hxxps://www[.]mediafire[.]com/file/w0fdoe8pgff9tdo/Auto_Heckin_Scope_Maker1[.]1[.]zip/file

Analysis

max time kernel
101s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/w0fdoe8pgff9tdo/Auto_Heckin_Scope_Maker1.1.zip/file

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5792	DivinityMashine.exe
2616	DivinityMashine.exe

Loads dropped DLL 44 IoCs

pid	Process
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
5792	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe
2616	DivinityMashine.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Auto_Heckin_Scope_Maker1.1\Auto_Heckin_Scope_Maker\Blank Scope\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Auto_Heckin_Scope_Maker1.1\Auto_Heckin_Scope_Maker\Blank Scope\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Auto_Heckin_Scope_Maker1.1\Auto_Heckin_Scope_Maker\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Auto_Heckin_Scope_Maker1.1\Auto_Heckin_Scope_Maker\desktop.ini	7zG.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 819006.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
5080	msedge.exe
5080	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe
3180	msedge.exe
3180	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3852	7zG.exe
Token: 35	3852	7zG.exe
Token: SeSecurityPrivilege	3852	7zG.exe
Token: SeSecurityPrivilege	3852	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
3852	7zG.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 516	5080	msedge.exe	84
PID 5080 wrote to memory of 516	5080	msedge.exe	84
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 3540	5080	msedge.exe	87
PID 5080 wrote to memory of 1996	5080	msedge.exe	86
PID 5080 wrote to memory of 1996	5080	msedge.exe	86
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88
PID 5080 wrote to memory of 2556	5080	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/w0fdoe8pgff9tdo/Auto_Heckin_Scope_Maker1.1.zip/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffe734846f8,0x7ffe73484708,0x7ffe73484718
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7932 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7868 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7816 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9104 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,6053796879770811731,1308590780912311414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136
- C:\Users\Admin\Downloads\DivinityMashine.exe
  "C:\Users\Admin\Downloads\DivinityMashine.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5420

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Auto_Heckin_Scope_Maker1.1\" -spe -an -ai#7zMap27625:114:7zEvent8655
1⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3852

C:\Users\Admin\Downloads\DivinityMashine.exe
"C:\Users\Admin\Downloads\DivinityMashine.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
65a51c92c2d26dd2285bfd6ed6d4d196

SHA1
8b795f63db5306246cc7ae3441c7058a86e4d211

SHA256
bb69ea4c761c6299b0abbc78f3728f19b37454a0b4eb607680ed202f29b4bb01

SHA512
6156dd7cec9fee04971c9a4c2a5826ba1bb3ef8b6511f1cdf17968c8e5a18bc0135510c2bd05cc26f3e7ae71f6e50400cf7bec536b78d9fa37ede6547cfa17e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce1273b7d5888e76f37ce0c65671804c

SHA1
e11b606e9109b3ec15b42cf5ac1a6b9345973818

SHA256
eb1ba494db2fa795a4c59a63441bd4306bdb362998f555cadfe6abec5fd18b8c

SHA512
899d6735ff5e29a3a9ee7af471a9167967174e022b8b76745ce39d2235f1b59f3aa277cc52af446c16144cce1f6c24f86b039e2ca678a9adac224e4232e23086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
61KB

MD5
1971e737391eabf87667012e84069a5a

SHA1
8fd29644afc6da70873c25f9bf9d1c495c759843

SHA256
c9aab23276584648e971c3745fca3bed6d9e4c7e373bf3dc7ad316f2aef42fd3

SHA512
23062a1d410b69532d3bf97ec7d1fa3c27e974613326fe3a3d80f909d595bda78f2ba366bcd612e494ecee1af1493264d0044a26fae604466e5437a25da6280b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e009e09e22804b522d2b06b7ef5fabfe

SHA1
d709e2bbd6651c5b3afdab33819905b63682c781

SHA256
7f150304e5871b58234ed641864d56404cd55a3e4b56490234ca4a8bbf822c77

SHA512
9fe9bc2309c4219d0a65a52ef7823f034819bdffdf05efa44b9dd4f2f6ff4037dd291ed05601395e1c4eecd81d28bbb550eebf9ce3e163633b43b0f1c1df7fb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
ab7fe66728ce7398181b14083c70d779

