hxxps://cdn[.]discordapp[.]com/attachments/1207441831240142858/1210006342408994886/eW91bmdhb3M-1[.]zip?ex=65e8fd38&is=65d68838&hm=0f5e2324f13bdb8bf9c5083c4ca9b3377048108bff7bdb9c70e89ec5028ea2ae&

Analysis

max time kernel
68s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1207441831240142858/1210006342408994886/eW91bmdhb3M-1.zip?ex=65e8fd38&is=65d68838&hm=0f5e2324f13bdb8bf9c5083c4ca9b3377048108bff7bdb9c70e89ec5028ea2ae&

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	ifconfig.me
46	ifconfig.me

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5920	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings	msedge.exe

Runs regedit.exe 1 IoCs

pid	Process
5728	regedit.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1128	msedge.exe
1128	msedge.exe
4632	identity_helper.exe
4632	identity_helper.exe
4916	msedge.exe
4916	msedge.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5772	PowerShell.exe
5772	PowerShell.exe
5360	taskmgr.exe
5772	PowerShell.exe
5360	taskmgr.exe
5360	taskmgr.exe
5956	powershell.exe
5956	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	5360	taskmgr.exe
Token: SeSystemProfilePrivilege	5360	taskmgr.exe
Token: SeCreateGlobalPrivilege	5360	taskmgr.exe
Token: SeDebugPrivilege	5772	PowerShell.exe
Token: SeDebugPrivilege	5956	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe

Suspicious use of SendNotifyMessage 57 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe
5360	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2608	1128	msedge.exe	60
PID 1128 wrote to memory of 2608	1128	msedge.exe	60
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 2924	1128	msedge.exe	87
PID 1128 wrote to memory of 1740	1128	msedge.exe	88
PID 1128 wrote to memory of 1740	1128	msedge.exe	88
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89
PID 1128 wrote to memory of 1564	1128	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1207441831240142858/1210006342408994886/eW91bmdhb3M-1.zip?ex=65e8fd38&is=65d68838&hm=0f5e2324f13bdb8bf9c5083c4ca9b3377048108bff7bdb9c70e89ec5028ea2ae&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe105f46f8,0x7ffe105f4708,0x7ffe105f4718
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1532
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get name /value
    3⤵
    PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,9727318074717732350,12821672727361649230,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5064 /prefetch:2
  2⤵
  PID:5252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2708

C:\Users\Admin\Downloads\eW91bmdhb3M-1\eW91bmdhb3M=-1.exe
"C:\Users\Admin\Downloads\eW91bmdhb3M-1\eW91bmdhb3M=-1.exe"
1⤵
PID:3080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  "PowerShell" Expand-Archive -Path C:\Users\Admin\AppData\Local\Temp\ta7SW1dEA3atCQQ62t56.zip -DestinationPath C:\Users\Admin\AppData\Local\Temp\ta7SW1dEA3atCQQ62t56
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Start-Process -FilePath C:\Users\Admin\AppData\Local\Temp\ta7SW1dEA3atCQQ62t56\EsqueleSquad.exe -WindowStyle Hidden
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5956
- - C:\Users\Admin\AppData\Local\Temp\ta7SW1dEA3atCQQ62t56\EsqueleSquad.exe
    "C:\Users\Admin\AppData\Local\Temp\ta7SW1dEA3atCQQ62t56\EsqueleSquad.exe"
    3⤵
    PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\u812s.exe
      "C:\Users\Admin\AppData\Local\Temp\ta7SW1dEA3atCQQ62t56\EsqueleSquad.exe"
      4⤵
      PID:5040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\87v58nq103-13883.tmp"
        5⤵
        
        PID:5876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get model"
        5⤵
        
        PID:772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5728"
        5⤵
        
        PID:3520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get name /value"
        5⤵
        
        PID:5504
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get name /value
        6⤵
        
        PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  "PowerShell" Expand-Archive -Path C:\Users\Admin\AppData\Local\Temp\V0FzSeFFxjsDsdTuJUD4.zip -DestinationPath C:\Users\Admin\AppData\Local\Temp\V0FzSeFFxjsDsdTuJUD4
  2⤵
  PID:5564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Start-Process -FilePath C:\Users\Admin\AppData\Local\Temp\V0FzSeFFxjsDsdTuJUD4\system.exe -WindowStyle Hidden
  2⤵
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\V0FzSeFFxjsDsdTuJUD4\system.exe
    "C:\Users\Admin\AppData\Local\Temp\V0FzSeFFxjsDsdTuJUD4\system.exe"
    3⤵
    PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\onefile_6016_133530321535935164\u812s.exe
      "C:\Users\Admin\AppData\Local\Temp\V0FzSeFFxjsDsdTuJUD4\system.exe"
      4⤵
      PID:524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get model"
        5⤵
        
        PID:3516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get name /value"
        5⤵
        
        PID:1532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get TotalPhysicalMemory /value"
        5⤵
        
        PID:1992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\87v58nq103-10627.tmp"
        5⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\87v58nq103-10627.tmp
        
        C:\Users\Admin\AppData\Local\Temp\87v58nq103-10627.tmp
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\onefile_5856_133530321652179362\system.exe
        
        C:\Users\Admin\AppData\Local\Temp\87v58nq103-10627.tmp
        7⤵
        
        PID:3360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get model"
        8⤵
        
        PID:5880
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get model
        9⤵
        
        PID:2792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        8⤵
        
        PID:5340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get name /value"
        8⤵
        
        PID:4808
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get name /value
        9⤵
        
        PID:5716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get model"
        8⤵
        
        PID:772
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get model
        9⤵
        
        PID:4552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get TotalPhysicalMemory /value"
        8⤵
        
        PID:5676
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get TotalPhysicalMemory /value
        9⤵
        
        PID:5972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get name /value"
        8⤵
        
        PID:5280
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get name /value
        9⤵
        
        PID:2764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid /value"
        8⤵
        
        PID:5284
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid /value
        9⤵
        
        PID:5524

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5360

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
PID:5728

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5728
1⤵
- Kills process with taskkill
PID:5920

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get model
1⤵
PID:3588

C:\Users\Admin\AppData\Local\Temp\87v58nq103-13883.tmp
C:\Users\Admin\AppData\Local\Temp\87v58nq103-13883.tmp
1⤵
PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp-39nd3812.bat""
  2⤵
  PID:5052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    PID:5496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath D:\
    3⤵
    PID:4368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath E:\
    3⤵
    PID:2296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath F:\
    3⤵
    PID:1308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableBehaviorMonitoring 1
    3⤵
    PID:1632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring 1
    3⤵
    PID:5224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableIOAVProtection 1
    3⤵
    PID:5600

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get model
1⤵
PID:5152

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get TotalPhysicalMemory /value
1⤵
PID:5608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58670ac03d80eb4bd1cec7ac5672d2e8

SHA1
276295d2f9e58fb0b8ef03bd9567227fb94e03f7

SHA256
76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8

SHA512
99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3782686f747f4a85739b170a3898b645

SHA1
81ae1c4fd3d1fddb50b3773e66439367788c219c

SHA256
67ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13

SHA512
54eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7021d6b212ff12d310fc775365567428

SHA1
752ec880094301fe4766437a51bd79f841944870

SHA256
ad640d0b83f0acadd66cedccefa237bcabce17648571f5fd390fcef556a4f7a0

SHA512
c222270c80fb36057263b2a05237ceceebe3ac2b8fa2e76bce49ce30081cb347cd0b730771a057cc9738bb74e36747131e93e6ee073296d10c0919f89fca9e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bd772707e6dbcf00e555e5fa1a9f09f1

SHA1
d81e81a883271ef2cea672cbb43699404c129d7a

SHA256
93635d90815f14abfc7e8f82f37b9337649d27446e8078b6f9239a9ad1f67341

SHA512
106a09d4fee0f010a2450b0d3ae0fa9dcede23ba6d6499249359e0aa70a2b8a2465f615cf234bcf1221d02b4a5072d8cb9d65b90a2e45efad9d292b3fb0f6396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2d9668957130d964f9eb49e3fc5a423

