32\NYL7CsyIobVK3pJYProd.Re1	Consequences Of Your Actions.exe
File created	C:\Windows\System32\nIFwf9vzzYQxDBE6SdGF.0Lx	Consequences Of Your Actions.exe
File created	C:\Windows\System32\AGOWbnAL3ZSocpjtZvdr.I55	Consequences Of Your Actions.exe
File created	C:\Windows\System32\n0PeCDm0DnSTpbuAtAmk.zhu	Consequences Of Your Actions.exe
File created	C:\Windows\System32\aXQ0OP3tYeX1E9Dt88ZJ.vws	Consequences Of Your Actions.exe
File created	C:\Windows\System32\9ejceoKOrD2kLeaUfl8O.YQI	Consequences Of Your Actions.exe
File created	C:\Windows\System32\58RzRIc3tpj9c1260zR1.aiQ	Consequences Of Your Actions.exe
File created	C:\Windows\System32\xqQBXK7ftmIeKmOgXfeo.7Ut	Consequences Of Your Actions.exe
File created	C:\Windows\System32\DMQCf8Of3fjcBNQLF8QF.b1z	Consequences Of Your Actions.exe
File created	C:\Windows\System32\7E1Yfba6RgtqaQuv7qX0.6dr	Consequences Of Your Actions.exe
File created	C:\Windows\System32\QIGcPJkVixLlkHXMWzO1.l5a	Consequences Of Your Actions.exe
File created	C:\Windows\System32\1Q38FB5sdH2etE1KCDPZ.YTx	Consequences Of Your Actions.exe
File created	C:\Windows\System32\90yKgN2NVeM0LL6i6AVe.zKN	Consequences Of Your Actions.exe

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000700000001e534-250.dat	pyinstaller
behavioral1/files/0x000700000001e534-300.dat	pyinstaller
behavioral1/files/0x000700000001e534-301.dat	pyinstaller
behavioral1/files/0x000700000001e534-1306.dat	pyinstaller

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	MH71 Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	MH71 Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	MH71 Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	MH71 Installer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	MH71 Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	MH71 Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	MH71 Installer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	MH71 Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	MH71 Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	MH71 Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	MH71 Installer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	MH71 Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	MH71 Installer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	MH71 Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	MH71 Installer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	MH71 Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	MH71 Installer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 47396.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2348	MH71 Installer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3860	msedge.exe
3860	msedge.exe
2936	msedge.exe
2936	msedge.exe
1652	identity_helper.exe
1652	identity_helper.exe
1028	msedge.exe
1028	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2348	MH71 Installer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2176	java.exe
2176	java.exe
2348	MH71 Installer.exe
2348	MH71 Installer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2404	2936	msedge.exe	94
PID 2936 wrote to memory of 2404	2936	msedge.exe	94
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 4244	2936	msedge.exe	95
PID 2936 wrote to memory of 3860	2936	msedge.exe	96
PID 2936 wrote to memory of 3860	2936	msedge.exe	96
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97
PID 2936 wrote to memory of 4220	2936	msedge.exe	97

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Image-Unstitcher.jar
1⤵
- Suspicious use of SetWindowsHookEx
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdc73446f8,0x7ffdc7344708,0x7ffdc7344718
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,4882944366363364939,2289130850740178381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1676

C:\Users\Admin\Downloads\v71installer\MH71 Installer.exe
"C:\Users\Admin\Downloads\v71installer\MH71 Installer.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2348

C:\Users\Admin\Downloads\Consequences Of Your Actions.exe
"C:\Users\Admin\Downloads\Consequences Of Your Actions.exe"
1⤵
- Executes dropped EXE
PID:2012
- C:\Users\Admin\Downloads\Consequences Of Your Actions.exe
  "C:\Users\Admin\Downloads\Consequences Of Your Actions.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  PID:3644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2460
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1292
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2412
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:1088
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:2156
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2320
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f C:\Windows\system.ini
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:3716
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:\Windows\system.ini" /grant %username%:F
    3⤵
    PID:2984
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system.ini" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:400
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f C:\Windows\win.ini
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1248
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1156
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2384
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:\Windows\win.ini" /grant %username%:F
    3⤵
    PID:2268
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\win.ini" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:3552
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:3732
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:2184
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1852
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2052
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3764
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:4672
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:572
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:2304
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2072
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1668
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:4364
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4628
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:5012
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:1428
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1272
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3260
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:4936
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:3920
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2940
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4748
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:4644
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:1660
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3004
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:2284
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3512
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:2320
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4904
- - C:\Windows\SYSTEM32\takeown.exe
    takeown /f "C:Consequences Of Your Actions.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:Consequences Of Your Actions.exe" /grant %username%:F
    3⤵
    PID:4956
  - - C:\Windows\system32\icacls.exe
      icacls "C:Consequences Of Your Actions.exe" /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b4689127b6aff4b093512e489cb048be