SHA1
c0f02682555ad4efce2f4996283b5aa9ad71303e

SHA256
bf0908389baa3249af6db82de03a17f3dd90f2763b94748932d8aa6ae219cc63

SHA512
f62086aa8da3e68b2b7c6212b10a43517286737c377ad3c8218e1a31d82bdd4782dd2f09985732625c5f6ed7b3de47ea6c2ca1eb8ff3aeb948b0cafef496f3d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
71a5d89b666abef9760fdb54b3eb886e

SHA1
c6aff0473ff39ca2d8fa0de5a72999026970661e

SHA256
aaf0cfd7d2314498867236915a071c03f66f97d34d994142ac9130da61949128

SHA512
6fbd6207d5ba26b42a4ee6436672f9248a03d8a5f125d4514177b5f1e1b8b070ba67aff243202e259a3522d7d707e1dcd7e64555e23f0c427cc36ece4a8247c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f11e905a7dca49c1909d9ca2a3011c0

SHA1
2f6cb7e465cbf8e1d9c365b57cfb644740afb842

SHA256
a5d686db75a4233fe1432768c1f982d60e8306ad8670dc7f382899d5ec309e7e

SHA512
ae3a31b9b6cf71d7740aae4206c1d3a826f02b1bca6c5b6296b1b8672f7b4e4278fb816783ff8d4af4c875cd5e958f056d0aea84f437bf4a737ff3c95c206677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
1626d1eac21afd0d9054a0dcd322c37c

SHA1
44bd5dd9585abee120b3780fe252915a2d27124d

SHA256
1aa0df6f5e089e1a9f656a38d09c0920d4940e95b75e45d2b1be27d0cf99e6ad

SHA512
c1b747c96835f5f73737335b5283c34d67f94a507083d4895ef5c06979926ee3135457efc5fec6dbf6f4d8796d81e49315ee5d55490a7242d1352e5fe4ce50f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
320323026ddfbd3f0dd9d7a551eb1588

SHA1
e903f073a0f10acf719cf75304437ee92017bc89

SHA256
c02b420c99bd191203bfb079d934f2946348755d0cf8b480a2992fa9ce940731

SHA512
c637ac3ccd89b08a1df5cea1663b083454661271cfb7b5669c7a40e18d75ba3d410b373b53cd1bb29eeaa0abfb23dc93ddbfc758352ae4f5e9a64274c0f00d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
041c16c179eefccd7b7257433befc9ee

SHA1
9d9cc6e9bcdbd244ca07626c09d21022787df8b1

SHA256
17cd475c7b5c8bf2754df5ad92b13926fa9dfa66b63c80d212102512aae337bf

SHA512
b23a5cc5d6fe540320f443c9075e614df4fe2cd9ded079ad7ae4304c65f6482e28fdf72cd6ad7cb870e89f9ed5002917bac5597877ecf439a32cb85be1050dff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
369b5bbf130ab0986e60624da47d847b

SHA1
eb539f99705fcd4f27a4db40002da90252a6f8a9

SHA256
aa1ddba123aa8c8b7f2e0ab8f658ae93142d8d99597234b302d963172902ec74

SHA512
5394f9bfcb47456c0cefed6ea84f8cca36884f7ee304f3b2de72eb610ec5a5e4f50802542fb1b7f57953774d9919205be64b5ffafe349ff92f9350a46dc2604d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57afc8.TMP

Filesize
2KB

MD5
ca48100276d84e0f837252f3b09c01bf

SHA1
81a7cdcaa2a173ae8aabde13a2b7d72255119aa9

SHA256
d0c5bcb9d26558e5e5fa8caab722fc20e2e89e24562327a0463d7bec27141793

SHA512
a5722f9770ef42258bf5c410eaee8d5be100af009282081be6bf14f8f79ce4bd2654b3d0a40b1efd651e3df94d16abbfef5a03ad051ae5bed83f20d6d8a054e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c4f5719f1915a83a4e75bdd0d0e0b881

