growtopia | c08b63c50a78ca119a5ff4fe10592a0f66289708df38349e91e645214aae7576

Analysis

max time kernel
1801s
max time network
1810s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
16-02-2024 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VespyGrabberBuilder.exe
Size

12.6MB
MD5

fab385fb154644665f94aca9424fb0ce
SHA1

8dc525108cebd97b3127129cc1633a7f31010424
SHA256

c08b63c50a78ca119a5ff4fe10592a0f66289708df38349e91e645214aae7576
SHA512

07def38b8590ebaa95d7213e77e3892f60f10a87cef797fa07c6feb033f08d4148024360c7c32b5f92441c41236b8a86e66cee59bb51d6fbde97b86923a640e3
SSDEEP

393216:NayDfg/3Y8G6jgVINcfwt+F2CZZiLe2Wq:wyDfYPwPwtO2Mie2J

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1488-58-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-59-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-62-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-45-0x0000000001E20000-0x0000000001E8C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-66-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-68-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-72-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-74-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-84-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-93-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-98-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-105-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-117-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-126-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-130-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-133-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-135-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-141-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-151-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-158-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-160-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-163-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-165-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-167-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-169-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-171-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-138-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-173-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-175-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-177-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-179-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-181-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-188-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1
behavioral2/memory/1488-190-0x0000000001E20000-0x0000000001E85000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 8 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeSahyui1337.exeKeyGeneratorTOP.exeKeyGeneratorTOP.exeWinErrorMgr.exebauwrdgwodhv.exe

pid	process
1488	Ilkdt.exe
4752	WinHostMgr.exe
3988	WinErrorMgr.exe
4000	Sahyui1337.exe
3828	KeyGeneratorTOP.exe
1320	KeyGeneratorTOP.exe
3208	WinErrorMgr.exe
1056	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

Processes:

KeyGeneratorTOP.exe

pid process

1320 KeyGeneratorTOP.exe
1320 KeyGeneratorTOP.exe
1320 KeyGeneratorTOP.exe
1320 KeyGeneratorTOP.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

1 discord.com
2 discord.com
26 pastebin.com
38 pastebin.com
196 pastebin.com

pid	process
1320	KeyGeneratorTOP.exe
1320	KeyGeneratorTOP.exe
1320	KeyGeneratorTOP.exe
1320	KeyGeneratorTOP.exe

flow	ioc
1	discord.com
2	discord.com
26	pastebin.com
38	pastebin.com
196	pastebin.com

Drops file in System32 directory 4 IoCs

Processes:

powershell.exebauwrdgwodhv.exeWinHostMgr.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 1056 set thread context of 3224	1056	bauwrdgwodhv.exe	conhost.exe
PID 1056 set thread context of 788	1056	bauwrdgwodhv.exe	explorer.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
4416	sc.exe
2044	sc.exe
4652	sc.exe
5000	sc.exe
2116	sc.exe
2084	sc.exe
4292	sc.exe
5116	sc.exe
3056	sc.exe
2984	sc.exe
3260	sc.exe
3160	sc.exe
560	sc.exe
4380	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4644 schtasks.exe

pid	process
4644	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sahyui1337.exepowershell.exemsedge.exemsedge.exemsedge.exeWinHostMgr.exepowershell.exebauwrdgwodhv.exepowershell.exeexplorer.exe

pid	process
4000	Sahyui1337.exe
4000	Sahyui1337.exe
2656	powershell.exe
2656	powershell.exe
2684	msedge.exe
2684	msedge.exe
4460	msedge.exe
4460	msedge.exe
2200	msedge.exe
2200	msedge.exe
4752	WinHostMgr.exe
2724	powershell.exe
2724	powershell.exe
2724	powershell.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
4752	WinHostMgr.exe
1056	bauwrdgwodhv.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
1056	bauwrdgwodhv.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe
788	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

664

pid	process
664

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 50 IoCs

Processes:

msedge.exe

pid	process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

Ilkdt.exeSahyui1337.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1488	Ilkdt.exe
Token: SeDebugPrivilege	4000	Sahyui1337.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeShutdownPrivilege	1472	powercfg.exe
Token: SeCreatePagefilePrivilege	1472	powercfg.exe
Token: SeShutdownPrivilege	4584	powercfg.exe
Token: SeCreatePagefilePrivilege	4584	powercfg.exe
Token: SeShutdownPrivilege	1804	powercfg.exe
Token: SeCreatePagefilePrivilege	1804	powercfg.exe
Token: SeShutdownPrivilege	4892	powercfg.exe
Token: SeCreatePagefilePrivilege	4892	powercfg.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	4768	powercfg.exe
Token: SeCreatePagefilePrivilege	4768	powercfg.exe
Token: SeShutdownPrivilege	2584	powercfg.exe
Token: SeCreatePagefilePrivilege	2584	powercfg.exe
Token: SeShutdownPrivilege	4128	powercfg.exe
Token: SeCreatePagefilePrivilege	4128	powercfg.exe
Token: SeShutdownPrivilege	3856	powercfg.exe
Token: SeCreatePagefilePrivilege	3856	powercfg.exe
Token: SeLockMemoryPrivilege	788	explorer.exe