SHA1
fbbc344a559b3282a31f21f6a76f4fac769c3777

SHA256
b84360ed3c1b96c877f3f350b26f6daa364298410c1a6b0292bbb09cfc33e50d

SHA512
7c703b77d7619b08fbbfb3e2a242232b68e92c13640afee1127e8cb7069ac077111c494902be4031473f9cfee3f3470b7470d2856461fdd0094eb63cc264857b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bfd3fce5439f1953880a8881d93c84a7

SHA1
e398643370e448f0dcbae4989fe0ad5824c02676

SHA256
fa314e831cd65481c2fb061d70f04c764167f34f1051434b4d4f1d4ce758f3ea

SHA512
bd1cac2972386b402ca3a45dc2af37886c4e315d8309ab5826e193cbf524852f0ac122aa2763dbbcb4e5199959914f63ace6a8abfce5081fc27c3f7b412261ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
a26df49623eff12a70a93f649776dab7

SHA1
efb53bd0df3ac34bd119adf8788127ad57e53803

SHA256
4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

SHA512
e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ff190b8dba095a4853ce05b7d4f090c7

SHA1
7d327be1d8b13fa67a1d58bf79e1969a08f8d174

SHA256
40df70e7cfcb592d334f2b89be9fbad4b40d508884dce06030e7f95d5149c275

SHA512
2c62369479c2bb06f3df5fa2a4d301e0f141dd8aeda1b2bc789bd3d161a2f3d25854f2d165cac61e3f1893ab6c186efeaab3e4bfdc957bae8fe9d34efe56dfe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
2d7ccad0445a4046adf23deda08742a4

SHA1
b59e1084a235a4d3fb827ba8f1e1857af13ad0a9

SHA256
8d19637f7691b2de9a29b471f00e5f6dbc844c92eb2df1b0803a9e0d0cbbe653

SHA512
ceada740a45c2bc31124ffb54ce761f75a991af9391f6f5bfa4ccedd6cc1f8ee9d662bc78ee1a92c810e65177f30248d411c7322d4d208d1a5be4ced324da6b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd

Filesize
1024KB

MD5
a0edba0ca99e74af81394fe6f62086b0

SHA1
b385b9f703ad89c252ddfdfd9e69904e6e6a52d8

SHA256
714b7a916452affcb6ce3ef557c7679b364dd9f0545d769804e4e49afbec0cf2

SHA512
a7c896d351b1427cec48cacf15f63964d921f5f1e140104fbe468e35a00f7354ce8309679a1b3b76cbafbe26ecaf6b1add3369d4a12b434cb7d8b72bdb9b221d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll

Filesize
2.2MB

MD5
9882914e548a58c779ff4a9a3b3bea42

SHA1
32602aed4822364714154aa821c7d7fb8bed1fab

SHA256
bd0203467ff78ce8c11a7c6915df07e1ea55b2b233bfd9fee8caf01f681321ab

SHA512
911316975f28a5fbf6f3e00fe219db836d2386d32e4d2c47025edd355c74148cbdd8ff6091fd35c1722ef1be6d3f0d132a9396eaa2f9739e91e2485d1652cbb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd

Filesize
29KB

MD5
0b55f18218f4c8f30105db9f179afb2c

SHA1
f1914831cf0a1af678970824f1c4438cc05f5587

SHA256
e7fe45baef9cee192c65fcfce1790ccb6f3f9b81e86df82c08f838e86275af02

SHA512
428ee25e99f882af5ad0dedf1ccdbeb1b4022ac286af23b209947a910bf02ae18a761f3152990c84397649702d8208fed269aa3e3a3c65770e21ee1eec064cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd

Filesize
512KB

MD5
dc08f04c9e03452764b4e228fc38c60b

SHA1
317bcc3f9c81e2fc81c86d5a24c59269a77e3824

SHA256
b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f

SHA512
fbc24dd36af658cece54be14c1118af5fda4e7c5b99d22f99690a1fd625cc0e8aa41fd9accd1c74bb4b03d494b6c3571b24f2ee423aaae9a5ad50adc583c52f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\V0FzSeFFxjsDsdTuJUD4.zip