SHA1
258206c30c7407aff3f7277a383d0e459441760b

SHA256
04cbb58aff8446915e373661d10e7a7839742285a216bfa04a658105619fd2ee

SHA512
1fed2fc644d186c21d6e3bf9c933c5eba0a3fef92226293b150555db0207113ef329c19a82f6305877ba5063b9448c17ece4a6e3b988102e8868e42317228369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
154e58643a3603968b46a063c7ee0cb6

SHA1
ed145825e4756b0f78b3840b10be555fbf874730

SHA256
000d1db37555fdfb8f49c507f9f988f6882979e2d80aa7f59681671fd5a0564d

SHA512
b5e1798993c8a824dcf6b1c4053fa1f90f8866eb8bb2c5ac1afd1e74aa2c5e8721204b2d6ef7000f36e7dd62fe10c141951dea367c01011bb07b29c735eec140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fb01c5e4e3950ea474de9b9b469b09ba

SHA1
592afce2d656f99bba6469dfeba5493737fc622f

SHA256
1d6ac23213548aed5a68936fa6e908708cd274aa9253478d75119474c3a0719d

SHA512
452c50b7a46e4697d9f58425bd5a3587344265b2fc976403bb1dd0b91f1da8416d4432882d5c7c8c64888541401c716be4f772b2d205bf1fcfd64eebc6348d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4fb54452f2c5d425ef20103cdcaf8e7e

SHA1
7733c1460228556f1b9aba6ffc7566b106a8a658

SHA256
839f1dafa2f4c197ca76d65c4f81eaf1dbbe48da686b653631fee12884945665

SHA512
9ccfac2b62ff2545158b16bd318e433c5ad04075dc7b277c77ab187a271bebce5f35e3348db5ff1a1af71fa572570c5a1fdec5e497d20fbb70f1efc0f08786e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\DivinityMashine.deps.json

Filesize
13KB

MD5
dbcc23ed13d2c7832536ec0904405846

SHA1
712bb7ad76f908a59b3f2b870e8be29b13883d88

SHA256
5c37ac7aa9918490067798a8182c1afc3bfae80bac8dcc5a512178b57a228ae6

SHA512
961795a27a1aa6669827780f2008dc1de62683f6bf5b97eab0efd37f9a832e5640350554e352c74a6899d637b8715930dabf30c8b7870a12eb2073e2566e729f

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\DivinityMashine.dll

Filesize
131KB

MD5
8eab52a0e4ae394fc4cb1f0d589f5b48

SHA1
23687c935c40c0c70dcc255dbeb58e0219067c69

SHA256
5eeb1d50e2e4dc030475f8fd4dc551633b0123de530ae6391c486f355f0f2e27

SHA512
581d3681842afa69f689374599b9f8df2151511aed8093ab3d94308c4fc72fd3e606c565093fa40ba675664dc44b7306267d9c1c95dd74b3e7d009fa05d928b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\DivinityMashine.runtimeconfig.json

Filesize
185B

MD5
516c1e6ba09e6c55018dc7a9399a7064

SHA1
9ccb5b0bdd741aa995f477d28a2fc9cda4e37f5b

SHA256
231c60ecfe91f878add778aba0ce908d2fbe0cf2a60bc73e08a9635144f84520

SHA512
e4f68ad276f8ba0bea7630f6c869e792009b7fd657497434c54aaaab4a451a17ccd8f7545b69cfbbad91eb2051fb1fd8f6e4d8a711aaba0cb9e1cd007e081018

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\System.Collections.dll

Filesize
323KB

MD5
e1ebe3926ee8d50b48131587fd0a5bb1

SHA1
53ede9bec4fb119b2dd5327192c80de754417aba

SHA256
c7d199a03e9493735c27c35052eddfc47cad60fb411255f33f3c99036cdd4d2d

SHA512
5608d9728636cf9a7ef1fdfc565ec0734d8de9aa7ed5fad1b831a5946957a537e99da02b75ea7194762d315031c7eed2d8586fdcddc1103817d5581232dee0f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\System.ComponentModel.Annotations.dll