Suspicious use of FindShellTrayWindow 57 IoCs

Processes:

msedge.exe

pid	process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

Processes:

msedge.exe

pid	process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

VespyGrabberBuilder.exeKeyGeneratorTOP.exeWinErrorMgr.exeKeyGeneratorTOP.exemsedge.exe

description	pid	process	target process
PID 4784 wrote to memory of 2656	4784	VespyGrabberBuilder.exe	powershell.exe
PID 4784 wrote to memory of 2656	4784	VespyGrabberBuilder.exe	powershell.exe
PID 4784 wrote to memory of 2656	4784	VespyGrabberBuilder.exe	powershell.exe
PID 4784 wrote to memory of 1488	4784	VespyGrabberBuilder.exe	Ilkdt.exe
PID 4784 wrote to memory of 1488	4784	VespyGrabberBuilder.exe	Ilkdt.exe
PID 4784 wrote to memory of 1488	4784	VespyGrabberBuilder.exe	Ilkdt.exe
PID 4784 wrote to memory of 4752	4784	VespyGrabberBuilder.exe	WinHostMgr.exe
PID 4784 wrote to memory of 4752	4784	VespyGrabberBuilder.exe	WinHostMgr.exe
PID 4784 wrote to memory of 3988	4784	VespyGrabberBuilder.exe	WinErrorMgr.exe
PID 4784 wrote to memory of 3988	4784	VespyGrabberBuilder.exe	WinErrorMgr.exe
PID 4784 wrote to memory of 3988	4784	VespyGrabberBuilder.exe	WinErrorMgr.exe
PID 4784 wrote to memory of 4000	4784	VespyGrabberBuilder.exe	Sahyui1337.exe
PID 4784 wrote to memory of 4000	4784	VespyGrabberBuilder.exe	Sahyui1337.exe
PID 4784 wrote to memory of 3828	4784	VespyGrabberBuilder.exe	KeyGeneratorTOP.exe
PID 4784 wrote to memory of 3828	4784	VespyGrabberBuilder.exe	KeyGeneratorTOP.exe
PID 3828 wrote to memory of 1320	3828	KeyGeneratorTOP.exe	KeyGeneratorTOP.exe
PID 3828 wrote to memory of 1320	3828	KeyGeneratorTOP.exe	KeyGeneratorTOP.exe
PID 3988 wrote to memory of 3208	3988	WinErrorMgr.exe	WinErrorMgr.exe
PID 3988 wrote to memory of 3208	3988	WinErrorMgr.exe	WinErrorMgr.exe
PID 3988 wrote to memory of 3208	3988	WinErrorMgr.exe	WinErrorMgr.exe
PID 1320 wrote to memory of 4460	1320	KeyGeneratorTOP.exe	msedge.exe
PID 1320 wrote to memory of 4460	1320	KeyGeneratorTOP.exe	msedge.exe
PID 4460 wrote to memory of 3944	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 3944	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe
PID 4460 wrote to memory of 2852	4460	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\VespyGrabberBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\VespyGrabberBuilder.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAcgB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAZAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAYgBxACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2112
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4012
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4416
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2984
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2044
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:3260
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1804
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:3160
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2116
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:560
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2084
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:3208
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3841.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:4644
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
  "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
    "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
        5⤵
        
        PID:2852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
        5⤵
        
        PID:4500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
        5⤵
        
        PID:3480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
        5⤵
        
        PID:772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
        5⤵
        
        PID:2032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
        5⤵
        
        PID:1744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
        5⤵
        
        PID:3908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
        5⤵
        
        PID:728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
        5⤵
        
        PID:608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
        5⤵
        
        PID:4852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
        5⤵
        
        PID:5000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5672 /prefetch:2
        5⤵
        
        PID:248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
        5⤵
        
        PID:1808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
        5⤵
        
        PID:1824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
        5⤵
        
        PID:5060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6064 /prefetch:8
        5⤵
        
        PID:4868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
        5⤵
        
        PID:2720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
        5⤵
        
        PID:3260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
        5⤵
        
        PID:200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
        5⤵
        
        PID:3036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
        5⤵
        
        PID:808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
        5⤵
        
        PID:2784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
        5⤵
        
        PID:3320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
        5⤵
        
        PID:4420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
        5⤵
        
        PID:940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
        5⤵
        
        PID:2292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
        5⤵
        
        PID:2436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
        5⤵
        
        PID:3840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
        5⤵
        
        PID:3340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
        5⤵
        
        PID:4868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
        5⤵
        
        PID:1588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
        5⤵
        
        PID:904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
        5⤵
        
        PID:4748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
        5⤵
        
        PID:3516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
        5⤵
        
        PID:2276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:1
        5⤵
        
        PID:3448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
        5⤵
        
        PID:2716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
        5⤵
        
        PID:960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8420 /prefetch:1
        5⤵
        
        PID:1204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
        5⤵
        
        PID:4416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8400 /prefetch:1
        5⤵
        
        PID:580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8208 /prefetch:1
        5⤵
        
        PID:2148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
        5⤵
        
        PID:1300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7820 /prefetch:1
        5⤵
        
        PID:3128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
        5⤵
        
        PID:2724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9672 /prefetch:1
        5⤵
        
        PID:5948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9816 /prefetch:1
        5⤵
        
        PID:5968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10040 /prefetch:1
        5⤵
        
        PID:6104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9612 /prefetch:1
        5⤵
        
        PID:5444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9888 /prefetch:1
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9592 /prefetch:1
        5⤵
        
        PID:5504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
        5⤵
        
        PID:5636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9384 /prefetch:1
        5⤵
        
        PID:4476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1696,11792311822590209638,12935073399796680184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9688 /prefetch:1
        5⤵
        
        PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      PID:1460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9e373cb8,0x7fff9e373cc8,0x7fff9e373cd8
        5⤵
        
        PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      PID:2080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9e373cb8,0x7fff9e373cc8,0x7fff9e373cd8
        5⤵
        
        PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      PID:4564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9e373cb8,0x7fff9e373cc8,0x7fff9e373cd8
        5⤵
        
        PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      PID:5880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9e373cb8,0x7fff9e373cc8,0x7fff9e373cd8
        5⤵
        
        PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9e373cb8,0x7fff9e373cc8,0x7fff9e373cd8
1⤵
PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2112

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1056
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3508
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2964
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:580
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4292
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4380
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3056
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4652
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3224
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
832KB

MD5
357baf338297a3b05aab01661dc7bea0

SHA1
65befcbcdc7abb738524c6f59a8fa7f7d14b80ed

SHA256
cbb57b501e8ad0bd8456e36b035bb89525c726a84aa2ce7533aa9616a8c1794b

SHA512
6a52f7028eea9f362831b460ec02d560c0b915001cd51c8575163fce449d5bdf1af885e55dc0b1a78026783438db20f5f9a873868a35c3fd949cf429857dbcd3