SHA1
49d4b39f423367f8644389765c394c66c4cb6552

SHA256
c80fecc63900ffa1205ba5c167dc5ae9f132cb03490656b31ab9058fd4c48ee6

SHA512
2a16e91bae9e86b8f052bcfc37d39e6402e89e4f45e0e7c16316046209b695ed34535114712cc45c04b27a28dc1084e19bdcf1ecb7c6864b15b4bb0bd92204b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
271B

MD5
369259739084e18d5da2754a960e1444

SHA1
e9df25bc937b1aea35f218d258101479dc98cb25

SHA256
25aae933f2e1abe455b18c339dedf91b055cc090188fed816f718d3af6ec1a26

SHA512
5097f737612070c65f1f6d008a805104f24e1061ce8b059cbb58b9e3230c47c12f49ad01fbf3c290471bfb1dc0218b8c0ed13517a5125f494b1b6018a40c0354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68f2b9f13ab4569a8970495d6d707ca6

SHA1
d482c491636acdd446aacb1a4da30dcda628ca69

SHA256
a90450f416b6a8f48cbccbfd68530daa8d5279dea96c2cb46eaf8932ff677707

SHA512
0238b067331651993d88fbc4b3351510d4c584c70093e342d71fbdaa720d4a16d5074c71ae95115b4a7e7fdfc3b6e07a17dea0bbee922e26c432b1506b786bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0e7ddbf6cd8e6a78d787bb0a09ff3d1

SHA1
0a9faf490617da23da1a9e369e0c28eedb103833

SHA256
2f1c94977f4cab2e885ea350ef99ed7534e9e09d5ef179b118da49e2fe87c227

SHA512
0a9f25b07d731af89b0af4489b18082d81f176648b19a88581a842dd85ef98d9db2f0fca40cf09200100e771fd7fcf4bcc87dd4200acc09b91e2d510fc02a703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
10edcb2a5147aa2796de68e51eb924ea

SHA1
6c156e111ae0cab0e687df2408ddd4f2530fc8f3

SHA256
73cfc3fd30924b63ec373d55480980b2bffb5c23c1962b42a0abf1ceab7746ac

SHA512
635db1fb8249428c19351a63481a908e7d1f330ac23dd436e398ebf56cc1962b3154a839da0eeda78fabf02b63a5f9c20fd6b3e8a889ff3997092c75b14895ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0bfc85f69ebf65b629db9bae277e83ba

SHA1
fdab641209805c6b0934b84c66e0ed22367604dc

SHA256
62dc628636170dcd0f0240669fa4788b0be4923d8cb966951aa92978dbd4c861

SHA512
23e8b3c2f221c6d238781d0676703e9726f6c4bb7804fc248702e8ff52f7969211b06cb4a70bd9fa009da295995ac633a19ada583fb7e1fd7e3b22bbf6c80566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
761aada11ca5fc3deb1bd74e4d8d3e10

SHA1
3481d862287cf99f758e8a309b699ad24cab2102

SHA256
c20429f8abbb4584ccdb288ac9ba1b094ced66a8034bafb27ffb2a92e78b54c5

SHA512
b356092c8862063c35c7b3baa26c79ebbfc354d58d7f4bf28b4ee09470693cdd3e0b55407b1d4d140b3be43b6b49856fb96ab96d4597579c042d079fddada120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
58366f8729129b5f06571f4ff48fba59

SHA1
c7f10f5f76aaf30c07ace10068841ad5628e399a

SHA256
a19626dc49306e81106005467f482868b2c50ae113c06a54f34e8210b0525e89

SHA512
f053881972c5fb1181da8c4ea367b08ea34548d1bc97b4ca2fe261e5d9a0f379fea205a7caa25a8190f86584684b7bd3c2f9bdad2d260307d4d8dcf86ed35b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
850d106222bb3f1db730d070cc4209d4

