growtopia | c08b63c50a78ca119a5ff4fe10592a0f66289708df38349e91e645214aae7576

Analysis

max time kernel
1799s
max time network
1797s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VespyGrabberBuilder.exe
Size

12.6MB
MD5

fab385fb154644665f94aca9424fb0ce
SHA1

8dc525108cebd97b3127129cc1633a7f31010424
SHA256

c08b63c50a78ca119a5ff4fe10592a0f66289708df38349e91e645214aae7576
SHA512

07def38b8590ebaa95d7213e77e3892f60f10a87cef797fa07c6feb033f08d4148024360c7c32b5f92441c41236b8a86e66cee59bb51d6fbde97b86923a640e3
SSDEEP

393216:NayDfg/3Y8G6jgVINcfwt+F2CZZiLe2Wq:wyDfYPwPwtO2Mie2J

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-54-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-56-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-51-0x0000000004C70000-0x0000000004CDC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-63-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-66-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-68-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-71-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-137-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-139-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-141-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-143-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-145-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-147-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-149-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-151-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-115-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-154-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-106-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-156-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-86-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-163-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-165-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-168-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-172-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-185-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-188-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-202-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-223-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-207-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-195-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-226-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-228-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-230-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2220-232-0x0000000004C70000-0x0000000004CD5000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

VespyGrabberBuilder.exeWinErrorMgr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	VespyGrabberBuilder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 8 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeSahyui1337.exeKeyGeneratorTOP.exeWinErrorMgr.exeKeyGeneratorTOP.exebauwrdgwodhv.exe

pid	process
2220	Ilkdt.exe
4048	WinHostMgr.exe
968	WinErrorMgr.exe
4920	Sahyui1337.exe
2372	KeyGeneratorTOP.exe
1180	WinErrorMgr.exe
3212	KeyGeneratorTOP.exe
1016	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

Processes:

KeyGeneratorTOP.exe

pid process

3212 KeyGeneratorTOP.exe
3212 KeyGeneratorTOP.exe
3212 KeyGeneratorTOP.exe
3212 KeyGeneratorTOP.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

39 discord.com
40 discord.com
105 pastebin.com
106 pastebin.com
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

361 api.ipify.org
254 api.ipify.org
258 api.ipify.org
308 api.ipify.org

pid	process
3212	KeyGeneratorTOP.exe
3212	KeyGeneratorTOP.exe
3212	KeyGeneratorTOP.exe
3212	KeyGeneratorTOP.exe

flow	ioc
39	discord.com
40	discord.com
105	pastebin.com
106	pastebin.com

flow	ioc
361	api.ipify.org
254	api.ipify.org
258	api.ipify.org
308	api.ipify.org

Drops file in System32 directory 4 IoCs

Processes:

WinHostMgr.exepowershell.exebauwrdgwodhv.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 1016 set thread context of 4436	1016	bauwrdgwodhv.exe	conhost.exe
PID 1016 set thread context of 5088	1016	bauwrdgwodhv.exe	explorer.exe

Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2692 sc.exe
1040 sc.exe
1796 sc.exe
1448 sc.exe
3532 sc.exe
3124 sc.exe
3392 sc.exe
2096 sc.exe
852 sc.exe
1544 sc.exe
2692 sc.exe
2248 sc.exe
1824 sc.exe
512 sc.exe

pid	process
2692	sc.exe
1040	sc.exe
1796	sc.exe
1448	sc.exe
3532	sc.exe
3124	sc.exe
3392	sc.exe
2096	sc.exe
852	sc.exe
1544	sc.exe
2692	sc.exe
2248	sc.exe
1824	sc.exe
512	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4516 schtasks.exe

pid	process
4516	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1168293393-3419776239-306423207-1000\{33CF0E80-7C8C-4123-A1BE-9F8E72357DA0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sahyui1337.exepowershell.exemsedge.exemsedge.exeidentity_helper.exeWinHostMgr.exepowershell.exebauwrdgwodhv.exepowershell.exeexplorer.exe

pid	process
4920	Sahyui1337.exe
4920	Sahyui1337.exe
224	powershell.exe
224	powershell.exe
4940	msedge.exe
4940	msedge.exe
1840	msedge.exe
1840	msedge.exe
3956	identity_helper.exe
3956	identity_helper.exe
4048	WinHostMgr.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
4048	WinHostMgr.exe
1016	bauwrdgwodhv.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
1016	bauwrdgwodhv.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

Processes:

msedge.exe

pid	process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

Sahyui1337.exeIlkdt.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	4920	Sahyui1337.exe
Token: SeDebugPrivilege	2220	Ilkdt.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeShutdownPrivilege	3844	powercfg.exe
Token: SeCreatePagefilePrivilege	3844	powercfg.exe
Token: SeShutdownPrivilege	3568	powercfg.exe
Token: SeCreatePagefilePrivilege	3568	powercfg.exe
Token: SeShutdownPrivilege	4732	powercfg.exe
Token: SeCreatePagefilePrivilege	4732	powercfg.exe
Token: SeShutdownPrivilege	3812	powercfg.exe
Token: SeCreatePagefilePrivilege	3812	powercfg.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeShutdownPrivilege	852	powercfg.exe
Token: SeCreatePagefilePrivilege	852	powercfg.exe
Token: SeShutdownPrivilege	3464	powercfg.exe
Token: SeCreatePagefilePrivilege	3464	powercfg.exe
Token: SeShutdownPrivilege	1384	powercfg.exe
Token: SeCreatePagefilePrivilege	1384	powercfg.exe
Token: SeShutdownPrivilege	4032	powercfg.exe
Token: SeCreatePagefilePrivilege	4032	powercfg.exe
Token: SeLockMemoryPrivilege	5088	explorer.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