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
576KB

MD5
f86220bc1733d8fcf36671c3f2084f32

SHA1
88fb4d78387a774f3627eaf4b5f15261509c7ad3

SHA256
a228b49479579d64a6edaa72ded791a263e193a5e3ee77a45d05c639f9d102bd

SHA512
16969eee3e267c57005708b58af6e019ed89538d726800d49176f737b9f17a4d3087c1e7c23c768ddd275ecdb25b68eff05d414d6f4131cccc78acee1b1b2298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4b96f04e-fb07-4eda-8800-55ad7d37bf15.tmp

Filesize
11KB

MD5
cc42a007cfc68bbd161e7f79f0c2e019

SHA1
8cab03ef762f0cb72e2e31320ab0fff769beca91

SHA256
8f2922c29e47efb9407df8b0ec737e9194b7c4291ce30a77a44307be60643b6c

SHA512
ce1da3e4b8a1d94aeea5131e57d026a45537fb80c903d505dbdad166351c3dfb2a881318d601dd00da41ec1440e21f3f499b3da2154981a01f66f1069fd9e612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4a7484ba6d457556ace4c311458fce2

SHA1
fd8ef690a7b356300e024699478ea1f4193ef660

SHA256
ed5f71ca09455340e6a3a9b196b276e2880f482ba20c959248af412fbf993a50

SHA512
e35626dce77f642e060d3e54a84a4ad62af74576581f68ea1e041977dcf61d679c7b546102b99a221963d1d754566661b46eff2b3d6d751d300200d17e69ccad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
67KB

MD5
0b7c1872da555a0dc5fa19a4f6d812db

SHA1
aa9e833d55d154eadcd97db93febf64b33b3f815

SHA256
357e5f70faef40e0625a859b854f4ba7f780cd69d785fc54f18de246d8622b7e

SHA512
132f57b99f0f08b66d20fd91f3a2fdf326d3df6a14509e4a26fde9b708a952a9bc5caa6e23107ab4ef90737c70f41d61c9f7f247e5140f37fb06d15da2dc4a41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
241KB

MD5
bb21f0142660167a7221733e1d8c52a7

SHA1
9601d6b174ddec3a2d9226e35c3667b5f2384cdc

SHA256
19ab2be029a03c15dfa56da1d466920d96d832ec989b447e0f44328496d2be22

SHA512
910be468b61fe5303303be94831cb58e10896a1c0e408eb367a4e8ca01c0e6183c491c77c20aadf5a4fc90808de90ad70511ccb78a8ab8fcd501e37ac970d432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f4a4c283f41226bc3c5f59ff0f94ced5

SHA1
4218e92073225b61b67bee280ad73681e17ba61c

SHA256
be073ddc2585a8e03fefddb959937d9863afb5e638c7cdf9cdd6eeb8e8574cc5

SHA512
8ec44b3076d05ad8bf22509474b87ec4248a18efe7ca3dfffc33dd771ed50dc401362f8ddbb3d3881e55319d39ec27ddded5b6db39aaced49a38c01b83f9c7a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
1ea3166c2229db42d6f8cf363e9ee4c0

SHA1
487193ae4447201962a30db550f72b8bed56d1cd

SHA256
369c376a74ec77acc00697da57b099d80a0eb5393725a5c4de11cc946154271e

SHA512
5a08a40b58aadfad79f4f8170b9c99df94837187adb750b0fe485151f2c65eb694ed657f6ae9104409de11715891dbb934f3aeb07cedf2f6964627ee38f343dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9f892555d35c2ac3af8f4959c88b7911

SHA1
383610e65695249cc03eb7286fc46dff2afaf56f

SHA256
6cf2f6f1eade017e9396529c23cf22b9c1cd35d180cf0f4fff9c225f9a2e67b9

SHA512
9d161a417b849177d2646d44a1e970816ecde0e07884a86495bce9198b6b0db4d9835676d3c67bc9f85ed8aafec6a147e9944d21accd702fdce049d6457ad2f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
0e455c7190bcdd7f5b788fcad14fbb49

SHA1
54d020af3ac8e1494ec2a0b2288d36a74f119bee

SHA256
f3d21b4dba9c1d59b9c792ada50ae169fca272de7be34c18e5b1939e68e7f181

SHA512
0e8872a9310af02e3b24bda08b2de237b9d3122f4dfed25884259c4f6e375f34be77b587cd9c19ed07809c87097d9249ae93c25b2b3c79019856fdb7f0fb1bb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
ee049b92bf44dfa27f070fbcb0fdc965

SHA1
35a3bbf4b38fdc63a933ef4e570e3a175804e285

SHA256
d70b33a22737efa3b7b7931585bb433ef113bd218be648eeb95b86cd3bc34a9a

SHA512
36066f9698642d3e13e4d8814e7e63af3cc779c44978cece0c21aa211e7e2477dc94af1691bcc510947aa0b8cd5c5eb27fc06ab130e85fdb926e22b49a29610e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
2b96c933f96f23fc540f83e8ee48a2aa

SHA1
0642e26247ac8006a2b6e1d438f44e6317ca7460

SHA256
e57a08140707150851b3cf9292638a82c8cff33e525d4859561844cfef55efb4

SHA512
6b76d10ed54e5599698cece8c73a08c07e0a3e626584fc3f4465001ef6be0334b96228c424fd297ca39989201f80a9a062b782986eea5a71ca45a8b0f39bd30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2fe6a135aa95a3f5b56577e390c751c4

SHA1
d13f8760ed13e7d4a27a8c9185546e7209871d1c

SHA256
cd674226995845d4d4c118589e7cbc0ebe0c9e85603f29dd19abd7949600913a

SHA512
05dbdb4e83daafa20d998582b0f1aa24d2200bc039869ba990b44f56dd2ce3b3e4e7f626cda8c3abd2f07160a404f9e36122ea6d3a5ea500bde83eb666d0d252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c1b414b1fb4c98e225ecdd350f196153