SHA1
79300fc1c6193d5173eca115da32258aa36d718a

SHA256
008feff57465df02879621c2defe39bcc540e7b25ea08499c15c8e474bcfe861

SHA512
25464073bbd01c31433592d09b89ae4534da09f486f0fe8a2846b94cc7a1be8662f847e611cb37e091316d98bae57932232906a33ec6d46d16d6f79edbcb3901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a59dfe3628ae9e6337e60ffb6167e84

SHA1
ffd74bf320543e15e9425ec8f0fabd5c1448ef10

SHA256
7c1c785e809179d29e5d85b91c0556967e897c2efa1280a09a1213e1ade9f0e7

SHA512
5d2ff17792c938f64cc3c715261b831cbcd79dc419c84936b03d72f262abedc33946c6829cdd7da1c515603de7616512536f0cc62d646126bb4abbfbf2e2754e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\PIL\MSVCP140.dll

Filesize
553KB

MD5
6da7f4530edb350cf9d967d969ccecf8

SHA1
3e2681ea91f60a7a9ef2407399d13c1ca6aa71e9

SHA256
9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da

SHA512
1f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\PIL\MSVCP140.dll

Filesize
553KB

MD5
6da7f4530edb350cf9d967d969ccecf8

SHA1
3e2681ea91f60a7a9ef2407399d13c1ca6aa71e9

SHA256
9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da

SHA512
1f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\PIL\VCRUNTIME140_1.dll

Filesize
36KB

MD5
135359d350f72ad4bf716b764d39e749

SHA1
2e59d9bbcce356f0fece56c9c4917a5cacec63d7

SHA256
34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32

SHA512
cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\PIL\VCRUNTIME140_1.dll

Filesize
36KB

MD5
135359d350f72ad4bf716b764d39e749

SHA1
2e59d9bbcce356f0fece56c9c4917a5cacec63d7

SHA256
34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32

SHA512
cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\PIL\_imaging.cp310-win_amd64.pyd

Filesize
3.1MB

MD5
17e391799227f1aa50f37761b520a97b

SHA1
1e19066b2a82fd26de41b1dbcd6e0505e8395306

SHA256
dc0416f7ab4d4134b4a50b7e5d4c50225fdd229a61cac9b2d7c50106cab16603

SHA512
df5d101bdb8eba2ddf15710ff18f278fc7b4e30c4f145743514fb6e351459b001c6b044e0490a850503dfb00b6306295922fb3a9ee7b5a38eb4e43ef053e3b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\PIL\_imaging.cp310-win_amd64.pyd

Filesize
3.1MB

MD5
17e391799227f1aa50f37761b520a97b

SHA1
1e19066b2a82fd26de41b1dbcd6e0505e8395306

SHA256
dc0416f7ab4d4134b4a50b7e5d4c50225fdd229a61cac9b2d7c50106cab16603

SHA512
df5d101bdb8eba2ddf15710ff18f278fc7b4e30c4f145743514fb6e351459b001c6b044e0490a850503dfb00b6306295922fb3a9ee7b5a38eb4e43ef053e3b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\VCRUNTIME140.dll

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\VCRUNTIME140.dll

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_bz2.pyd

Filesize
78KB

MD5
b45e82a398713163216984f2feba88f6

SHA1
eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839

SHA256
4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8

SHA512
b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_bz2.pyd

Filesize
78KB

MD5
b45e82a398713163216984f2feba88f6

SHA1
eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839

SHA256
4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8

SHA512
b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_ctypes.pyd

Filesize
117KB

MD5
79f339753dc8954b8eb45fe70910937e

SHA1
3ad1bf9872dc779f32795988eb85c81fe47b3dd4

SHA256
35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007

SHA512
21e567e813180ed0480c4b21be3e2e67974d8d787e663275be054cee0a3f5161fc39034704dbd25f1412feb021d6a21b300a32d1747dee072820be81b9d9b753

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_ctypes.pyd

Filesize
117KB

MD5
79f339753dc8954b8eb45fe70910937e

SHA1
3ad1bf9872dc779f32795988eb85c81fe47b3dd4

SHA256
35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007

SHA512
21e567e813180ed0480c4b21be3e2e67974d8d787e663275be054cee0a3f5161fc39034704dbd25f1412feb021d6a21b300a32d1747dee072820be81b9d9b753