msedge.exe

pid	process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

VespyGrabberBuilder.exeWinErrorMgr.exeKeyGeneratorTOP.exeKeyGeneratorTOP.exemsedge.exe

description	pid	process	target process
PID 4196 wrote to memory of 224	4196	VespyGrabberBuilder.exe	powershell.exe
PID 4196 wrote to memory of 224	4196	VespyGrabberBuilder.exe	powershell.exe
PID 4196 wrote to memory of 224	4196	VespyGrabberBuilder.exe	powershell.exe
PID 4196 wrote to memory of 2220	4196	VespyGrabberBuilder.exe	Ilkdt.exe
PID 4196 wrote to memory of 2220	4196	VespyGrabberBuilder.exe	Ilkdt.exe
PID 4196 wrote to memory of 2220	4196	VespyGrabberBuilder.exe	Ilkdt.exe
PID 4196 wrote to memory of 4048	4196	VespyGrabberBuilder.exe	WinHostMgr.exe
PID 4196 wrote to memory of 4048	4196	VespyGrabberBuilder.exe	WinHostMgr.exe
PID 4196 wrote to memory of 968	4196	VespyGrabberBuilder.exe	WinErrorMgr.exe
PID 4196 wrote to memory of 968	4196	VespyGrabberBuilder.exe	WinErrorMgr.exe
PID 4196 wrote to memory of 968	4196	VespyGrabberBuilder.exe	WinErrorMgr.exe
PID 4196 wrote to memory of 4920	4196	VespyGrabberBuilder.exe	Sahyui1337.exe
PID 4196 wrote to memory of 4920	4196	VespyGrabberBuilder.exe	Sahyui1337.exe
PID 4196 wrote to memory of 2372	4196	VespyGrabberBuilder.exe	KeyGeneratorTOP.exe
PID 4196 wrote to memory of 2372	4196	VespyGrabberBuilder.exe	KeyGeneratorTOP.exe
PID 968 wrote to memory of 1180	968	WinErrorMgr.exe	WinErrorMgr.exe
PID 968 wrote to memory of 1180	968	WinErrorMgr.exe	WinErrorMgr.exe
PID 968 wrote to memory of 1180	968	WinErrorMgr.exe	WinErrorMgr.exe
PID 2372 wrote to memory of 3212	2372	KeyGeneratorTOP.exe	KeyGeneratorTOP.exe
PID 2372 wrote to memory of 3212	2372	KeyGeneratorTOP.exe	KeyGeneratorTOP.exe
PID 3212 wrote to memory of 4940	3212	KeyGeneratorTOP.exe	msedge.exe
PID 3212 wrote to memory of 4940	3212	KeyGeneratorTOP.exe	msedge.exe
PID 4940 wrote to memory of 4364	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4364	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe
PID 4940 wrote to memory of 4760	4940	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\VespyGrabberBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\VespyGrabberBuilder.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAcgB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAZAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAYgBxACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1780
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:2860
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2692
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3124
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2248
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:2096
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:852
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3812
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1824
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1040
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:1796
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:1180
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC37.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:4516
- C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
  "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
    "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa560a46f8,0x7ffa560a4708,0x7ffa560a4718
        5⤵
        
        PID:4364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
        5⤵
        
        PID:4760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
        5⤵
        
        PID:1300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
        5⤵
        
        PID:1028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
        5⤵
        
        PID:456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
        5⤵
        
        PID:4540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
        5⤵
        
        PID:3384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
        5⤵
        
        PID:2648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
        5⤵
        
        PID:3996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
        5⤵
        
        PID:2732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
        5⤵
        
        PID:2548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
        5⤵
        
        PID:4480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
        5⤵
        
        PID:1864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
        5⤵
        
        PID:1796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
        5⤵
        
        PID:1344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6396 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:3016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2064 /prefetch:8
        5⤵
        
        PID:2736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
        5⤵
        
        PID:4820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
        5⤵
        
        PID:2788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
        5⤵
        
        PID:3748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
        5⤵
        
        PID:2200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
        5⤵
        
        PID:6868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
        5⤵
        
        PID:7068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
        5⤵
        
        PID:1028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1752 /prefetch:1
        5⤵
        
        PID:3680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
        5⤵
        
        PID:4960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,16612908352732098107,16847678266124085391,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
        5⤵
        
        PID:3976
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1016
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3540
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3964
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1448
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1544
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2692
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:512
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4436
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:852
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4032
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
5.0MB