SHA1
bb48c12abf210e29aca9d993d50bd2201f0113ba

SHA256
a5324f242960f1caa27b41a5b85414df8fa46882893d6c3a0aa8be540ffcb1e7

SHA512
b0f9ece3e2c7f1fcb03f95cedf9dcd15df5be1d084049fc269d4d800ba777cfbdb3f4e8d803630d25e8c83fd84bd27d715a1cd73d4830db1547380825c5c60b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ce573d38ce4f52a4dfde53aa6294cde8

SHA1
520b115ccb3988dddfbe2fd90ec547b9f89c8c12

SHA256
65f7d5374f2fee9eabc4b401c80b090ba9dc9d3681db3777caca30f1aca596de

SHA512
f9893d0765757a7ebcf3a365cf58ef5e64692c5e4d949052ef99763841299b2e69522770a9e413a9f2a8406134465b9dedc07632ab767b9bdc1f41b09c153767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b44a935d9e7ff4180029e1791376b650

SHA1
8ad752bc59d8bbf11ad35c0be4adcb63f908ffa3

SHA256
72bb8fa3917a787f0b57714fa1c94a31585cb97be215f7b054c7ab9f4197d3ea

SHA512
1d6e815fb5ae6e1ff48bd8feef5f24db6d301d90a2ad04fabf36a7f2b0590099c347ca003b65c030d4f9a3437ae8ae55d8fbebde33368913f9aac036bdeabd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6ccc29d1fe680c98677ee707b35ec16b

SHA1
08573566c2bc8f34052b0c2ced94737822988d5c

SHA256
6d3189d0915bebb0ff0fa7ac81495b20e5f68517b52684ae2cf696b459181602

SHA512
5f73df41b29be5d6a13d5d22fd3777f59f1ec16cf1afe9cb0e18c19920a1e56bf14d63b591b90c734a687d68af277a195fc3fc40a6b9cdd733fe402c06d6dab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fb9e190a6b8cacfaf681e5f7bcbab17f

SHA1
cfdb9efcc9b18ddb7a84a902f4bf63d51de6fbb7

SHA256
06d958b56e73bf2697efdcd0e0fb509e202640b38b2a1baa4d41cb19ad2a404d

SHA512
5167a788f3ffdb62e659ca4a056a404a5141b083bfcb77ae7f239593f5f386e1244ea81f14ede7a878f9e054a537aa51aca73727697bdb6a354e9f20ce276c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c45bb7d4d668690bab9cf6e8d40ff211

SHA1
9d6429920859f1c16fd56e69cf67f18829cd8880

SHA256
dafc5b334d6ebc895b7d765220dce20cc6b11d2e665cfee48170487a7c6a139e

SHA512
fab1a29ab00d0ac8179adecdc19bdbe57d1d18c0976ca62f0d3a2031057a4effb33ff140689af6fd2f5ce147906fa072cda12bc51401c1e8158ca0479b9676aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f15ba7e2cb4b5039e25bc4d40386961a

SHA1
13ed6d9543e8dd2b7d86429530c50d2b157a6dd0

SHA256
abfa8f35bc91010ff900f115605646a793069c4304651d11b6d0e79184ee66a6

SHA512
f20dc733456c9e15a3cbf195ded7ca671bdc72eb3d8b237aa0e54f8ee60f4f324324c7e492afd79db94dfaf238f4a42e878794f7e543ce074304216e4806ba5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f4ca538aaa73e1a49e6e44d4264a6de3

SHA1
0d555c6f18fc9063db6346ecc8f4fbf580d2a8c4

SHA256
88979958f1a70a63db45615cedc19d5fc1bd95ea694bfb0a8cc1d596791026ef

SHA512
59e58d2660f7e37d719309da5d037eb04185c61878843af5abed367079838c06219ae3f4ac7c183371fdce9c16301f719889ec95fb1b6dd12b56e2af3b8aaf51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8f743bc3a95af90964ae0b19cf96bd47

SHA1
20f543cc33a12a7a21b244e09d1b0eebe9685e95

SHA256
5ab7417d8c40c809c441851a7f42564deb1f9ef4fbb6e09689f3a94cb62499b3

SHA512
0f6312a959373c2e0b77349e58ffb7d0e1508b55e7822cd93ac53713fd97db4d40a75a557a08988740d08ed6dab21889a882695da545599c711834bc9919cda1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
6e9e88dcf640a9a8a0be5584d834d024

SHA1
111fd5dcfadefe87f176df88dc980a90b153b3f8

SHA256
08aede2ba1c524349e8c24e89a279d835ade156d2bbd95ba47abff906b5b77ee

SHA512
0dce00982e9fa19ad20f6ce07a7ae64a24cddd2034569e1ae44cd688b2142c41f55aa76424f108ff516468c551d72759323678870e0b9431660a1e6ab25ff05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
946718f39c47a4cc2bc8a79ebe47b8eb

SHA1
be65ada14883dab3a126c56412290330dd15b2b9

SHA256
4639f8579ac2521cc9fe51d9fb41291509cc2de2134907e01c7841ef0bf62fc8

SHA512
51abf9e447dcf34a29fedb2e3f6de0d5670da7801074b5cf47582924fc3fac04802b80b987d9b9b12c69ecb5eb22da21664655f533e93ef1e34b81c5b1addfbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d0a561120a25fc3d8b92f39f4697196d

SHA1
2fb2da8f81495f95dc22e8a421f43499714d6e4b

SHA256
2ed3c0ee9e01afdcbfcd2bbd778235fc4623269c9875ad546b38c738a5dd821b

SHA512
f4239b6b98a7f8a3dc09daf4bf491bacfc418a2446b98511692b1dcf3c74c2c9ee3ecdd0ae1c7f220bd9188c2c842fd8c2aaf57bc83081ade4af0b8e7b1ffc62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
033f1b0b4dc23ce82497a9c6a636a1e6

SHA1
238f07a657c6c82549f11f24c07bd6a0e0da0406

SHA256
0f915941de1f5ec7e8817403d3e9d60540c2d91a9130371e0ab324c05bc670ef

SHA512
68d317487711bd689336ea5ec8793d0cb69af7d08bbfa2d09b7e31f326e93e553b04905009dcccbab800b96284a6204dfc1a99f0c4087cb9831f030cb8c94c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7149a3479f37e91a84015f3bd8fa3041

