Analysis

  • max time kernel
    225s
  • max time network
    226s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/05/2024, 23:56

General

  • Target

    https://github.com/d4rkw0lf667/nitro-generator-V2

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/975336363153031178/8op4_fCpVhyfI_03V_xCMrnSKxG1j4smHmlbTABd2zvfK7NfLM6solTC3r5Ph39lKIU6

Signatures

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Looks for VMWare Tools registry key 2 TTPs 7 IoCs
  • Checks BIOS information in registry 2 TTPs 7 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs
  • Looks up external IP address via web service 14 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 14 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Detects Pyinstaller 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 7 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 31 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/d4rkw0lf667/nitro-generator-V2
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc310b46f8,0x7ffc310b4708,0x7ffc310b4718
      2⤵
        PID:2300
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        2⤵
          PID:244
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1280
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
          2⤵
            PID:3520
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
            2⤵
              PID:4600
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
              2⤵
                PID:4032
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
                2⤵
                  PID:704
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:64
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
                  2⤵
                    PID:2896
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
                    2⤵
                      PID:3476
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
                      2⤵
                        PID:704
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
                        2⤵
                          PID:1008
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5392 /prefetch:8
                          2⤵
                            PID:3948
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
                            2⤵
                              PID:3248
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6236 /prefetch:8
                              2⤵
                                PID:4472
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4344
                              • C:\Users\Admin\Downloads\nitro generator.exe
                                "C:\Users\Admin\Downloads\nitro generator.exe"
                                2⤵
                                • Looks for VirtualBox Guest Additions in registry
                                • Looks for VMWare Tools registry key
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Maps connected drives based on registry
                                • Checks SCSI registry key(s)
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4888
                              • C:\Users\Admin\Downloads\nitro generator.exe
                                "C:\Users\Admin\Downloads\nitro generator.exe"
                                2⤵
                                • Looks for VirtualBox Guest Additions in registry
                                • Looks for VMWare Tools registry key
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Maps connected drives based on registry
                                • Checks SCSI registry key(s)
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1624
                              • C:\Users\Admin\Downloads\nitro generator.exe
                                "C:\Users\Admin\Downloads\nitro generator.exe"
                                2⤵
                                • Looks for VirtualBox Guest Additions in registry
                                • Looks for VMWare Tools registry key
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Maps connected drives based on registry
                                • Checks SCSI registry key(s)
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3560
                              • C:\Users\Admin\Downloads\nitro generator.exe
                                "C:\Users\Admin\Downloads\nitro generator.exe"
                                2⤵
                                • Looks for VirtualBox Guest Additions in registry
                                • Looks for VMWare Tools registry key
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Maps connected drives based on registry
                                • Checks SCSI registry key(s)
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2460
                              • C:\Users\Admin\Downloads\nitro generator.exe
                                "C:\Users\Admin\Downloads\nitro generator.exe"
                                2⤵
                                • Looks for VirtualBox Guest Additions in registry
                                • Looks for VMWare Tools registry key
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Maps connected drives based on registry
                                • Checks SCSI registry key(s)
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1340
                              • C:\Users\Admin\Downloads\nitro generator.exe
                                "C:\Users\Admin\Downloads\nitro generator.exe"
                                2⤵
                                • Looks for VirtualBox Guest Additions in registry
                                • Looks for VMWare Tools registry key
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Maps connected drives based on registry
                                • Checks SCSI registry key(s)
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5164
                              • C:\Users\Admin\Downloads\nitro generator.exe
                                "C:\Users\Admin\Downloads\nitro generator.exe"
                                2⤵
                                • Looks for VirtualBox Guest Additions in registry
                                • Looks for VMWare Tools registry key
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Maps connected drives based on registry
                                • Checks SCSI registry key(s)
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5320
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1300 /prefetch:8
                                2⤵
                                  PID:876
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2740 /prefetch:1
                                  2⤵
                                    PID:3692
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
                                    2⤵
                                      PID:5648
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6540 /prefetch:8
                                      2⤵
                                        PID:1068
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6344 /prefetch:2
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5412
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
                                        2⤵
                                          PID:5564
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,5903142285557870473,7543631926887582246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2996 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4272
                                        • C:\Users\Admin\Downloads\Nitro gen.exe
                                          "C:\Users\Admin\Downloads\Nitro gen.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          PID:1928
                                          • C:\Users\Admin\Downloads\Nitro gen.exe
                                            "C:\Users\Admin\Downloads\Nitro gen.exe"
                                            3⤵
                                            • Drops startup file
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5132
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "ver"
                                              4⤵
                                                PID:4876
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                4⤵
                                                  PID:5232
                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                    C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                    5⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1916
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                                                  4⤵
                                                    PID:5848
                                                    • C:\Windows\system32\netsh.exe
                                                      netsh wlan show profiles
                                                      5⤵
                                                        PID:3156
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                      4⤵
                                                        PID:3660
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic os get Caption
                                                          5⤵
                                                            PID:5044
                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                          wmic cpu get Name
                                                          4⤵
                                                            PID:2428
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                            4⤵
                                                              PID:5852
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic path win32_VideoController get name
                                                                5⤵
                                                                • Detects videocard installed
                                                                PID:5704
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                              4⤵
                                                                PID:5864
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic computersystem get totalphysicalmemory
                                                                  5⤵
                                                                    PID:5376
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                  4⤵
                                                                    PID:5948
                                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                                      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                      5⤵
                                                                        PID:4884
                                                                • C:\Users\Admin\Downloads\Nitro gen.exe
                                                                  "C:\Users\Admin\Downloads\Nitro gen.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:6008
                                                                  • C:\Users\Admin\Downloads\Nitro gen.exe
                                                                    "C:\Users\Admin\Downloads\Nitro gen.exe"
                                                                    3⤵
                                                                    • Drops startup file
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5964
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "ver"
                                                                      4⤵
                                                                        PID:4516
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                        4⤵
                                                                          PID:2040
                                                                          • C:\Windows\System32\wbem\WMIC.exe
                                                                            C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                            5⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3220
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                                                                          4⤵
                                                                            PID:3680
                                                                            • C:\Windows\system32\netsh.exe
                                                                              netsh wlan show profiles
                                                                              5⤵
                                                                                PID:4036
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                              4⤵
                                                                                PID:4628
                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                  wmic os get Caption
                                                                                  5⤵
                                                                                    PID:3828
                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                  wmic cpu get Name
                                                                                  4⤵
                                                                                    PID:4436
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                    4⤵
                                                                                      PID:5032
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic path win32_VideoController get name
                                                                                        5⤵
                                                                                        • Detects videocard installed
                                                                                        PID:3468
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                      4⤵
                                                                                        PID:3436
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic computersystem get totalphysicalmemory
                                                                                          5⤵
                                                                                            PID:2328
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                          4⤵
                                                                                            PID:3536
                                                                                            • C:\Windows\System32\wbem\WMIC.exe
                                                                                              C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                              5⤵
                                                                                                PID:4516
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                          PID:4276
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:3208