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_lzma.pyd

Filesize
149KB

MD5
5a77a1e70e054431236adb9e46f40582

SHA1
be4a8d1618d3ad11cfdb6a366625b37c27f4611a

SHA256
f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e

SHA512
3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_lzma.pyd

Filesize
149KB

MD5
5a77a1e70e054431236adb9e46f40582

SHA1
be4a8d1618d3ad11cfdb6a366625b37c27f4611a

SHA256
f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e

SHA512
3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_queue.pyd

Filesize
26KB

MD5
c9ee37e9f3bffd296ade10a27c7e5b50

SHA1
b7eee121b2918b6c0997d4889cff13025af4f676

SHA256
9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a

SHA512
c63bb1b5d84d027439af29c4827fa801df3a2f3d5854c7c79789cad3f5f7561eb2a7406c6f599d2ac553bc31969dc3fa9eef8648bed7282fbc5dc3fb3ba4307f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_queue.pyd

Filesize
26KB

MD5
c9ee37e9f3bffd296ade10a27c7e5b50

SHA1
b7eee121b2918b6c0997d4889cff13025af4f676

SHA256
9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a

SHA512
c63bb1b5d84d027439af29c4827fa801df3a2f3d5854c7c79789cad3f5f7561eb2a7406c6f599d2ac553bc31969dc3fa9eef8648bed7282fbc5dc3fb3ba4307f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_socket.pyd

Filesize
72KB

MD5
5dd51579fa9b6a06336854889562bec0

SHA1
99c0ed0a15ed450279b01d95b75c162628c9be1d

SHA256
3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c

SHA512
7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_socket.pyd

Filesize
72KB

MD5
5dd51579fa9b6a06336854889562bec0

SHA1
99c0ed0a15ed450279b01d95b75c162628c9be1d

SHA256
3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c

SHA512
7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_tkinter.pyd

Filesize
60KB

MD5
0f1aa5b9a82b75b607b4ead6bb6b8be6

SHA1
5d58fd899018a106d55433ea4fcb22faf96b4b3d

SHA256
336bd5bffdc0229da4eaddbb0cfc42a9e55459a40e1322b38f7e563bda8dd190

SHA512
b32ea7d3ed9ae3079728c7f92e043dd0614a4da1dbf40ae3651043d35058252187c3c0ad458f4ca79b8b006575fac17246fb33329f7b908138f5de3c4e9b4e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\_tkinter.pyd

Filesize
60KB

MD5
0f1aa5b9a82b75b607b4ead6bb6b8be6

SHA1
5d58fd899018a106d55433ea4fcb22faf96b4b3d

SHA256
336bd5bffdc0229da4eaddbb0cfc42a9e55459a40e1322b38f7e563bda8dd190

SHA512
b32ea7d3ed9ae3079728c7f92e043dd0614a4da1dbf40ae3651043d35058252187c3c0ad458f4ca79b8b006575fac17246fb33329f7b908138f5de3c4e9b4e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\base_library.zip

Filesize
1.0MB

MD5
dcf31ac99bd43ac1ad1fe256607c4d11

SHA1
9e1b29c5dbf36dc4a39db6285b1262312d768de5

SHA256
9330fb90ec2b9e821124f5130ee99e913ea8aa21c4b1fd4aab8807a78cf6251e

SHA512
c891bdee8fdc383621916ac81ba2aaefffac14a990f7d2426b5fc4dd8878c07e7d3c987746b1bb32c407bc3cf88534c2a14f16812f052f7853357745111af8b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\numpy\core\_multiarray_umath.cp310-win_amd64.pyd

Filesize
2.6MB

MD5
52dcc1bc9f9b5d7388bc5eed78ea7305

SHA1
724e4b4753a7bc804a0af431882e3e6430405a37

SHA256
d1e42fbc2912af1515fa0fbdf60bbe8616721d2e537b345aa01fed6e90f07d0b

SHA512
11cee9b2f6f69f829cb9cb492f7454a2d0c3dfd8513dfed51b4adc332f583003d7e06c9ce004cc185b426ad486346cdcd62d3ed696770fc3967908ea1b61ae89