SHA1
746665db20605e72a6c305b265a1d6daf0f153f3

SHA256
85161ca4ffb5dc4b7ea834055b5fa629a96d50c6217a62b387c3f223b3a732f2

SHA512
eb7ed8a62bbd5fbd9f39c76463ff5d5f77d36a321cca17ff1baede3b3d68c002fdb81020922bf9fa23d896614b9d7212d050f97c3ce6c7080c684127adde3fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a2e4b80f37996a884d72580df28ab1b

SHA1
17bb5c1cf67cf3d8cc96323ac8742a325d97d18b

SHA256
cb68c295e337977bb9f785e724358d001e17df55a482235bf2e66519c18f3764

SHA512
3c15c446d39a83210d680bb53463bacdc868ff03464df09a9988a3ac9c5386dfbc9b80598708b04903396a2445a8422dbb2bd2def01694c67767381afde1bf88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6b2a5b408bfb881cc2cec51569d95d2

SHA1
e36f786d4a8447a743a684ce2282ce2655eb7980

SHA256
267b694269f25787095f38b6f9467f16e8fc98b8ea59875f6a6bf75fc3756b9b

SHA512
469dbb90bb0c58f34d4acf0e9170964873a568a05797c493b2e17e2a3e1bba3de24aecaaf5d1d6e347cabf5696b5795446e96c460e5f7089d38a6e3fb8b29ecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b05e5851f8e966dbda2e196036377993

SHA1
de40833ef0722571c5e0a2dfa790336ea92899de

SHA256
6f971e52300286544926f8238d2b315ea5bc539f521a433486c2fe86edc89839

SHA512
fb20343d8bf768ffe2005192bef545244240673ff426d912ef3ceb927a1f11bc3ae991221cc81b7a0ea2fb12e845b0af4e3fb36a00a4e710fbddcb8e2c000d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6d11e459961fb7b188c962d22498f232

SHA1
b466cc563ab8b5a9051f5938ec1af1eb4b21e56b

SHA256
8f8373ef6248bf40d3e5c7f2c6ef4142cdceaafb791691a99456121bbbb16240

SHA512
ced7399d87c01b2a3217096b8a3d18be92ee56e505c7005956724fc9b90a032a0271e6efa934d910431138f5a1234fa74efbd9b8aac5161c109577bc7009e6d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f18105465d0aafee196364380d16299f

SHA1
c8b28918e39d4b434b90faf125c1636368efa569

SHA256
059b2743e0f4057d458d8849b7ec25d5b1f75cb481469ee29d7b3f5f8a11ddd5

SHA512
8902f47a51418fd9194fada9e5e0a2c256794a1302628637cb49a04adc52ce5e366e4cf90734b8f66eed599435083a1523ecfd1d8587bf80a2fec22457f51c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
67c5b5de2d96b3aba17eeeb157772dd1

SHA1
f663f64b78cf495b61c7e7a72ffa73552d8cdacd

SHA256
c475b30757887c335be79c087620eeaa31749cb1f82cefb2ea48640e377739f0

SHA512
0f892384278f868f6e986d31ec787720de25d261688551058110b3e4961390876d053c73dd156aebe1ba49364675e19669aed2842c4c38dd9c4820625f4c22a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
202B

MD5
7f01a293a41fecdb19eea5bdaa81d46e

SHA1
3826d7fd956927b7cef96450b67d9041a104cfb8

SHA256
b04f2ca22d1a0182992087e242a27307f9d43b2239e529779950943b4e55257a

SHA512
aa62fcef94b35c38e7e17c5fc145e258c47cdb02228fadf269eb4de9b83fb611fca0ab1346fd163b09d86d6ab049a97e3714b3d49966b92b1159164c4a07e69f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
611b12756a19f078918980d51f972c46

SHA1
dbef4a2656ac7b751c3cc3e8bd0b9b943f764391

SHA256
ff4871340cdfe8ff328c28bd6012bb3d7404d30cf9f79359a7e2f1729be1a10d

SHA512
a1a671b8bff1be1072834902329583dd587a60662b700c38baaa20c20757d4cc978dbd34d63710b475c23878e3c01cb02916f6110f63daca8ae3aeafc506e166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cb643f4e857edee014aba27931f3ab96

SHA1
7d45f3dfde113e4de4ac7031dfa2c4ca90e7d3c9

SHA256
26c3072dec7ace4fbf7da0fb3cbbc9e604b08ee3fd00df10cdd8ee04788ccbbd

SHA512
df160b3b33d6ec108e1891c69c3d4629aab8ac916a9df9dea5375bdeef71134c488d2f890679be2121d87bbe14eb19c00ecb9b41efbcde33b56932ccf6884fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
20c912a3772e7efecc905918d1983721

SHA1
6b9a7852a923b3d5099ccff3a6fbdaa1eeca3b63

SHA256
912c3e55766cc6fb789e1fd556025a93d756e1220e032d29b891519de6d8f987

SHA512
2f64e7ecd3f1199225bb48ee03dd13c53426ce610d81af80a96461f3c55f15a43c1661aa6884eda0e065a924a9de2ef823dae7957fd045197a17fdb65f4c035d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
30d4c03fa577253657145f61fe6b50e0

SHA1
9c663d4591c716b3d6842fa9dd331e730bb55ffe

SHA256
8d6ace0adf9aad1bbca8593f358bb7a6d04b8229121c0845978c3403350c13b0

SHA512
5ee10f89b5f0da836ef870b7f8fb47210ca55563ac63454bb069713b11f3e5cf2c59171373250f5697ea6fe1e3b03afd2df3a7ef74861ad092b32f31f84b3980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
83ab39516c8dc80ce3508e8491e6a75e

SHA1
0e9c80cd5adbb25cc35246cb34eb072e3eccb606

SHA256
df448f1cb75eb76af7daaaebd5df47a88e983e1b97dd6fc813185029ee657ac3

SHA512
8a98194d886f2c6525a7e14b6999808a0e6b1ea2d8903be06b6724b223835a9e236883b4597e39353dc620f8490b0ee920ee5f96ac3f7b2edd2abc388d3e2eeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
202B