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                            Filesize

                                                                                            152B

                                                                                            MD5

                                                                                            c9c4c494f8fba32d95ba2125f00586a3

                                                                                            SHA1

                                                                                            8a600205528aef7953144f1cf6f7a5115e3611de

                                                                                            SHA256

                                                                                            a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

                                                                                            SHA512

                                                                                            9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                            Filesize

                                                                                            152B

                                                                                            MD5

                                                                                            4dc6fc5e708279a3310fe55d9c44743d

                                                                                            SHA1

                                                                                            a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

                                                                                            SHA256

                                                                                            a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

                                                                                            SHA512

                                                                                            5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                                            Filesize

                                                                                            44KB

                                                                                            MD5

                                                                                            a4b04ba2b9a56f5911fee0c29629e53e

                                                                                            SHA1

                                                                                            939e8e65e22ae978a6b63dd1400fc6f58c5015eb

                                                                                            SHA256

                                                                                            523d8983d24e050e6e7e1f43d0caca6bd77bef38ec046d181b13bf32702fc025

                                                                                            SHA512

                                                                                            1c3357e9ecd3ac0de53d14f5d4c8d8d0aeafd30cb2e0dd6cfd1be68cca4fd4e178e79938a5ffe9a17b43e4f60f6e8e08c1054fa44160377fea740da70761c80f