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\pyexpat.pyd

Filesize
187KB

MD5
983d8e003e772e9c078faad820d14436

SHA1
1c90ad33dc4fecbdeb21f35ca748aa0094601c07

SHA256
e2146bed9720eb94388532551444f434d3195310fa7bd117253e7df81a8e187e

SHA512
e7f0fd841c41f313c1782331c0f0aa35e1d8ba42475d502d08c3598a3aaefd400179c19613941cdfad724eca067dd1b2f4c2f1e8a1d6f70eeb29f7b2213e6500

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\pyexpat.pyd

Filesize
187KB

MD5
983d8e003e772e9c078faad820d14436

SHA1
1c90ad33dc4fecbdeb21f35ca748aa0094601c07

SHA256
e2146bed9720eb94388532551444f434d3195310fa7bd117253e7df81a8e187e

SHA512
e7f0fd841c41f313c1782331c0f0aa35e1d8ba42475d502d08c3598a3aaefd400179c19613941cdfad724eca067dd1b2f4c2f1e8a1d6f70eeb29f7b2213e6500

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\python310.dll

Filesize
4.2MB

MD5
384349987b60775d6fc3a6d202c3e1bd

SHA1
701cb80c55f859ad4a31c53aa744a00d61e467e5

SHA256
f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8

SHA512
6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\python310.dll

Filesize
4.2MB

MD5
384349987b60775d6fc3a6d202c3e1bd

SHA1
701cb80c55f859ad4a31c53aa744a00d61e467e5

SHA256
f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8

SHA512
6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\pywin32_system32\pythoncom310.dll

Filesize
543KB

MD5
b7acfad9f0f36e7cf8bfb0dd58360ffe

SHA1
8fa816d403f126f3326cb6c73b83032bb0590107

SHA256
461328c988d4c53f84579fc0880c4a9382e14b0c8b830403100a2fa3df0fd9a9

SHA512
4fed8a9162a9a2ebc113ea44d461fb498f9f586730218d9c1cddcd7c8c803cad6dea0f563b8d7533321ecb25f6153ca7c5777c314e7cb76d159e39e74c72d1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\pywin32_system32\pythoncom310.dll

Filesize
543KB

MD5
b7acfad9f0f36e7cf8bfb0dd58360ffe

SHA1
8fa816d403f126f3326cb6c73b83032bb0590107

SHA256
461328c988d4c53f84579fc0880c4a9382e14b0c8b830403100a2fa3df0fd9a9

SHA512
4fed8a9162a9a2ebc113ea44d461fb498f9f586730218d9c1cddcd7c8c803cad6dea0f563b8d7533321ecb25f6153ca7c5777c314e7cb76d159e39e74c72d1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\pywin32_system32\pywintypes310.dll

Filesize
139KB

MD5
f200ca466bf3b8b56a272460e0ee4abc

SHA1
ca18e04f143424b06e0df8d00d995c2873aa268d

SHA256
a6700ca2bee84c1a051ba4b22c0cde5a6a5d3e35d4764656cfdc64639c2f6b77

SHA512
29bf2425b665af9d2f9fd7795bf2ab012aa96faed9a1a023c86afa0d2036cc6014b48116940fad93b7de1e8f4f93eb709cc9319439d7609b79fd8b92669b377d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\pywin32_system32\pywintypes310.dll

Filesize
139KB

MD5
f200ca466bf3b8b56a272460e0ee4abc

SHA1
ca18e04f143424b06e0df8d00d995c2873aa268d

SHA256
a6700ca2bee84c1a051ba4b22c0cde5a6a5d3e35d4764656cfdc64639c2f6b77

SHA512
29bf2425b665af9d2f9fd7795bf2ab012aa96faed9a1a023c86afa0d2036cc6014b48116940fad93b7de1e8f4f93eb709cc9319439d7609b79fd8b92669b377d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\select.pyd

Filesize
25KB

MD5
78d421a4e6b06b5561c45b9a5c6f86b1

SHA1
c70747d3f2d26a92a0fe0b353f1d1d01693929ac

SHA256
f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823

SHA512
83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\select.pyd

Filesize
25KB

MD5
78d421a4e6b06b5561c45b9a5c6f86b1

SHA1
c70747d3f2d26a92a0fe0b353f1d1d01693929ac

SHA256
f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823

SHA512
83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\tcl86t.dll

Filesize
1.8MB

MD5
ad03d1e9f0121330694415f901af8f49

SHA1
ad8d3eee5274fef8bb300e2d1f4a11e27d3940df

SHA256
224476bedbcf121c69137f1df4dd025ae81769b2f7651bd3788a870a842cfbf9

SHA512
19b85c010c98fa75eacfd0b86f9c90a2dbf6f07a2b3ff5b4120108f3c26711512edf2b875a782497bdb3d28359325ad95c17951621c4b9c1fd692fde26b77c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\tcl86t.dll