MD5
ff4ee8e66aaeb682205bfafd4cd8f2b8

SHA1
fd958a05eb17f5ebc8cb8364a039507ef4a21d63

SHA256
775ff34dd6c6e5320ff5949061f7b04df1e047bdd8ecccb7486c713c1936c2ab

SHA512
e62d19280950bbcbb7fed409bc41634dbb3cc6f716c71c1396a44eed3dcedb458584b90e0536f2027ab945839780ec04ce093034170d59d8e5df36cdf6f24d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c8b5f.TMP

Filesize
204B

MD5
bda38ef9e54b6c4e419244566da3d762

SHA1
039e26343ed4d3cc18ba126b9238013bc712e595

SHA256
f4ac39140378553b9729090fa0552d38828dae678627486755c60f47d68d233b

SHA512
482021cc42fb4ddc48a92fac5961102a57a130e6f608196a935fa927e37ab338f65e160e9002eeac5495d16113a6f0b85c6d7e27a7076569b9e9bb93ff5b0691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
34f2dbacb43b58f5a837326e35ca2c8d

SHA1
9bf9782ae4069efc59700a559644bb39f488b2a0

SHA256
f93a030495f2a800968f6af643ef6f803bae334fa7373728e2cb1cc76331772f

SHA512
32e376e8d7ee30e434e60e77991dc4aadcb144afc494eb47e4dd8bf997be67d6de92ebeea95ec6483f8a02ee52097b0c52247320e691d4aa82e630067ea460cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
91d86bb51a81454b0d35803dc1f3f095

SHA1
29b3be7da55464933ade1dda54a4073bf3a9c2ca

SHA256
70a0a9446db62576475e12b4b4a1a1064692a899575e411627b723e28a80a230

SHA512
1b6f15e6efd56cb070b9e67d41ad94b1c92e15c5c4da0373d405776a98b98df1448b4e5c5d3463e607c1e503bbcf74df8d7e21dc03dc9e569eb5779268d42a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e120c58596e3318ed92f809084fff082

SHA1
d0f1d2ce2e95432393a7b14bebb54fd20554fcc6

SHA256
881cf783f71520a304f962bc48af1b39bca7897fd9ba509cae0d583319c7f478

SHA512
d7f3011e348a6dd5faf15318336d20da7d3c6c640e6f90e3cf4899b87af1967eb1902258c53d6c270cb68d413df23525267fb9d44adf3f93c88f83c85cca95a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a5cb41af5da44351767aa428e586a117

SHA1
2ebc8137689e5adfef4160b73b2a1520721126ee

SHA256
06fbf5b065d96e69df380b89fd78a49109733fabc9d252b2a00534770240a3c8

SHA512
c4e3b9c1ecd27f83e35220e6972a24e338f81afe67e0ef35860059db07101f24332cf26fe578a0d1bca0422e5fc2a5ebf7e1faa6d79458ca4e9a523d8a4d80a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e1990136275f25c04118b586eaf9cd8a

SHA1
f0dcd02c1d9b32c8ab82ad3fe117b0b6c0a786ca

SHA256
59f1393ea404a227e15ec078f5b5d67eceaa213f0eaa725db0eff78cdbb30627

SHA512
c91db7aad7cf8a24548b1f5bbab81f090e96d779592bbe472fb0e0171a46fe8af42ed29073c93161c35d2ebbc9415b0bf552de265cbea150ec8c8cb183e51e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f22857b15962c9b0cbbc7e3841c8c37b

SHA1
c0f058a1065f6e451c9701af16d8299a886241d3

SHA256
ead43357aac04c4642ea9d6ee43f238bd2325330beeac8589b23cdc0303c207d

SHA512
c5047052337f2911a0c76ef623bbb13378ef8d98374c159ab653edde6658dee6c1bee1cb132437c953a7104a10ffed795031da20c20a90791c7d193139287153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
408641808e457ab6e23d62e59b767753

SHA1
4205cfa0dfdfee6be08e8c0041d951dcec1d3946

SHA256
3921178878eb416764a6993c4ed81a1f371040dda95c295af535563f168b4258

SHA512
e7f3ffc96c7caad3d73c5cec1e60dc6c7d5ed2ced7d265fbd3a402b6f76fed310a087d2d5f0929ab90413615dad1d54fce52875750057cffe36ff010fc6323fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
832KB

MD5
3e6046ee3fc5557fd09ea48e41116918

SHA1
28f2dd32dbc76c9e4cd0273460593f7ccd3146f8

SHA256
7af157ff46912c1934b6f3043b8e12c529a6ce3568e02eeec102f74bcaf5cea6

SHA512
e9427ca1f00641cf38025a4eb05d172fc143bc4c395b3b029d344fc21dddd97f4aea9145e79a37130bc940a57fc827786a89527fb6bc18422a3716acce4bb7d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
256KB

MD5
7ec59a44e61af162137aa0a597b6cebf

SHA1
7948535aa6b1013df17e34200d1e8091285adf36

SHA256
55ce01acf53952ed93c5e0768c9f925390b39c7afecf361121e2157af48c0cad

SHA512
a777a5791bedad224b70772f5f92e98b15d4fb056d06e08134cf2fea81bf883f8bed92f771a6562856adf0777123648f1084952f3a0da25f7a8a8440aa987d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
1.3MB

MD5
5d219a4b86bc9075c1b661bf442acf5e

SHA1
411e11d162afd6e76dd7fec24f0b7fdd97db8891

SHA256
e088086248ecfd26515ade7da7d6128031a3ded60591a21bf06469f0f8cd47ee

SHA512
175316d34ca561ad341a579fcc05da27490bf9ab776dab3797f6b8a91ab8302318aff4305cd54ea83b972f3137d9d5762fb3eaa97dd454348a872c74c100c351