Filesize
1.4MB

MD5
ff69867b2b1a7defcaf420f6460f87c5

SHA1
fcac5c95b757ec3d32ee6345e06d6e9895e37f9e

SHA256
8966f0c924a674f55431b65af2a59169c20047c54b91972c6e6f44e0359df23b

SHA512
3544c5de00c6e428d7bce6a8d44f35ade559507540c4c45cf440c07e7d997cf414137292e9bddbd2c287514800f6fa5a04932b9e7d40dd60ebc65aab39c586f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sla5g3u0.aj0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\VCRUNTIME140.dll

Filesize
64KB

MD5
d9c2529d395734d8b45424ffad61c13c

SHA1
7b22bc8c2f49dc1956a346eabb02037c1d5ae181

SHA256
a028671c6536180478bd1e0aad5b88ea226a13a3f7cf222845719a4aa8771891

SHA512
0595a2baee030433552afb01ea5c52d7a83e77e954d62eca27e461ca5c35866e84c2ecb52d66dda80ebedfa1eac3da126bcd1f54961fd4f80d90e4777a1b7d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\_brotli.pyd

Filesize
801KB

MD5
d9fc15caf72e5d7f9a09b675e309f71d

SHA1
cd2b2465c04c713bc58d1c5de5f8a2e13f900234

SHA256
1fcd75b03673904d9471ec03c0ef26978d25135a2026020e679174bdef976dcf

SHA512
84f705d52bd3e50ac412c8de4086c18100eac33e716954fbcb3519f4225be1f4e1c3643d5a777c76f7112fae30ce428e0ce4c05180a52842dacb1f5514460006

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\_bz2.pyd

Filesize
82KB

MD5
afaa11704fda2ed686389080b6ffcb11

SHA1
9a9c83546c2e3b3ccf823e944d5fd07d22318a1b

SHA256
ab34b804da5b8e814b2178754d095a4e8aead77eefd3668da188769392cdb5f4

SHA512
de23bb50f1d416cf4716a5d25fe12f4b66e6226bb39e964d0de0fef1724d35b48c681809589c731d3061a97c62b4dc7b9b7dfe2978f196f2d82ccce286be8a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\_cffi_backend.pyd

Filesize
177KB

MD5
210def84bb2c35115a2b2ac25e3ffd8f

SHA1
0376b275c81c25d4df2be4789c875b31f106bd09

SHA256
59767b0918859beddf28a7d66a50431411ffd940c32b3e8347e6d938b60facdf

SHA512
cd5551eb7afd4645860c7edd7b0abd375ee6e1da934be21a6099879c8ee3812d57f2398cad28fbb6f75bba77471d9b32c96c7c1e9d3b4d26c7fc838745746c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\_ctypes.pyd

Filesize
121KB

MD5
78df76aa0ff8c17edc60376724d206cd

SHA1
9818bd514d3d0fc1749b2d5ef9e4d72d781b51dd

SHA256
b75560db79ba6fb56c393a4886eedd72e60df1e2f7f870fe2e356d08155f367b

SHA512
6189c1bd56db5b7a9806960bc27742d97d2794acebc32e0a5f634fe0ff863e1775dcf90224504d5e2920a1192a3c1511fb84d41d7a2b69c67d3bdfbab2f968fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\_hashlib.pyd

Filesize
63KB

MD5
534902be1d8a57974efd025aff4f11ef

SHA1
1179c6153dc52f72c29fe1591dc9a889c2e229e9

SHA256
30adfb86513282e59d7e27968e1ff6686e43b8559994a50c17be66d0789f82b3

SHA512
7f0cdcf8576faf30fc8104b9bc9586d85ad50b7803074a7bcaa192eed05b1e2bd988a91873554fb63f204fcad86c667e95755c5ff13c43f96dc334ef3ea37240

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\_lzma.pyd

Filesize
155KB

MD5
2ae2464bfcc442083424bc05ed9be7d2

SHA1
f64b100b59713e51d90d2e016b1fe573b6507b5d

SHA256
64ba475a28781dca81180a1b8722a81893704f8d8fac0b022c846fdcf95b15b9

SHA512
6c3acd3dcae733452ad68477417693af64a7d79558e8ec9f0581289903c2412e2f29195b90e396bfdcd765337a6dea9632e4b8d936ac39b1351cd593cb12ce27