Filesize
1.8MB

MD5
ad03d1e9f0121330694415f901af8f49

SHA1
ad8d3eee5274fef8bb300e2d1f4a11e27d3940df

SHA256
224476bedbcf121c69137f1df4dd025ae81769b2f7651bd3788a870a842cfbf9

SHA512
19b85c010c98fa75eacfd0b86f9c90a2dbf6f07a2b3ff5b4120108f3c26711512edf2b875a782497bdb3d28359325ad95c17951621c4b9c1fd692fde26b77c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\tcl\encoding\cp1252.enc

Filesize
1KB

MD5
5900f51fd8b5ff75e65594eb7dd50533

SHA1
2e21300e0bc8a847d0423671b08d3c65761ee172

SHA256
14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0

SHA512
ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\tk86t.dll

Filesize
1.5MB

MD5
e3c7ed5f9d601970921523be5e6fce2c

SHA1
a7ee921e126c3c1ae8d0e274a896a33552a4bd40

SHA256
bd4443b8ecc3b1f0c6fb13b264769253c80a4597af7181884bda20442038ec77

SHA512
bfa76b6d754259eabc39d701d359dd96f7a4491e63b17826a05a14f8fdf87656e8fc541a40e477e4fef8d0601320dd163199520e66d9ee8b5d6bb5cd9a275901

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\tk86t.dll

Filesize
1.5MB

MD5
e3c7ed5f9d601970921523be5e6fce2c

SHA1
a7ee921e126c3c1ae8d0e274a896a33552a4bd40

SHA256
bd4443b8ecc3b1f0c6fb13b264769253c80a4597af7181884bda20442038ec77

SHA512
bfa76b6d754259eabc39d701d359dd96f7a4491e63b17826a05a14f8fdf87656e8fc541a40e477e4fef8d0601320dd163199520e66d9ee8b5d6bb5cd9a275901

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\win32\win32api.cp310-win_amd64.pyd

Filesize
131KB

MD5
ec7c48ea92d9ff0c32c6d87ee8358bd0

SHA1
a67a417fdb36c84871d0e61bfb1015cb30c9898a

SHA256
a0f3cc0e98bea5a598e0d4367272e4c65bf446f21932dc2a051546b098d6ce62

SHA512
c06e3c0260b918509947a89518d55f0cb03cb19fc28d9e7ed9e3f837d71df31154f0093929446a93a7c7da1293ffd0cc69547e2540f15e3055fe1d12d837f935

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20122\win32\win32api.cp310-win_amd64.pyd

Filesize
131KB

MD5
ec7c48ea92d9ff0c32c6d87ee8358bd0

SHA1
a67a417fdb36c84871d0e61bfb1015cb30c9898a

SHA256
a0f3cc0e98bea5a598e0d4367272e4c65bf446f21932dc2a051546b098d6ce62

SHA512
c06e3c0260b918509947a89518d55f0cb03cb19fc28d9e7ed9e3f837d71df31154f0093929446a93a7c7da1293ffd0cc69547e2540f15e3055fe1d12d837f935

Download Submit
C:\Users\Admin\Desktop\ClearFind.m4a

Filesize
78B

MD5
3d745e8922fd5714b5c47d11c8f8163a

SHA1
ebdc220cd3fa59d1016a73a39fcade2f029ad4ca

SHA256
17f6653d2314b3af1b94e47f852d28b0bc7e39e81bb90618513d00862d2facd6

SHA512
e16c88253d0a0785df2458f21801a2274b6286a983709c6f086e07f91974618cb6aa24735be68ee4ae78a14484d91a621f873e6b6680ac5f665a67fd2350089f