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
1.2MB

MD5
7a76975663c5d3de06bcc8103f9d7afb

SHA1
80a2aa7a179b49aa29bb3529f30a5ea9071963a8

SHA256
0a8306776765f5b1e9542b6a7fad426e9d47a31edccaf651726cd9865e319e0f

SHA512
4d5a7faa62eddeaa1b90607c7a3e8da94a2487d3c7b14f3575a57f82e41ad22b6a8f46586de5d8ffdbc725e69012fac0d850b510111a08b1031d00eed0edd4b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.7MB

MD5
868454a627021586c4327ef3a8afb2ee

SHA1
4e265903660706c1d244937ec89f955968e415fb

SHA256
7ae2b6e6b062a4728068c97a0246f7772734e0d095aeada55bbce812bf3df796

SHA512
ba8da083f24cd49e4e487564d1a0f9a361b550f791388fba6823d246d59747fae53ff4abece66709b1a2dd1159770225d0cb0dd3be49958fc811713654b2286e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
896KB

MD5
181b0cf88311a8ec9cd6c2ae951f7e04

SHA1
256ccda056596bfa80a928e19d4fec40eb646bd3

SHA256
81232b5d984f7a753829c6d38506a3b6bca47f1b4fe7b8ba009954de2c04573a

SHA512
a3a642a2fed869e5cdd49116fab1901218b729f4b9bf7fa131deaa1b46e7d4db03c2990747e9a979bd4da121496d48599611226ee8784c85af521736cbdee490

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.8MB

MD5
9c84341b4b74067c2192ccc640e684b6

SHA1
98d49b38de83f9c3b888a3aff48bd781c4cc849e

SHA256
b51f3ed25d80bef20b492e122d75ef8fa2ee177fca92dc6117ec023d58e2f48b

SHA512
ded1eeba8ebde27c9fc2511246f13e16e3ba3b82fa0f84a6260eaab911ca5f163ac7d64646c71cdb1a4c58d15cb9ea2e66ae8dbe1a2a66c967f8b9d8cc3f90d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\VCRUNTIME140.dll

Filesize
14KB

MD5
025997057ab9a7c463fd3e82d15a4d43

SHA1
b7eeca10232ac56e438e6c05b9a574f5c28e3db8

SHA256
cdbe7488ec1eca0014d37dc5cd8c26b274eb3520c361dc82ad071523dd47e516

SHA512
9f71897b23bfa4ab2da70d16b5ada92feb3152d955525789c0625dff46a4b39d049036feb273f94aba9011caa593164351da68449742992a8157f314a77c32f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\VCRUNTIME140.dll

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\base_library.zip

Filesize
1.3MB

MD5
44db87e9a433afe94098d3073d1c86d7

SHA1
24cc76d6553563f4d739c9e91a541482f4f83e05

SHA256
2b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71

SHA512
55bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\libcrypto-3.dll

Filesize
1.7MB

MD5
39d73824e5fd4bb4c9faec32ad753cef

SHA1
bffcef8bd744104a6608c887e72133e280b8ff9a

SHA256
855d31a6aa20c0781f2aa1693061b9ab9def410a7e7fba31ed72cbd2d5e0bd1b

SHA512
2af755bced5c319234945bf2d2647fd8ffbfeaf211b9654cd19ab032f8fb0b982498ea0d235b1030a18957e4171f8daf83ed83ed8d118f5d7cc302306e6acba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\python312.dll

Filesize
64KB

MD5
f8441253c380bc6ad42693f646031072

SHA1
bdc63ff40ac290d019ebf15c075ee7f90213d107

SHA256
b66992fb27606a42952f05c32cb03a8a60772aebfce4715168277fc3ba33da55

SHA512
886cc5e5ba9a2e9df74ebed14791705f44f5eff7ec8a47ddd84f789f95f646acc03d4f9d484aa4a0ea7163e8ef38b6d5532c2b370e794253d9017b65aac3029f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\python312.dll

Filesize
14KB

MD5
a7ef648c16b04d0ae3fa6a4278700b83

SHA1
d79083f1e9751ccdf3307b3bcd4f99e94d37d44e

SHA256
c8c7eb26b5e66cfb75576e4d4996753b852d71eca5a55fbe311e4496e9d9f6e2

SHA512
0cfca43183af28ee5036e313713de415956b1900791806015b88f316a6d88e486cc263aa70639da562449e17174209523a21ce291e617246793bb94357b6d373

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI38282\unicodedata.pyd

Filesize
1.1MB

MD5
fc47b9e23ddf2c128e3569a622868dbe

SHA1
2814643b70847b496cbda990f6442d8ff4f0cb09

SHA256
2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

SHA512
7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_grbfpkm2.k2u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3841.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
memory/1488-133-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-177-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-179-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-181-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-188-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-45-0x0000000001E20000-0x0000000001E8C000-memory.dmp

Filesize
432KB

Download
memory/1488-190-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-175-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-173-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-602-0x0000000001EA0000-0x0000000001EB0000-memory.dmp

Filesize
64KB

Download
memory/1488-138-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-171-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-169-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-167-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-62-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-59-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-58-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-165-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-163-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-50-0x0000000001EA0000-0x0000000001EB0000-memory.dmp

Filesize
64KB

Download
memory/1488-160-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-158-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-151-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-141-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-135-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-74-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-130-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-126-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-117-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-105-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-66-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-98-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-68-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-93-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-20-0x0000000073A60000-0x0000000074211000-memory.dmp

Filesize
7.7MB

Download
memory/1488-16-0x0000000000DE0000-0x0000000000E16000-memory.dmp

Filesize
216KB

Download
memory/1488-84-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-72-0x0000000001E20000-0x0000000001E85000-memory.dmp