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\_queue.pyd

Filesize
31KB

MD5
dbd3c2c0a348a44a96d76100690c606d

SHA1
04e901eac1161255adb16155459ac50f124b30a6

SHA256
2bfd8459ba01c741d676f79ee96802fb2c29cb30f50301d67fde8bbce8e7e7d4

SHA512
99fee97c272bfff4515407d588b2761af7be39a83be070e01128fba71ff75404fbad6352bcdbe5465786ce86a6550f47b177d022ccb53f32f5a482db61bee3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\_socket.pyd

Filesize
77KB

MD5
11b7936a5bd929cc76ac3f4f137b5236

SHA1
09cb712fa43dc008eb5185481a5080997aff82ab

SHA256
8956b11c07d08d289425e7240b8fa37841a27c435617dbbd02bfe3f9405f422b

SHA512
7b050df283a0ad4295a5be47b99d7361f49a3cfd20691e201c5da5349a9eb8f5710ab3a26a66d194567539660ed227411485f4edf2269567a55a6b8ccfd71096

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\_ssl.pyd

Filesize
172KB

MD5
0e9e6d6839d74ad40bb9f16cc6601b13

SHA1
6671039088793f4ba42f5bd4409c26b1283ceafa

SHA256
bca1f490c9f7ba25cbbb4b39785dda8aa651123e22d4e7edc299b218c8157a81

SHA512
cb8742ae5db83487c21ba17d9efaca736df49f8f3c4a72355ede119717b83e0b4c6d94bd1c75a992abaf4ab89502a805f81b2529e85fd6a656600d6e7b0c90f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\charset_normalizer\md.pyd

Filesize
10KB

MD5
723ec2e1404ae1047c3ef860b9840c29

SHA1
8fc869b92863fb6d2758019dd01edbef2a9a100a

SHA256
790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94

SHA512
2e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\charset_normalizer\md__mypyc.pyd

Filesize
116KB

MD5
9ea8098d31adb0f9d928759bdca39819

SHA1
e309c85c1c8e6ce049eea1f39bee654b9f98d7c5

SHA256
3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753

SHA512
86af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\cryptography\hazmat\bindings\_rust.pyd

Filesize
4.2MB

MD5
135afd532bcf52daac6dcf74c64fb0b4

SHA1
537b26b7dd71b2c69aa36f408cc3d2ae16bb3c9f

SHA256
cc65dac7fd75711ac189726f3eb35987d9731233b28daca23bb3e92f91fe8e2e

SHA512
fcfe28fc9bd375da5bca128f676bbab2be44b0f3942b849e2495e6560610c8b011f1710f8f8e80aba40f1bf56fccdc9147ee1fd2405a83aff6b8fd43f172ce15

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\libcrypto-3.dll

Filesize
2.0MB

MD5
79612fbeeb364c1958ae50509976f398

SHA1
d38e0965c6d7ef67d4ac2b6b617a348ede8b0390

SHA256
5e0355a25521b6c09e17b5461a19c24c6b253308854a9feb13c4e098fbb3f7ec

SHA512
d317ef69f816dae4aa529ccf549d07715a47ec9cd2f03802e3fe12d262483db58b2b0605080161e86b2ad90229e7cb650097e733edf868f0c983f97f054f2079

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\libssl-3.dll

Filesize
771KB

MD5
bfc834bb2310ddf01be9ad9cff7c2a41

SHA1
fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c

SHA256
41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1

SHA512
6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\psutil\_psutil_windows.pyd

Filesize
65KB

MD5
2c62184e46ecc1641b8e09690f820405

SHA1
953db2789d5eeab981558388a727bd4d42364dd6

SHA256
43e09408673687a787415912336ac13fcca9a7d7945b73d0c84ac4bb071e9106

SHA512
2df440a9bf87345a5a0727cf4ae68592b32324a3a4d4611d047fbca7984a9b8e55487d89e83e80df8e0580c2a1db26db9722dbf18d4b2c8fd2770a55309e573e