Filesize
68KB

MD5
e4d8a2849e0e167f3830aea6bff927b9

SHA1
492fb92692aa32edca60746ca71e9d4a2f90f930

SHA256
4da4055f7a009370b482fbf8f471b421c608cfce6779db034998f603f74b8150

SHA512
25ecf48c5f63282f9381ad7d6fc63ea465c330053adc9dcb2fb24412569ef919fcf806fec21347c35a9b204fcd6644259cf10ded199d202952829d9bff13e912

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\System.ComponentModel.dll

Filesize
5KB

MD5
6d004ad0c4a0eafb8be2c53c59713d0b

SHA1
1aff40138c51ece320f5210cd3e8cc53d7001459

SHA256
d6b0495b4938e5f5a2394b48a864759a883d5a98abf782ff1df44538185e11ae

SHA512
bd8111c4f288a38c4a92ac8ebde560cae7dc92271025e60c42f1f00aa6f8cfe4d43804e1db180a1b66dd38be3b9ad53ca5fd5b70690ad49aa1280e12289aea79

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\System.Console.dll

Filesize
61KB

MD5
fb27d688cfa98d77eb53ca5f6e486366

SHA1
96b8b57b65ab4402917494fd846664350919a83f

SHA256
477125aa9e72bf923557a79ef142d3f956109398f1f29488d921c5431a3f09e1

SHA512
30ec19de3ba88a4a9f869ac32f3560b83acd4ff0dedd64680a9500dd6b6766712d1cf75a270ae8f38f47edb05a9ae36b8893d3417dcefd8871d823902ad1be07

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\System.IO.FileSystem.dll

Filesize
83KB

MD5
4e2c9a200db525f6c96309db529716a7

SHA1
bd6b9546c810c347547663aed3fa193613b24c3f

SHA256
a4af740a3ff30f7cee6237755f2b306715b0bd3a3cb42f97a1ba563878f26f97

SHA512
174ef79c063d60c78bfb9c30f1aa7339de62712f55820ad9d52388a5b96bb63baf5515c7f420f97e16d290dc685be23362d31ff99a33011b788ba05b0fa1069c

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\System.Linq.dll

Filesize
124KB

MD5
8fa24178a7775aa6c0ff5cbf5d81cd47

SHA1
b1c41b87198467b3ca4021b2f4e4b651262849d8

SHA256
ed54495ce6c43395ebb62d1f5fff0413aac7191e3fe6ec83c5c18be992ab9b41

SHA512
c73e0364a6c3c5af4c6a77b354d696b7864a1cd636b8633000dab102af9f560a7093b425cca083f637d68a01744b01e6a5a1baf9e4e6f031411f7ab4ec3d6681

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\System.Private.CoreLib.dll

Filesize
3.0MB

MD5
360fd07ea7b9c2df00adf9847601b449

SHA1
8a4d9903f95a479322a1c93ee9127b05340b6f4d

SHA256
72b7016b986cd817e4e317727733c51ed3075adac8ec74897b99234c6e9edf1f

SHA512
596078984d587775ff8130b57524e161847ec45e01bf59df1f5f1bf374e64b70d459484b670568ae46e601759052054322bfc62e188746ecfaa296e189708759

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\System.Private.Uri.dll

Filesize
236KB

MD5
517c045f582781aeb4f4975890564fb1

SHA1
d27e9e01a7dcc20a022fe0856a81f0560feb0907

SHA256
454507bc10ee9caec3954e08f7b2c21b488340622a264cdbbd0236bebb1f0331

SHA512
9caaaf8d0df53faee711685a7d6e998a30ddf681e5ca311dfb9e2be9ff159615c88e6a904f35abd46cdd9a2c99e56a8b48597a0e67e52cd464013308a46b7abd

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\System.Runtime.InteropServices.RuntimeInformation.dll

Filesize
10KB

MD5
4394e14f031b7121cb36fff60856e367

SHA1
7008894f38ab3694bab16b93d45cb21b138a2c23

SHA256
4141f089c88592fd87d1f14e2dcd8ac09dbcb49d37c44497a97c1f839d5ae7c9

SHA512
d55607b43570afe80f7d16423a52ab90e34c32c7011151495fdad545b65246948b3dfbe157e14f21933696889b19099aa40307f2da54094fec864316d5cc7796