Filesize
404KB

Download
memory/1488-598-0x0000000073A60000-0x0000000074211000-memory.dmp

Filesize
7.7MB

Download
memory/2656-264-0x0000000006D60000-0x0000000006D94000-memory.dmp

Filesize
208KB

Download
memory/2656-266-0x0000000074DA0000-0x0000000074DEC000-memory.dmp

Filesize
304KB

Download
memory/2656-17-0x0000000002880000-0x00000000028B6000-memory.dmp

Filesize
216KB

Download
memory/2656-42-0x0000000073A60000-0x0000000074211000-memory.dmp

Filesize
7.7MB

Download
memory/2656-41-0x0000000005130000-0x000000000575A000-memory.dmp

Filesize
6.2MB

Download
memory/2656-279-0x0000000006DA0000-0x0000000006E44000-memory.dmp

Filesize
656KB

Download
memory/2656-521-0x0000000073A60000-0x0000000074211000-memory.dmp

Filesize
7.7MB

Download
memory/2656-52-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/2656-48-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/2656-76-0x0000000004E90000-0x0000000004EB2000-memory.dmp

Filesize
136KB

Download
memory/2656-96-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/2656-99-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/2656-111-0x00000000058B0000-0x0000000005C07000-memory.dmp

Filesize
3.3MB

Download
memory/2656-155-0x0000000005D80000-0x0000000005D9E000-memory.dmp

Filesize
120KB

Download
memory/2656-156-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Filesize
304KB

Download
memory/2656-219-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/2656-261-0x000000007F460000-0x000000007F470000-memory.dmp

Filesize
64KB

Download
memory/2656-276-0x0000000006340000-0x000000000635E000-memory.dmp

Filesize
120KB

Download
memory/2656-283-0x00000000076E0000-0x0000000007D5A000-memory.dmp

Filesize
6.5MB

Download
memory/2656-284-0x00000000070A0000-0x00000000070BA000-memory.dmp

Filesize
104KB

Download
memory/2656-461-0x0000000007400000-0x0000000007408000-memory.dmp

Filesize
32KB

Download
memory/2656-295-0x0000000007130000-0x000000000713A000-memory.dmp

Filesize
40KB

Download
memory/2656-309-0x0000000007330000-0x00000000073C6000-memory.dmp

Filesize
600KB

Download
memory/2656-316-0x00000000072B0000-0x00000000072C1000-memory.dmp

Filesize
68KB

Download
memory/2656-367-0x0000000007310000-0x000000000731E000-memory.dmp

Filesize
56KB

Download
memory/2656-393-0x0000000007410000-0x000000000742A000-memory.dmp

Filesize
104KB

Download
memory/2656-382-0x00000000073D0000-0x00000000073E5000-memory.dmp

Filesize
84KB

Download
memory/2724-427-0x00007FFF8B180000-0x00007FFF8BC42000-memory.dmp

Filesize
10.8MB

Download
memory/2724-429-0x000002803A920000-0x000002803A930000-memory.dmp

Filesize
64KB

Download
memory/2724-431-0x000002803A920000-0x000002803A930000-memory.dmp

Filesize
64KB

Download
memory/2724-441-0x000002803A9A0000-0x000002803A9C2000-memory.dmp

Filesize
136KB

Download
memory/2724-466-0x000002803A920000-0x000002803A930000-memory.dmp

Filesize
64KB

Download
memory/2724-488-0x000002803A920000-0x000002803A930000-memory.dmp

Filesize
64KB

Download
memory/2724-538-0x00007FFF8B180000-0x00007FFF8BC42000-memory.dmp

Filesize
10.8MB

Download
memory/3208-139-0x00000000058B0000-0x00000000058C0000-memory.dmp

Filesize
64KB

Download
memory/3208-131-0x0000000073A60000-0x0000000074211000-memory.dmp

Filesize
7.7MB

Download
memory/3208-709-0x0000000073A60000-0x0000000074211000-memory.dmp

Filesize
7.7MB

Download
memory/3508-729-0x000001EAF9700000-0x000001EAF970A000-memory.dmp

Filesize
40KB

Download
memory/3508-714-0x000001EAFA090000-0x000001EAFA143000-memory.dmp

Filesize
716KB

Download
memory/3508-821-0x000001EAF9CE0000-0x000001EAF9CFA000-memory.dmp

Filesize
104KB

Download
memory/3508-805-0x000001EAF9730000-0x000001EAF973A000-memory.dmp

Filesize
40KB

Download
memory/3508-623-0x000001EAF9D30000-0x000001EAF9D40000-memory.dmp

Filesize
64KB

Download
memory/3508-606-0x000001EAF9D30000-0x000001EAF9D40000-memory.dmp

Filesize
64KB

Download
memory/3508-841-0x000001EAF9CA0000-0x000001EAF9CA8000-memory.dmp

Filesize
32KB

Download
memory/3508-748-0x000001EAF9CC0000-0x000001EAF9CDC000-memory.dmp

Filesize
112KB

Download
memory/3508-853-0x000001EAF9D00000-0x000001EAF9D0A000-memory.dmp

Filesize
40KB

Download
memory/3508-596-0x00007FFF8B180000-0x00007FFF8BC42000-memory.dmp

Filesize
10.8MB

Download
memory/3508-846-0x000001EAF9CB0000-0x000001EAF9CB6000-memory.dmp

Filesize
24KB

Download
memory/3508-710-0x000001EAF9710000-0x000001EAF972C000-memory.dmp

Filesize
112KB

Download
memory/3508-600-0x000001EAF9D30000-0x000001EAF9D40000-memory.dmp

Filesize
64KB

Download
memory/3508-711-0x00007FF433580000-0x00007FF433590000-memory.dmp

Filesize
64KB

Download
memory/3988-61-0x0000000073A60000-0x0000000074211000-memory.dmp

Filesize
7.7MB

Download
memory/3988-129-0x0000000073A60000-0x0000000074211000-memory.dmp

Filesize
7.7MB

Download
memory/3988-43-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/4000-71-0x000002B2981C0000-0x000002B2981D0000-memory.dmp

Filesize
64KB

Download
memory/4000-49-0x000002B2FD920000-0x000002B2FD974000-memory.dmp

Filesize
336KB

Download
memory/4000-69-0x00007FFF8C200000-0x00007FFF8CCC2000-memory.dmp

Filesize
10.8MB

Download
memory/4000-154-0x00007FFF8C200000-0x00007FFF8CCC2000-memory.dmp

Filesize
10.8MB

Download