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\python3.dll

Filesize
65KB

MD5
ff319d24153238249adea18d8a3e54a7

SHA1
0474faa64826a48821b7a82ad256525aa9c5315e

SHA256
a462a21b5f0c05f0f7ec030c4fde032a13b34a8576d661a8e66f9ad23767e991

SHA512
0e63fe4d5568cd2c54304183a29c7469f769816f517cd2d5b197049aa966c310cc13a7790560ef2edc36b9b6d99ff586698886f906e19645faeb89b0e65adfdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\python311.dll

Filesize
64KB

MD5
4d3bc8c5de4e9487cd4ad185d96f0e5a

SHA1
81e8a15fec698558804d62f3d46becc46a3415af

SHA256
790c6a7c342fa6e2d845468fd2bb462412541c736ee379f79af62dbe05768bb7

SHA512
0dc16c4321ae6d3b3d59babe940c488f275e2df735afe7aa08af16e62b91eb9e209bebe71903a0e57e3cbce38b7457a220a6bfbaf4cb2f0c15ebaea1491b8814

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\u812s.exe

Filesize
2.1MB

MD5
81232765bb3ae006b19f20b78a25d7c6

SHA1
9ff3be48ea843d5e8e779e201141210be3a0286c

SHA256
6b1bf2a84debe6ad520b09acd89b300975b3244726571be74b8a494660147a3b

SHA512
4afb5797476cfcf57c7f3a6610e48103768f61c175c3c3265c55c8fc317a1ad8a166ccab1ef01f323eea4a6dedd0e7e1a88a52e05a12e5fbd59072740fe1f00b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\u812s.exe

Filesize
3.3MB

MD5
6226f6e58ea62d27994500a7bc495bca

SHA1
a2874f201b8e9338131dcb276bd1497b4fac5960

SHA256
a2cd7ae5b0d51f32c96792a0d05bbadcec0c57f26a1df71ba63106e7930abe27

SHA512
f9acdf2701698e61167f189b42d37e7661c5a007f71c22a7fad4edc5938f35562ed26e1a115840e5e5e674ae5445bbe0fd9610a0ef0f695bcc2f929b63742c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5300_133530321431091574\vcruntime140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\ta7SW1dEA3atCQQ62t56.zip

Filesize
16.8MB

MD5
1591e74233c008948cc0feca8d20e5e3

SHA1
5ec69013cb1f306926680ae1dc01f417e8383e50

SHA256
208e306b10c95d74bf4cb81e199d01823d531d0a3d9bdd7f3c5b34c0bde3e89f

SHA512
d1c6374af4f69c452a34496048d53f68faeb3b1ad28ee1742333cc8fefefac9181eb8ff83f17abc2f40a7107647b90a9f7f70caeec5b0f1f3bf6473e683d25c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ta7SW1dEA3atCQQ62t56\EsqueleSquad.exe

Filesize
2.9MB

MD5
5017465b43f02993c7360e972062ef25

SHA1
9a7696d12e40996afe17a6aa8cccb46045327278

SHA256
557315e79ad4fdff560ae82598a7b541e30e173480cc755db1a113d3f51aa84e

SHA512
bd62126c47043e6e429e236c5f0d0f575d5d27008c8d5f89d6218ec4f37a11f8ddb76b8b794e7aa3482b733a047cfba675e9f7754d5c8907489ad1be8f3c6933

Download Submit
C:\Users\Admin\AppData\Local\Temp\ta7SW1dEA3atCQQ62t56\EsqueleSquad.exe

Filesize
128KB

MD5
8e926cca05751cf36825ba000a2570da

SHA1
2cae72462fb50d3af81f19934954d11ba72e7b04

SHA256
fc31a5a0ab5b5c79241cb56daf810916caba9d157266bd5747d48f88b6bd3e71

SHA512
8a50cc59a006bafe4ef5e1045fd078e93619638e5404ea16e2c9aebb7d21b7a524902d2c91a9f9f923e99528421eceb18b75713c8fb482a610a261d33e8d3ed0