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\System.Runtime.dll

Filesize
51KB

MD5
d486f353cab99d2cfa310d81cd19aa42

SHA1
84eb876c5fb2f14d95e89771bc8d72412d4969fb

SHA256
65a365351fa674fedeb11810c495c3bd8808ad6a278890e3c3622463b10e0de3

SHA512
eb79df65eb965a8c87a7d6b86e69358fd6ea4bcb0e8433ab7c4b097400fa60e8831aab86d45a6852c9c962b658412e6d73c6b91df245550e9b713e9f6785c39c

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\clrjit.dll

Filesize
1.2MB

MD5
f630ffcd46fe7924088c263ea16e0d2a

SHA1
2e3f0d973ca3c02f564e9d01c22b8e0b79bf1812

SHA256
e3173055356cdb2b803773dc2265c47806ca42a73e44441818b69c80a5f2d0aa

SHA512
a8314ae8cb89a664a558fea3769e0b0a24be872b611dde9dcd1aa76d215ed46b9704e8aa05f21e1e23973bea63e1643b2d3ac8ae83793564eb15eb6e91d59691

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\coreclr.dll

Filesize
3.6MB

MD5
d2bad168e7e391c7cfb40a44b12b3520

SHA1
f59b3dc518e6942410350c2d52613c7aa699090c

SHA256
f2f6b462de473d2617f406c809db23135df55eda0d98c14f8ddf50057bddb615

SHA512
60635bc6a37849ad0f3bc26e60750f900c86ae9f43fb62f09fcdcf47f68a91370a3dfa05a8649c8d4c59ba1547715c63849a5d4091da8ff805f4abec243a79c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\coreclr.dll

Filesize
2.1MB

MD5
51dab568c2b53a6426924d7114e60334

SHA1
68e5215a845a8d403cd40a68f0b557ece4a70bf7

SHA256
20fc5be1fc9e0e824e0fc16931f6d10745d2b150f45eee4f8cf08d05006eb603

SHA512
ddf8cce886c7ff385ab3ac93a32a1ff72f0c91777ab8fc78b189e1ddbb1193222f0f06649748f5db91717b981127c1b0b3c375fde277064e9acb73c3b7574caf

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\hostfxr.dll

Filesize
585KB

MD5
89e190296f23bf599993725ced5d8d89

SHA1
dcbd8e517d92885a1b8f9f864c77b3b78b0ca45d

SHA256
0b18bfe2aab661112d2cd61ba8399ba631cad09d735cd516a80709e7bb1b0e0d

SHA512
0acc36a26fd6fc7c509c1531999886488238be6ed7679cd913ac50ed3ec73647a5090184da70b6fd40e98389f3edb96ab279d5bf84700de50768dcf692700937

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\DivinityMashine\j1dzbk4t.xnq\hostpolicy.dll

Filesize
576KB

MD5
bdf71ec9ae4f7c23f2015b5ef21577d9

SHA1
0dd9734faeebf59e6743c8b03e4c9a0ea2917df5

SHA256
53722549b269e8e914b0748b466feaa7b29ed573b555eabd7fac6f71ada4f044

SHA512
e1fbee92e259580524fc29d6c3eff378023404e9af1780854a07170bf471efdbf9d92bbfba6a2e6dd28af06f8dce95be24f29309c4afbb1e4ac0885399c06366

Download Submit
C:\Users\Admin\Downloads\Auto_Heckin_Scope_Maker1.1.zip

Filesize
12.1MB

MD5
8baf29e214aca31e3193923053803af2

SHA1
9dfd6b5b42465014830c0c2283e8a970ae2774bc

SHA256
faa5585dfb5fe8d0a74080a73ba69f735fb4b62b32021d7afc59d6cb6bd1d430

SHA512
e51b77ddf258b57f5df4b8e06e50e443afae2a36d1efa63690138485f7d4ee1752caa103433e0522f459b3ef58e1ea33d2df9caae9f68258cc44b883a7baba0b