MD5
e222309197c5e633aa8e294ba4bdcd29

SHA1
52b3f89a3d2262bf603628093f6d1e71d9cc3820

SHA256
047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

SHA512
9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
597KB

MD5
d300c289185b63a1d7a60f658118de07

SHA1
3de17734d96f946cfaa0a7cd208587f23710dc23

SHA256
729480276399da7b9386ca13607addc3415073aca568a84ab200cf4c5c5074af

SHA512
31b330f53a2865c03c7c35cfa199c9556cb617948732d83526073bf48361a035364829174426655a3f95698ae9dc278e35f14d8b99dcd2329a31c7cbf76c01af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
21KB

MD5
44129a82842153ef9b965abfb506612a

SHA1
c0964eb2ee1a76d48e4e09e31915415d74e18bbc

SHA256
8a3908fb32a414703eff3e435566b1e5598eb3a5d50c500e70eb1a5c20d003d7

SHA512
77d149f19343d765834f2bcaa02bc160c75bd42db1fc431aba87f78257a83c4c8a7e5953c247cb7cbbaf4ae44ace269eb0a5194dfd7489d66f69489ce5dd78d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
37KB

MD5
898356e655d9a30019f392af43dd1338

SHA1
daa2dc24493473ef2fb5e393259f56b4eb7efea6

SHA256
0bcf60c1ed7fb89b783027471ce3f913f80dbe3149ef1d7b99c2593ab4fbd491

SHA512
42189d445e47f88758b9f6cd6b0fdd9132a64612314c0013a7f2d5ada26c176d8ac824c26807744ea01a588e5a4b33ac411b1459a32ed89dc48714ad21907a87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
66KB

MD5
c0e4fc2c40d61ca1a03888efba139888

SHA1
1420a9c04a280917d10a53920f8bca97ebf01eac

SHA256
6fa1da50bfc2e1c050bf6e9e728a628b29537e1f5ca739b3aba2bc2431f4a0e3

SHA512
2388bf0a316cec7b52f9631f174592fd943a8cef56e3b61cab1fb0451de4c29c75ef28b90051e8e7dbff61d1c1f94b526056e4fdb8dbe6ccc92f62b4e9473d98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
36KB

MD5
683162fbde80fbd61aa5aa7976cc8a83

SHA1
3a45c1f1e45b6f73966b3e69dcfe219364d0d3df

SHA256
031b0f6f5e23028e3b00fc76882d9f4bb2dd9e47fbcd2c6d61c01be0eef707d2

SHA512
f1480a442ae04aab405a6c6b33bfc33d2dab6b4a6835444dfbd86c9a4607924d741893415d1e4e158ebae3c81088b4f929afca8213d81b7a11a0183194157caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
89KB

MD5
e1ed3395882978a367e932cc21d29836

SHA1
4205f61c079f93b588132ddccb8589ee71bc0dc4

SHA256
6686d802cdbacae6388a30830f6071041999c987a52aedfb0082e43e74417858

SHA512
70f0e2ba38390cacd87df6ca0731cd6462e46a6f1a440791e4f601bf85d3a7390c4b09675e7a42e04cf07591c54f3e9d0942bfa6e87eb8ded43b2eed2247b5f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
24KB

MD5
772921a67ff6a39c4b4447ea06576497

SHA1
deaeaa4770a806c4effdf626bee5646150c10e19

SHA256
33ec947034d642e2eafe5c2663ac97375eddcc21c54a67a3a13ee79e4f783954

SHA512
83d8e5063f5bda2e7ab29c2b693fe3a2cfe1a373340ff1437da8d6a03bcd82cb9f6747ed7be8db78a024f940b0bff307e05d7806d8718a5f39098ad7f188c5ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
21KB

MD5
9788cef8af118918ede9263810544656

SHA1
7594bbb3faf41631beb6901614c63985b0ff7f66

SHA256
897a7890846687ba8bc76b338ead8961442c39d9465a15c1f7241faeaa7a80a5

SHA512
92e83d37875c612edd13490681352c552801761d5e5ad2a05a835d56f231e6e8f3bf319a0e4ac9034fd020afe7d59759b9e200750feb1ccd5a956de4b977574d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
106KB

MD5
95fd3cfd4e865d176b17cd36c6bc8082

SHA1
19d798894fa2361cf1e4aa8415e3cf2b86691b0b

SHA256
1b524954194ea43a48db40a660894f888581469e7e6fd1a53e90eff5e43e385b

SHA512
ab9632ce8b8fc55d7d8916ce46416d53045613696b030bd9e979cebb7c3eb773c12b469ec313648306542668e36ef0b2029bb9decc31185539bf27a424c9055b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
221KB

MD5
e88654f7c1c47a11046ccb492d593a4d

SHA1
8109d9bc3b030b5e4be0f511b7f3a00b461e969d

SHA256
19a5dfae560d5c4410b5a53d72cc5c6af880adeacb9ba4d430ae148e11915b1c

SHA512
588d6b9c5752ff55324e1aab6897a7ac43200d14955046e4a400cad2a8e16c1380b5b591d4d24dbfd6937b10373db0f28cb14b1e7fcc83267afa595141735539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
28KB

MD5
193e3fd4f5c28fde1e5b7c3caa417457

SHA1
20fd0755a315b30deaf3f212e0ae5c0f8d4db15e

SHA256
0358e44f0ecacd801e03c3eab821ed433c042730eeafbc37fc9413dc6602d809

SHA512
38b6cdbd641f5bc69bc766462c791af7941c3954cff945867153edcb71869e467b2540c7536def0c836ea6ecf381fcbe6967bb21c2cc3c65fa67023949ff95a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
1200966878142a86d12fc9ba7b82bbcd