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                            Filesize

                                                                                            24KB

                                                                                            MD5

                                                                                            e1831f8fadccd3ffa076214089522cea

                                                                                            SHA1

                                                                                            10acd26c218ff1bbbe6ac785eab5485045f61881

                                                                                            SHA256

                                                                                            9b9a4a9191b023df1aa66258eb19fc64ae5356cfc97a9dda258c6cc8ba1059ac

                                                                                            SHA512

                                                                                            372c486ac381358cc301f32cd89b7a05da7380c03fa524147c2ddf3f5e23f9b57c17485aaedc85b413461a879afc42e729547b0c96c26c49bbdb7301cd064298

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                                            Filesize

                                                                                            48KB

                                                                                            MD5

                                                                                            0c2234caae44ab13c90c9d322d937077

                                                                                            SHA1

                                                                                            94b497520fcfb38d9fc900cad88cd636e9476f87

                                                                                            SHA256

                                                                                            d8e6f62282e12c18c930a147325de25aef1633a034eaf7a3ce8de1fb8de09912

                                                                                            SHA512

                                                                                            66709f74b19499df1e06700e1c257e14a82ca4287194e4b177b3f333748d927f413c8c459a35e7e5a2f92d28410b0129f106d94e3dd85bc0dd0b986add83b18f

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                                                            Filesize

                                                                                            20KB

                                                                                            MD5

                                                                                            8b2813296f6e3577e9ac2eb518ac437e

                                                                                            SHA1

                                                                                            6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

                                                                                            SHA256

                                                                                            befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

                                                                                            SHA512

                                                                                            a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                                                            Filesize

                                                                                            21KB

                                                                                            MD5

                                                                                            addbac3228beeb9b91c6c82ceb5d0927

                                                                                            SHA1

                                                                                            56a4e1fbe3ebcd9ae8a3d9612716675f5a7792d1

                                                                                            SHA256

                                                                                            22911a92291696a97bd934b37bcb65619dee3548cdd887ab32599e13ccb736e1

                                                                                            SHA512

                                                                                            280c10dc7db1e162234e22e0c922db6939c8b8cb4b12407601baca8df5b762ec9b3866008abf57a3f8c8c0ef9ebc8a8d2e20e1f35187bf046657efcf92c32515

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                                                                            Filesize

                                                                                            21KB

                                                                                            MD5

                                                                                            279a08187fe6dd2fc9af819e4a104b4d

                                                                                            SHA1

                                                                                            9d3cd1b396cefa97cd2de96a327da6daa457950c

                                                                                            SHA256

                                                                                            ea3b8ac34dd2156a5c83cc7d282db609ac01c87e45d129839630580e7cfefddc

                                                                                            SHA512

                                                                                            9c19e345474f6535253fa4c6ff1a230069752b7c34141924a90c1c54975c26759851cd618d10af601c3b169593b935364fce8b0662d3282ef4520e23c3b0fe37

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                                                                            Filesize

                                                                                            24KB

                                                                                            MD5

                                                                                            7b9cb0b6c9837bf7d7529689f6b1af8b

                                                                                            SHA1

                                                                                            18fb7b11ce3f7ab9bc9b339c3bddd0adba256ac8

                                                                                            SHA256

                                                                                            40bcfc603a1d58a67b524342a9d2b2cb327c54e96dcbeaf1e25b490f7d9243b8

                                                                                            SHA512

                                                                                            2e03cb144295410dd3e0515db2203b2d4d7c44196c5776c98563fe9f32071a6c6319be03c3f98a508587778beb0a0de6d8adf95e8b3dca20e35e7beb71d7b2d5

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                                                                                            Filesize

                                                                                            21KB

                                                                                            MD5

                                                                                            9ccb3e387ecf1d1c32d33a33b61db8f3

                                                                                            SHA1

                                                                                            9d6625afcaa4d6bfe223268ccf82ff32ea9532a3

                                                                                            SHA256

                                                                                            3d34b64d0099f608de0e555d46338252a99d36f2a25af7180702c9966621fa0b

                                                                                            SHA512

                                                                                            05c3d41fd4115bd66c1a938ad644424f8df93f96ae27004c800e43acbc4b23568456574ceba605ea696fb594585811fedd0f9ec547a697344479e4d7516f65f4