Download Submit
C:\Users\Admin\Downloads\eW91bmdhb3M-1.zip

Filesize
18.1MB

MD5
eb56d54fa4b60c0d24caa68fc8bc5ba9

SHA1
e5deff92409f359776053afdcf0aadb977e85191

SHA256
d93da212b31549f36938ab7d88a6e8d1bae14fff1427f3dbf8b87bd76fa957e0

SHA512
699cfdd628ab9b10a67365caee8123655a749167f61d14259f76f47c2566b9676efabe44f0a9c7c581c703b6656f327e74c0e7f53ad825391759834a1e5869f9

Download Submit
memory/524-561-0x00007FF7B2E00000-0x00007FF7B3E00000-memory.dmp

Filesize
16.0MB

Download
memory/524-518-0x00007FF7B2E00000-0x00007FF7B3E00000-memory.dmp

Filesize
16.0MB

Download
memory/1308-508-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/1308-520-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/1308-510-0x000002ACC1450000-0x000002ACC1460000-memory.dmp

Filesize
64KB

Download
memory/1308-517-0x000002ACC1450000-0x000002ACC1460000-memory.dmp

Filesize
64KB

Download
memory/1308-509-0x000002ACC1450000-0x000002ACC1460000-memory.dmp

Filesize
64KB

Download
memory/1632-531-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/2296-496-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/2296-494-0x0000021D35EF0000-0x0000021D35F00000-memory.dmp

Filesize
64KB

Download
memory/2296-478-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/2296-480-0x0000021D35EF0000-0x0000021D35F00000-memory.dmp

Filesize
64KB

Download
memory/2296-479-0x0000021D35EF0000-0x0000021D35F00000-memory.dmp

Filesize
64KB

Download
memory/2792-315-0x00007FFDFCC30000-0x00007FFDFD6F1000-memory.dmp

Filesize
10.8MB

Download
memory/2792-290-0x00007FFDFCC30000-0x00007FFDFD6F1000-memory.dmp

Filesize
10.8MB

Download
memory/2792-292-0x000002B165A60000-0x000002B165A70000-memory.dmp

Filesize
64KB

Download
memory/2792-291-0x000002B165A60000-0x000002B165A70000-memory.dmp

Filesize
64KB

Download
memory/3360-563-0x00007FF7C6440000-0x00007FF7CBA5E000-memory.dmp

Filesize
86.1MB

Download
memory/3656-96-0x0000025BDCCA0000-0x0000025BDCD16000-memory.dmp

Filesize
472KB

Download
memory/3656-82-0x0000025BDC660000-0x0000025BDC682000-memory.dmp

Filesize
136KB

Download
memory/3656-92-0x00007FFDFD160000-0x00007FFDFDC21000-memory.dmp

Filesize
10.8MB

Download
memory/3656-93-0x0000025BC4070000-0x0000025BC4080000-memory.dmp

Filesize
64KB

Download
memory/3656-94-0x0000025BC4070000-0x0000025BC4080000-memory.dmp

Filesize
64KB

Download
memory/3656-95-0x0000025BDCBD0000-0x0000025BDCC14000-memory.dmp

Filesize
272KB

Download
memory/3656-120-0x00007FFDFD160000-0x00007FFDFDC21000-memory.dmp

Filesize
10.8MB

Download
memory/4368-363-0x000001E7776B0000-0x000001E7776C0000-memory.dmp

Filesize
64KB

Download
memory/4368-362-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/4368-364-0x000001E7776B0000-0x000001E7776C0000-memory.dmp

Filesize
64KB

Download
memory/4368-366-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/5040-346-0x00007FF749020000-0x00007FF74A020000-memory.dmp

Filesize
16.0MB

Download
memory/5040-370-0x00007FF749020000-0x00007FF74A020000-memory.dmp

Filesize
16.0MB

Download
memory/5040-557-0x00007FF749020000-0x00007FF74A020000-memory.dmp

Filesize
16.0MB

Download
memory/5224-542-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/5300-342-0x00007FF68D310000-0x00007FF691E49000-memory.dmp