SHA1
968c3825d4a2bc28ef07a3b59cade06efdf301ae

SHA256
5424edcafa77227873044bf9124b8e08058ff2b2c8b0a581f408ddc91be85088

SHA512
d30fd928b3502b51ca6b7d776eaefd259b12ffc8e6a2ab4bef809ea7649176b04afca0f0f5b12ae9a88928591f121a8ac32916bae628a9885c63bee5c1679da6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ea7d19cf735163fcb32da5c8341c3398

SHA1
3f691eed2a9e41d711265719316b95e32df3b78d

SHA256
8755c93f9d141c68413ce8a8acc5caf24387a8d7a60884c51f687b3eeeb509be

SHA512
3ffc8fa77f3f207310d7a0e69f2766d40d2fa8c9c9ccdca8ac55412ad8987dd3cc4afde267a231983de7324df41c2610c640943c9f1fad37ca5832b526850912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a46f381dbd27adb52e2153942c100c67

SHA1
2100397504b647a8782fa30b45f6efb9e830785f

SHA256
307456a82da0e7767f63a8a0310f4553690947baf08ccc8349d6c2b1c1b34297

SHA512
6deb362a3b69c492fbc1b8c5ca1e30de0778c12968b0755c705f9909c7e727c4cea6c5aff11acc3cb42c287b10edd8e696e19f05933c0aed365401551b562d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2e1d1baefb91fd93b5ae90aeddfed0c8

SHA1
dc1063a1067f2e9200098879eafcb893ee73b1bf

SHA256
533c4f4aa1f0648a904b52e50c41530fff8ff596123f5a7ea0aa5cd84e82080e

SHA512
18c2e21615de95fa03bf918d446c2624be09a4b39dfcb76bbd644a281af962d3581733212c7e91591e20d70a56ab5e70d8eef36e35632308d872c896d55832c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
bc99ef0622817700717f989d0c6932bc

SHA1
56b11252249a93e33ed8538d4945306e731ec080

SHA256
8c6a0822a4cc0e59bca0d159e6176db5accad2dd58f9be98baf20c27300746be

SHA512
7d0ff5467fe429236e5172ecbf94f364aeb704c599572f82a6613723eddfd16908ba00609fd6191cf50c2680f8f3649cbffeae42650b38b07e151f8f32b8578a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
8748c9aba69e00f783e775635166b2b0

SHA1
c85b8e83d98bc8c7ba99e90f98233cf4de1d60cb

SHA256
02045cf726a8a6055747d4d64e4b7e02b9531e5259c9dbabc590d21b3b67eb4a

SHA512
daf0904f9503ca99c1100dbf221ce2685a497b283b2ec0605e5d4600f2e22a468f71dae7dbd7ad7eb402efeb4206e5c2ccfa4cc81c34c373c533b102d6f1ef72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b3462f1ec43e96e15cb45054dc6e6ec5

SHA1
956172494649f5ffc74b7f3a2d9966d3c7781c37

SHA256
ef781c946abb7e1ce473806b6437e25b988407e0e5813a33d6dc48d6ecabd6c7

SHA512
d74a9b74c496673cf84801b12fdeac847c7a3e89e386e2868dbf6a6c0578d8cd6faf45d931db3d0325db022b7fc607ffa673fcf39b646c9273c5757683519c65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2169dd4ffb2640fddb0658664a53c8dc

SHA1
85409ae5fc6d5277ccbf8bc6561a7471c9ba3bfd

SHA256
53d7ba68e4372a9768b22a6a268565af1f40f0363d47f8086f6f1e5d40b2cafb

SHA512
dff4a5f2bef1f4186182e3a24884ce5d4e181bafb412befd389ca74779f76f3b280a147121751deb746723dfa1dcd53de92d2f94a4b9a83b49a172d77e76838a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
388e553756dab424b5d430ac5eeaee12

SHA1
19b8caf987c44bf9660c06345bda045c54786a0e

SHA256
6dbf34b4c284635e0be286cc422babd10414e8e6c1c525bde8b54336352f9ee3

SHA512
ef85a46b2b551e4c9f22fcc921a98ff3bd87a2d7c66e426834594ac01279a655ca1269b8c0e5d4ca2ce949876016c99ee12ab38607f134d58f3b51827184d15b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c58708b4575e73fb3405fda82fef76b5

SHA1
e674f41fcbde27ed9192934d84231418433f9e9e

SHA256
f1098a3065d80312a5ab1ff3f773b0ec4c9ea193a21dab51765f1bcf8a44ef3f

SHA512
ab39064720be39ddfb91ef0b7490a5ffe607475387a77c46bb591a3e3e816925bed913deb97896752f744398b3d60033c00baa24e9af01d54f488e063adc0cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7f276a6d11c432f3bf94ae42ac76a952