Download Submit
C:\Users\Admin\Downloads\Auto_Heckin_Scope_Maker1.1.zip

Filesize
12.8MB

MD5
f5d60ef6de3c0405bb11c1dcef28f0c1

SHA1
48d31ee9b063b186e1fa15324db0e20dc4bbfb14

SHA256
f1c771c9367ce8887d6ce6f9389c7bb814f87e9f7580620f929863736442d0cc

SHA512
78ccf76c1dc2730c9663702717d2e7cfa48980080169b11c068ed37adcb2cb5f1ba978edc13cb1c27c99c639e941e9f5330bae9d9c3da5d2e4969da47acd4d01

Download Submit
C:\Users\Admin\Downloads\Auto_Heckin_Scope_Maker1.1\Auto_Heckin_Scope_Maker\tools\DivinityMashine.exe

Filesize
9.3MB

MD5
38f1ab72a57faae9a52c3abf0d89deab

SHA1
15953e1cc39faa38901254bce8c5930354fe9f46

SHA256
6abbf331aca95c85cb1f45aaa4937524d99e4c60a6b88103d1a10eee8c47d83f

SHA512
e887bf2fdedbcc01b455e53ae68a3576f2b4cd2d4c6830b8f5df1688ee98cfbeab83085a2f1f6e83d7498c86de92497bb15232aa586b5888e0ea269b539602a2

Download Submit
C:\Users\Admin\Downloads\DivinityMashine.exe

Filesize
384KB

MD5
3908183a36c54178b379836e03ac17e8

SHA1
ad0ddaf0ccba4c98acc85765634fa0b3d0ba1725

SHA256
907a69d6553b794033a5d809886d33a576ac36b321ecd11f683968bfd7d923aa

SHA512
c91dfd2fc4a65521d18f7c46c283395d2699890f17a8afa873d02c56489067321b9aa6202ffb67460dc2142bd608d9484224af9b088ce50287f5e82bf57e376c

Download Submit
C:\Users\Admin\Downloads\DivinityMashine.exe

Filesize
11.8MB

MD5
7ca28643bc590848473011a42356a76c

SHA1
6f28c3fc5b52d441e97c50aac0039163ccf8cc05

SHA256
84957f0bd6aad17714899580cd61570b74e32d79b59001b940aa62f593ce5f2a

SHA512
a23e263f77566cc6460d80076257ce542bd1b03c95374b5274ab0e35280bbebba33849f9de375c513b66bf502c1f02be1d720662646d49e7ecc98ff33444ab07

Download Submit
C:\Users\Admin\Downloads\DivinityMashine.exe

Filesize
7.2MB

MD5
0ff34c030181b5afcb472ccf97cb4b46

SHA1
781e94f1c1cdad28bc604f2d82cf8dd81091874e

SHA256
06e03e24d15db605e7e27b93ebbd7eb03b85ae63a42895af571b94f520b3b629

SHA512
1223f2a35fc60a4c0b43377fbccc71f3acc1d2f242604f3bd96057eae9c6a3b068bf6f99a71d805491dce9bddeb446508d168f4647eaa91c417b3a1d83a7567e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 819006.crdownload

Filesize
11.8MB

MD5
3bb7ad4ae242136db1af92639c25b841

SHA1
5ed70769a83415622554326835f241d189015128

SHA256
2a4cb82eea98135713e60601e677fe6d747ea736f76b1d60d8465dae0c92a17c

SHA512
33c5e84bb6224786902f48f2eada794e3f4548f8ebfb7fcc6ffa0d7e03c7567044c6770dbcbddaddfcebe2e0e68527e4ff33a87ff99fb6dd93c1b93a48ad24ec

Download Submit
memory/2616-701-0x00007FFE5F000000-0x00007FFE5F56F000-memory.dmp

Filesize
5.4MB

Download
memory/2616-702-0x00007FFE5F000000-0x00007FFE5F56F000-memory.dmp

Filesize
5.4MB

Download
memory/5792-536-0x00007FFE5AFB0000-0x00007FFE5B51F000-memory.dmp

Filesize
5.4MB

Download
memory/5792-535-0x00007FFE5AFB0000-0x00007FFE5B51F000-memory.dmp

Filesize
5.4MB

Download