Filesize
75.2MB

Download
memory/5300-227-0x00007FF68D310000-0x00007FF691E49000-memory.dmp

Filesize
75.2MB

Download
memory/5360-109-0x0000015ABFDA0000-0x0000015ABFDA1000-memory.dmp

Filesize
4KB

Download
memory/5360-97-0x0000015ABFDA0000-0x0000015ABFDA1000-memory.dmp

Filesize
4KB

Download
memory/5360-98-0x0000015ABFDA0000-0x0000015ABFDA1000-memory.dmp

Filesize
4KB

Download
memory/5360-99-0x0000015ABFDA0000-0x0000015ABFDA1000-memory.dmp

Filesize
4KB

Download
memory/5360-103-0x0000015ABFDA0000-0x0000015ABFDA1000-memory.dmp

Filesize
4KB

Download
memory/5360-104-0x0000015ABFDA0000-0x0000015ABFDA1000-memory.dmp

Filesize
4KB

Download
memory/5360-106-0x0000015ABFDA0000-0x0000015ABFDA1000-memory.dmp

Filesize
4KB

Download
memory/5360-105-0x0000015ABFDA0000-0x0000015ABFDA1000-memory.dmp

Filesize
4KB

Download
memory/5360-107-0x0000015ABFDA0000-0x0000015ABFDA1000-memory.dmp

Filesize
4KB

Download
memory/5360-108-0x0000015ABFDA0000-0x0000015ABFDA1000-memory.dmp

Filesize
4KB

Download
memory/5496-348-0x000002A7B0340000-0x000002A7B0350000-memory.dmp

Filesize
64KB

Download
memory/5496-352-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/5496-347-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/5496-349-0x000002A7B0340000-0x000002A7B0350000-memory.dmp

Filesize
64KB

Download
memory/5564-245-0x00000215AB7E0000-0x00000215AB7F0000-memory.dmp

Filesize
64KB

Download
memory/5564-226-0x00000215AB7E0000-0x00000215AB7F0000-memory.dmp

Filesize
64KB

Download
memory/5564-225-0x00000215AB7E0000-0x00000215AB7F0000-memory.dmp

Filesize
64KB

Download
memory/5564-224-0x00007FFDFCC30000-0x00007FFDFD6F1000-memory.dmp

Filesize
10.8MB

Download
memory/5564-260-0x00007FFDFCC30000-0x00007FFDFD6F1000-memory.dmp

Filesize
10.8MB

Download
memory/5600-553-0x00007FFDFCD30000-0x00007FFDFD7F1000-memory.dmp

Filesize
10.8MB

Download
memory/5772-146-0x00000281F4E40000-0x00000281F4E4A000-memory.dmp

Filesize
40KB

Download
memory/5772-151-0x00007FFDFCAF0000-0x00007FFDFD5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5772-137-0x00000281F4460000-0x00000281F4470000-memory.dmp

Filesize
64KB

Download
memory/5772-138-0x00000281F4460000-0x00000281F4470000-memory.dmp

Filesize
64KB

Download
memory/5772-143-0x00000281F4460000-0x00000281F4470000-memory.dmp

Filesize
64KB

Download
memory/5772-145-0x00000281F4E50000-0x00000281F4E62000-memory.dmp

Filesize
72KB

Download
memory/5772-136-0x00007FFDFCAF0000-0x00007FFDFD5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5856-562-0x00007FF6F6570000-0x00007FF6FA459000-memory.dmp

Filesize
62.9MB

Download
memory/5956-192-0x00007FFDFCAF0000-0x00007FFDFD5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5956-163-0x000001C8B4780000-0x000001C8B4790000-memory.dmp

Filesize
64KB

Download
memory/5956-157-0x00007FFDFCAF0000-0x00007FFDFD5B1000-memory.dmp

Filesize
10.8MB

Download
memory/5956-165-0x000001C8B4780000-0x000001C8B4790000-memory.dmp

Filesize
64KB

Download
memory/5956-162-0x000001C8B4780000-0x000001C8B4790000-memory.dmp

Filesize
64KB

Download
memory/6016-367-0x00007FF7CE970000-0x00007FF7D33B0000-memory.dmp

Filesize
74.2MB

Download