SHA1
0e3b1b7143230977ca8cee9ad998edb7a4bc1f44

SHA256
0b53c694a87e9a619ccc9d164b76ba0ae1cd558d6a92034636586c09933e72e9

SHA512
6b05c651fc4b12b6b35c224b4fb2418bfa667e051513b09c9a60d2399dab3cd7228729209f953fe510ea8eeeb2e3557de05bb3edc8918fe4055318c285432f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
713b5348381336e98d8ab0939bcd16c6

SHA1
8084b40e561ef3a1d7452df7df6581a01f1e15f5

SHA256
e0d6b3b14ed9c1507f9c4570582c7f6db44c498b03812ea6815f3e3da51b7707

SHA512
121fac0a086bc016dd83c967ba011ae9634376110eedf95a4c6483de0317ea433f4e4b4efed891030c95c3d8ea69f8e0b55abbf33e1897f0dd3810fcf72bf545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\1a690933-d97c-4d8b-97a4-870c0ee61074\index-dir\the-real-index

Filesize
4KB

MD5
07766275bd4efbc5661fc8e34b783413

SHA1
b05a9b29b20ac4fbc45b56c25eccb02ded68aefc

SHA256
bec9cae5d169dd4c09ab4be9ebe36ab44150e2f8659d4bfb0f6c15e164930b03

SHA512
8754e35551dc97c4a124c65ec488168681263ae152babd7338eb67232ac7448110dc838b25304f05a211542a6125d8438f28eda7004bb2e74d3ba7ff6b8ebc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\1a690933-d97c-4d8b-97a4-870c0ee61074\index-dir\the-real-index~RFe58cf22.TMP

Filesize
48B

MD5
fc2d926007ab408d5f7bd150d4d99df7

SHA1
157a40347c30322aac1ac08adc023720d33f83e9

SHA256
fecdc419ad36286095f31fe5199b9ce4e1e45e71b72c43812ed8603ad5f8747f

SHA512
37145d2299b52c667e69562e23390b475ea2a03cc4fcf05aebf635027fc5abbe477e3b49be534470b20375fab1c3fd9cb8b571092b297f66e2b6585786f4ef4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
93B

MD5
19dc14897c322acd74e8d8a46514c40f

SHA1
4d921356210c9e0c9f4b812e466452bcae7baeee

SHA256
79bbc6b1260aeb0d1067787a93c5c45ccb27bd34fbda881734fb9d09e289d5ec

SHA512
e66ee73f0846ea815f553dcda9811d6d2ed43e73fef922f9cfadb951d5eef97e3b5c1662dddadd597809d7ca3224adc4cc4c0ed5f99ae68eda39b4ffab35e0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
89B

MD5
6feb15b144685fa8aef57b492871d66e

SHA1
feeb8f448d8eeb9759fe262740784369916b2f7a

SHA256
0e6952d26b8bdf02d0c772e8658bab6954daf7257ec0c927b841ad870f0f314b

SHA512
c4ba3d4e34b7fe7109ba324c3783921cee8699cbb91e1cef7952ac6442a32272e0fc3540459c977564217a3559e64f72e90c5d55c242248b6e3c5cd99c92c440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
22140811c4cfa25d8f6f46bb634589ff

SHA1
b565e9ef83efb5f7ce7b86eceae69e5ad763aa76

SHA256
6652623c5748ba4ff92d39b9522d5e72080ae98c02252d60115afa44600950d4

SHA512
ed87405ea6f95b3f75db6a334a242ddb0b4bb4f984c256872ae680393136cbcb09bbe81355320ff203255b95d9c5120dfbac06cf2b2d383967e97b1ff08c0b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5898a1.TMP

Filesize
48B

MD5
d3af076c3897c59e9873d2e78e19540e

SHA1
92fd9dbece1e927fcc0d47059252025d9c4168a0

SHA256
86b9fc7d6319adf44a2490aa895dfdd4aaa03eb8baf934dde4b7f5a2976c77c3

SHA512
f983526186f0f1897736ee91a6d52bbe3479608bfb939c54ed62510cfdea3956b7efb12dd5fcfec00a37b2f7c53d192c7b0c513afbb898817328e1e97ca16fe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9d49d622f4843155ea9f1a5dbd078c9f

SHA1
3b9066698dfe66836bb09e911874ed33f64469f0

SHA256
da189ba65c4a0846749c29da202c22e172ccfb4ab962ca64cb106b2621e5364b

SHA512
4ddf6b696a85bd9a0d8f6cd81f219a1f7c808af16aab22126716e81e8ac8d4b97da08341f170c284e1cddd48eae8f55ef4b8dc5f7706d176e37833fc9bd52dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9970e47be9d50b82417744c133aa1684

SHA1
6ccbd30500ea9d1b52bd853c031b9a9ec7884224

SHA256
8dcbf88a2c7f3f7df4147c95eaebcd2de5b0c82b1df12e421b7ff61afc6f40d9

SHA512
68c45be672f61acb20d1519d8b86775d55656dcf9cf2755d15f792b248612985e24ce1f5c1443e4ff2e7119a472868d379fd8723be1619c9d1be111732c267d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e8d970a3ee7d8a2a30a4dcc20e21fa6b