Download Submit
C:\Users\Admin\Downloads\Consequences Of Your Actions.exe

Filesize
37.3MB

MD5
b0b005c02cd5ab7c344efea31245f3ea

SHA1
d0b2414af0b7e9e8c1a1f6a7a1547c2c0f10076c

SHA256
af089c1f1e1b4a5a11689616ac8675a386f89a6b544b7fa8bf2806b6389830dd

SHA512
1c050d1b1cd6c5d52581544193c2a290f70e59de458d6634ff50d8a870052e462e5898e5bb73edc3dece06fe5ad865566c68412d6bf4f54bb38041fa4f89c99a

Download Submit
C:\Users\Admin\Downloads\Consequences Of Your Actions.exe

Filesize
37.3MB

MD5
b0b005c02cd5ab7c344efea31245f3ea

SHA1
d0b2414af0b7e9e8c1a1f6a7a1547c2c0f10076c

SHA256
af089c1f1e1b4a5a11689616ac8675a386f89a6b544b7fa8bf2806b6389830dd

SHA512
1c050d1b1cd6c5d52581544193c2a290f70e59de458d6634ff50d8a870052e462e5898e5bb73edc3dece06fe5ad865566c68412d6bf4f54bb38041fa4f89c99a

Download Submit
C:\Users\Admin\Downloads\Consequences Of Your Actions.exe

Filesize
37.3MB

MD5
b0b005c02cd5ab7c344efea31245f3ea

SHA1
d0b2414af0b7e9e8c1a1f6a7a1547c2c0f10076c

SHA256
af089c1f1e1b4a5a11689616ac8675a386f89a6b544b7fa8bf2806b6389830dd

SHA512
1c050d1b1cd6c5d52581544193c2a290f70e59de458d6634ff50d8a870052e462e5898e5bb73edc3dece06fe5ad865566c68412d6bf4f54bb38041fa4f89c99a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 47396.crdownload

Filesize
37.3MB

MD5
b0b005c02cd5ab7c344efea31245f3ea

SHA1
d0b2414af0b7e9e8c1a1f6a7a1547c2c0f10076c

SHA256
af089c1f1e1b4a5a11689616ac8675a386f89a6b544b7fa8bf2806b6389830dd

SHA512
1c050d1b1cd6c5d52581544193c2a290f70e59de458d6634ff50d8a870052e462e5898e5bb73edc3dece06fe5ad865566c68412d6bf4f54bb38041fa4f89c99a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 7986.crdownload

Filesize
18.2MB

MD5
6298371ab1c06496fb3ef2a2280620bd

SHA1
5622ce2cde2edf88bed292c0c293c090ed50a9ff

SHA256
41ebcc5abf384236b8fd911fe063b7785f9e000efe71962befc7691de6501804

SHA512
1c63d6bb69ab31416fa1007761bbf4c272aaf2713285bc0dc168423eabf3efad94d246c0dc4019290874761043d5f652175a2e7eec61994a11f6a8f0abc6b9bc

Download Submit
C:\Windows\System32\aXQ0OP3tYeX1E9Dt88ZJ.vws

Filesize
6.7MB

MD5
8777f7e283a3b08be66fb51c952b0f47

SHA1
9eb5a042901e7f9157cc91f2ce3c96620cbbdd92

SHA256
e58070bea039b4a63fcb672218985d9b82e5a5a7bba4790b32a50fb606fe3a22

SHA512
f7ce326680a1108765084babc06c602326faf77bfc3c2831f07076ab1b3b294ee7965d83e20507255cb702adf63bfde091124c77a81446698e2d7feb65f84341

Download Submit
memory/2176-15-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2176-32-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2176-21-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2176-17-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2176-34-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/2176-11-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2176-33-0x0000000002420000-0x0000000003420000-memory.dmp

Filesize
16.0MB

Download
memory/2176-72-0x0000000002420000-0x0000000003420000-memory.dmp

Filesize
16.0MB

Download
memory/2176-2-0x0000000002420000-0x0000000003420000-memory.dmp

Filesize
16.0MB

Download
memory/2348-268-0x0000000000F60000-0x0000000000F70000-memory.dmp

Filesize
64KB

Download
memory/2348-278-0x0000000000F60000-0x0000000000F70000-memory.dmp

Filesize
64KB

Download
memory/3644-1350-0x0000000070200000-0x0000000072088000-memory.dmp

Filesize
30.5MB

Download
memory/3644-1421-0x0000028B49920000-0x0000028B49921000-memory.dmp

Filesize
4KB

Download