SHA1
26a0140fd1772991f412b3223fc04654693e2c5c

SHA256
13528bdfe6f21675b67c624d00645c1de7525627137040362f0b884d7a2401c8

SHA512
4ae28e50d1d75e404b760e6c100af4ae0f691e99f364750dd5552b951e322d3ccee78f17bab32599f94d26908a03a8e574911e28d3590d705ec041f6dc02c726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a9ef59b548fff254896b5e53d066dfb2

SHA1
a32dcf10806d5682a47177d1e0d910a75f74e723

SHA256
149006d2f4f6f3b87f14ce83dc8639440592e2cd4ef45948006cdc8ded9a03ef

SHA512
c5226a8d3fb7a0db290e225da5f36dd1cd14fc0f9320f2afb04858aeb84bdb22e2eacc2b490a4d8047ab65ba94f55efc0a3b5d55c1191074b464c6e1fc2784d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586387.TMP

Filesize
202B

MD5
d832e4234a59cc558875b0c6347cf054

SHA1
977fd335b3b1f6935de09d8e2fe44ebdd54f7d84

SHA256
09f1dbbf1aff4b4f21c81f91501ca20e50c919143b25a32a77cef2ed17314946

SHA512
cd168a218d6fde47489f4aa674025160b7a6fd2b89c0bb9f752c12c33503b14b5b753a6324ebdf1e5d60fa43e8f0b38ca7ab6fb1cb6e62a3ca1bca71496ae520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d34913fb33c5909ee38f3d3fc2a6d92a

SHA1
99666fe0c29eca94cb2dd48df575a0b67c4f4e03

SHA256
d96dac4bce574995e6b33559e8048cc8a6d376dca29ebe6c5aba8bacab42f1b0

SHA512
d951284b38ed550f22d757a078d00ae8100f431f234fe66fef2c9f9c493a924c877665d6412a6e0df18165cb725f1e32003f89a38c0807026cd9822874e31f3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
533acf07cc24d0e877e47679c292de2d

SHA1
4a78588e95ee827dc95c02a30681453902768d08

SHA256
6bc9dbf79a53f5ca8a9e03308dc884a1f747161eda76ddda76de67aa9c89669d

SHA512
0ec7580b5b1a9d66d4ec5923deb9bf8b8130e6d2056ad03423365b764dc6483237e0daf7e100a20489108ee710198bf578ad2a599b32759a3204e828bcf700a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
cb3c59b3896688e118ae3c640122e9fb

SHA1
23a4f52087cd128f71445df8f698bd8c0a3b65c8

SHA256
a906fbbd63265b2e82c7ef2f0dfed5c47806d89c5f3b49fef14a8e823030d45f

SHA512
1f4c1ab2d09055008a00863bccb3e460152a3d19dafbb3fcd0612b028d25ff0ff8e66c874be0b8724f9f615594da47909b10afdc20e105e279f1ad0abf654685

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
4.0MB

MD5
c2ba0ca717e7dcdea9df4eb13e336960

SHA1
27c0d37622bb7de20feac4c4f2c2b19b2ffbd88a

SHA256
32b1f57fd42563bc78121e74cc8cff80296388512e5b52ac7080d3245b1ded41

SHA512
0bc8e41c5d326c04b3d3a88cd44a7f39c3cfcee619d7b24224aa7f3153de58559f4a608e3be665e4cd725b82f3859102caa2b3a146c831e2caee0afdfb91a8de

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
1.1MB

MD5
c64f1d936ef9f2cdb840c7f5a0b21d48

SHA1
5df7a32189f450330496691d73f92e636edb1c04

SHA256
4da408039a30bd9ff1164f6e3ac18f561673bbc5c74b6cf340444417d9de9c67

SHA512
a58788aa55d6a6539fd0484e9ff727b2d84e87a56e252155eb15535f911716166bd793676dbf546f6dcae2446bec07bf874b00e576bc497df0cf926c88dcc04d

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
576KB

MD5
4cbf0dd056799458bba16b2ba54d6787

SHA1
ea34d681c314c26f4f1571305b30cc1f687ae72d

SHA256
1efe008ecd637b9fba35af621d3937163dbe39e8e740eaf77d9b14e3421a6625

SHA512
353942c17ed5b8159816c44e3ac191b97ba2e64d8cd8212e8a742d9c5acd06363c57bc096d2b5870839396c0b98be40cfb04f4461883ed10c2371c5253b4496c

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
1.3MB

MD5
5d219a4b86bc9075c1b661bf442acf5e

SHA1
411e11d162afd6e76dd7fec24f0b7fdd97db8891

SHA256
e088086248ecfd26515ade7da7d6128031a3ded60591a21bf06469f0f8cd47ee

SHA512
175316d34ca561ad341a579fcc05da27490bf9ab776dab3797f6b8a91ab8302318aff4305cd54ea83b972f3137d9d5762fb3eaa97dd454348a872c74c100c351

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.6MB

MD5
5a7a3c43bea04a929f306ded49acc618

SHA1
66af91947bae38f2b0615302355b0c44e8d68ee5

SHA256
4517ed0d82e1d47cfcdcdd5f42dbd91cfcfda563280871c109b3d536d2701278

SHA512
8a1808ab1d3a57a2f1e2ec035f5a7ef6600053af032a623b5ba49727935cda865e8d5f08ac53ef491b8d68f82ff3b7d99e2487c693190202382345492a7ce4e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
3.1MB

MD5
73d31366771da793824b6caea0579162

SHA1
140f982ab118dea79c008abe2adc22cac7743577

SHA256
d6f0d3c97e60a52778c06112d0e148de711130a8f1f488eb083f0d0544f4b267

SHA512
de50a70c97bb15a55cce1ad672b23c4403224891cc1d133bad93bd9b2a9a06134f2cdfa69829825dbabb0e34e858d1dbd3281cca81e154a2afd0792418f6f82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.9MB

MD5
584ab8c662d27ccdd5be295081915ff6

SHA1
7a1ce72a2ead2720e551a400570ce0d9012b3c44

SHA256
672347e0f0bf1935ab6d658ccadd8525e0bc58fd6b5505237cb4bf7026854997

SHA512
a4b6c6bf2985e1566e31ca87b8416ea3f1f3569d59750c2eccd3f9406c088e30868cd5639464a8f36faa81b267885949636af33673a6ad332f9989a89d47f80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\base_library.zip

Filesize
1.3MB

MD5
44db87e9a433afe94098d3073d1c86d7

SHA1
24cc76d6553563f4d739c9e91a541482f4f83e05

SHA256
2b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71

SHA512
55bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\libcrypto-3.dll

Filesize
1.3MB

MD5
60562bb33dd12ac736d8bce36fa2e264

SHA1
e840fad46481a0c4931d21eb832a67c026d05ef7

SHA256
dad687a1f9883ceb446931c6f0688e6b5a8fbde04d96038634f51c887ffee391

SHA512
677bf7d8079390ed7d43105b6654b2e0ba4888a25dac08d4131b17682133c659797c447404dee0ec9006f0e75bc91700c98b970fd2a44dc3392082cad496913a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\python312.dll

Filesize
3.6MB

MD5
031b16043e18afaf1eb84e9d1d3ee356

SHA1
79f793b1dd7035b83fa3f469e94aa4884e60b545

SHA256
e8ccb4017df7ff65ffb54e6a53f618a1d6579cf324d329ac19106b4fb3d0ab2c

SHA512
df24ffd96cc4d12babf6d9c9aebc13202c3a8626d4f906fa8ad3fbc3d07057d895756d3fe19c75434efad17f767406e20274ef00b464d1996130ef06ccebedde

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\python312.dll

Filesize
4.4MB

MD5
5be476696c55b5222b6cf9b0e7645911

SHA1
4b5d45b44bff717442e5800615efd957c06c415b

SHA256
e8a7ebe9fe264998a166650089bc1e104876f665f6eaefaef1803e92c33dd704

SHA512
82fe062ff85e9d9f43fe4c450e61945c8354f5f1a6801debbc09a5a4a0aa92d3a3ba09b01b18c9f03e563a3fd9ede2fb2ba6d2717c4ea239ec8ba4eb9c118c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23722\unicodedata.pyd

Filesize
1.1MB

MD5
f696cd42c4ccb7a8ca2a2461c19f7ae3

SHA1
6cec9fab6fbfc37971dd2144afbdd75664d0fe2f

SHA256
a9589c9cf288b15328f58eecee5fe54f833289edea46b240fcdb68f61b72f354

SHA512
105f658006af1c7fffcef2e17627c41f6e9fc6bfd62f12f73f3c6d9b56f85291a14a2a9b2ca0475fa607c8b4119def7c437d41aa0260aa7901b5b2201d1ba6d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hkpeb5bi.qwi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDC37.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_4940_OOMXBKFLUKNKCZYR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/224-224-0x0000000007950000-0x000000000795A000-memory.dmp

Filesize
40KB

Download
memory/224-99-0x00000000060C0000-0x0000000006126000-memory.dmp

Filesize
408KB

Download
memory/224-169-0x000000007F8F0000-0x000000007F900000-memory.dmp

Filesize
64KB

Download
memory/224-42-0x0000000002FD0000-0x0000000003006000-memory.dmp

Filesize
216KB

Download
memory/224-183-0x0000000007510000-0x000000000752E000-memory.dmp

Filesize
120KB

Download
memory/224-182-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/224-40-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/224-186-0x0000000007580000-0x0000000007623000-memory.dmp

Filesize
652KB

Download
memory/224-58-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/224-53-0x0000000005670000-0x0000000005C98000-memory.dmp

Filesize
6.2MB

Download
memory/224-61-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/224-203-0x0000000007F20000-0x000000000859A000-memory.dmp

Filesize
6.5MB

Download
memory/224-206-0x00000000078E0000-0x00000000078FA000-memory.dmp

Filesize
104KB

Download
memory/224-170-0x00000000751C0000-0x000000007520C000-memory.dmp

Filesize
304KB

Download
memory/224-70-0x0000000005600000-0x0000000005622000-memory.dmp

Filesize
136KB

Download
memory/224-73-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Filesize
408KB

Download
memory/224-167-0x0000000007530000-0x0000000007562000-memory.dmp

Filesize
200KB

Download
memory/224-109-0x0000000006130000-0x0000000006484000-memory.dmp

Filesize
3.3MB

Download
memory/224-135-0x00000000065B0000-0x00000000065CE000-memory.dmp

Filesize
120KB

Download
memory/224-136-0x0000000006600000-0x000000000664C000-memory.dmp

Filesize
304KB

Download
memory/224-403-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/224-267-0x0000000007B60000-0x0000000007B68000-memory.dmp

Filesize
32KB

Download
memory/224-234-0x0000000007B70000-0x0000000007C06000-memory.dmp

Filesize
600KB

Download
memory/224-245-0x0000000007AE0000-0x0000000007AF1000-memory.dmp

Filesize
68KB

Download
memory/224-250-0x0000000007B20000-0x0000000007B2E000-memory.dmp

Filesize
56KB

Download
memory/224-256-0x0000000007B30000-0x0000000007B44000-memory.dmp

Filesize
80KB

Download
memory/224-262-0x0000000007C10000-0x0000000007C2A000-memory.dmp

Filesize
104KB

Download
memory/968-52-0x0000000000590000-0x00000000005A0000-memory.dmp

Filesize
64KB

Download
memory/968-64-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/968-120-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/1180-114-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/1180-121-0x00000000048C0000-0x00000000048D0000-memory.dmp

Filesize
64KB

Download
memory/1180-1909-0x00000000048C0000-0x00000000048D0000-memory.dmp

Filesize
64KB

Download
memory/1180-1883-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/2220-68-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-230-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-26-0x00000000004A0000-0x00000000004D6000-memory.dmp

Filesize
216KB

Download
memory/2220-38-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/2220-154-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-1804-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/2220-115-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-185-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-163-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-188-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-54-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-202-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-56-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-141-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-168-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-51-0x0000000004C70000-0x0000000004CDC000-memory.dmp

Filesize
432KB

Download
memory/2220-63-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-66-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-232-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-223-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-71-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-106-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-165-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-207-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-156-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-195-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-151-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-149-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-147-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-145-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-143-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-172-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-86-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-139-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-137-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-228-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/2220-226-0x0000000004C70000-0x0000000004CD5000-memory.dmp

Filesize
404KB

Download
memory/3540-1836-0x000001DF557C0000-0x000001DF557D0000-memory.dmp

Filesize
64KB

Download
memory/3540-1830-0x000001DF557D0000-0x000001DF557F2000-memory.dmp

Filesize
136KB

Download
memory/3540-1845-0x00007FFA53300000-0x00007FFA53DC1000-memory.dmp

Filesize
10.8MB

Download
memory/3540-1835-0x00007FFA53300000-0x00007FFA53DC1000-memory.dmp

Filesize
10.8MB

Download
memory/3672-1881-0x000002682F2C0000-0x000002682F2C6000-memory.dmp

Filesize
24KB

Download
memory/3672-1873-0x00007FF47BE70000-0x00007FF47BE80000-memory.dmp

Filesize
64KB

Download
memory/3672-1876-0x000002682F130000-0x000002682F13A000-memory.dmp

Filesize
40KB

Download
memory/3672-1880-0x000002682F290000-0x000002682F298000-memory.dmp

Filesize
32KB

Download
memory/3672-1879-0x000002682F2E0000-0x000002682F2FA000-memory.dmp

Filesize
104KB

Download
memory/3672-1884-0x000002682ED00000-0x000002682ED10000-memory.dmp

Filesize
64KB

Download
memory/3672-1878-0x000002682F280000-0x000002682F28A000-memory.dmp

Filesize
40KB

Download
memory/3672-1875-0x000002682F070000-0x000002682F125000-memory.dmp

Filesize
724KB

Download
memory/3672-1887-0x00007FFA53420000-0x00007FFA53EE1000-memory.dmp

Filesize
10.8MB

Download
memory/3672-1877-0x000002682F2A0000-0x000002682F2BC000-memory.dmp

Filesize
112KB

Download
memory/3672-1858-0x00007FFA53420000-0x00007FFA53EE1000-memory.dmp

Filesize
10.8MB

Download
memory/3672-1882-0x000002682F2D0000-0x000002682F2DA000-memory.dmp

Filesize
40KB

Download
memory/3672-1874-0x000002682ED00000-0x000002682ED10000-memory.dmp

Filesize
64KB

Download
memory/3672-1872-0x000002682F050000-0x000002682F06C000-memory.dmp

Filesize
112KB

Download
memory/3672-1860-0x000002682ED00000-0x000002682ED10000-memory.dmp

Filesize
64KB

Download
memory/3672-1859-0x000002682ED00000-0x000002682ED10000-memory.dmp

Filesize
64KB

Download
memory/4920-55-0x00007FFA55540000-0x00007FFA56001000-memory.dmp

Filesize
10.8MB

Download
memory/4920-44-0x000001B126410000-0x000001B126464000-memory.dmp

Filesize
336KB

Download
memory/4920-134-0x00007FFA55540000-0x00007FFA56001000-memory.dmp

Filesize
10.8MB

Download
memory/5088-3317-0x0000000001BD0000-0x0000000001BF0000-memory.dmp

Filesize
128KB

Download
memory/5088-3439-0x0000000001BD0000-0x0000000001BF0000-memory.dmp

Filesize
128KB

Download
memory/5088-1910-0x0000000001AB0000-0x0000000001AD0000-memory.dmp

Filesize
128KB

Download