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                                                                                            Filesize

                                                                                            76KB

                                                                                            MD5

                                                                                            af2a94a15cfc70b46dab2757201adbcf

                                                                                            SHA1

                                                                                            577ed407721aa8ed700d7efd91a9ae4abd88cda0

                                                                                            SHA256

                                                                                            2a36ee45320b297ec23e9f2fb1f35d224b08a3f767264241e30198359906a555

                                                                                            SHA512

                                                                                            0b33d31fa94738e6502ec94084aed66abe5d36e162d20391aeb5bb2b260c38ba30f9e5cc543a1dbea5c0789bde20d7601cca97d778b533cdb12fd3be35be8db7

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b88f65c875df9e5a_0

                                                                                            Filesize

                                                                                            19KB

                                                                                            MD5

                                                                                            cbbb38813005c9291772e1f786b0f20e

                                                                                            SHA1

                                                                                            9b7047ad18770ac4730411b07a12125bc301ee3f

                                                                                            SHA256

                                                                                            4deb843842ad7507b7bbdfaa14dc7e050b295e2de5c3747d95eb441329855a36

                                                                                            SHA512

                                                                                            227cf14d2ac9afb66cd2dfd9ebb08be0e1c90fadde617db1fd16c6655d2bac0acdf301507919d9a5a962c4cea4da9a741fa3bbc4cd8b606f290cd970d6c38e78

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bc9e1fd4409420f7_0

                                                                                            Filesize

                                                                                            8KB

                                                                                            MD5

                                                                                            4fbaffe5961140bb31c24ba523fdc8e9

                                                                                            SHA1

                                                                                            3e0f7c94a54f084afc023729b34aa2e16ac35249

                                                                                            SHA256

                                                                                            a8ea1b8b4c421cdb98b6547c8907d9717f07668eca16ce3fb64df75a33a854c6

                                                                                            SHA512

                                                                                            392f2d87a656f272a0853cd5a3fba3d5fd5f4ebab6781bd2905724c4e6c8175a8b43aedac24145bfdb414d39b3df9f6342af7075669306fa4233844a72c61ade

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ff1c2cdc18ed865a_0

                                                                                            Filesize

                                                                                            41KB

                                                                                            MD5

                                                                                            9451a3d56bd1cdf0146cf70f58992cab

                                                                                            SHA1

                                                                                            5164e609fb76b00a13c23c105bb692e455c4e106

                                                                                            SHA256

                                                                                            03d691f431bc45f6f54754a849b742d754b92b58f5543d82aff6e3cd82ec2b17

                                                                                            SHA512

                                                                                            b353dbf2fb609efd730980e164052a2f5890489bc2197c46ff2ad9ecf5fa9858f5fc10b1a6fd26a323bb96772b6c980eba0f0c3e76d3f121157d0140aa3e4c2a

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            075c6496df5fb2b0cc7d45491f03688b

                                                                                            SHA1

                                                                                            305d80ae2b9005b84265863b5adfade09b4e43b2

                                                                                            SHA256

                                                                                            c0d142e0ac9857bfef11f3c0b693ed01ed4d6fe894d3bc6cacdc2b2b92032bc3

                                                                                            SHA512

                                                                                            608564e2526b962b6965d61b25ca7520616fedc67439c6afdc4c3d5915a33de8f9f3b53082fd6fbc4127d137ca64edc30215d12c077bf15fa5dbb4dc46752069

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            5677af800460becd96057426a89f5b66

                                                                                            SHA1

                                                                                            126b9322c776f7eb6ed5fe76efac433ea2f3b714

                                                                                            SHA256

                                                                                            59c91fe9b5776c260264707762ea2538713f881bb0282adc6909de9b7bd5c6c7

                                                                                            SHA512

                                                                                            79cf0e67ecafe2bf6da501f0e168b2e02a14c906745c0575d42bb998fd7d12af4a2687f20b757f77cf455c972e417e88916433919806dfcf614eef114d41f4ea

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            6e62725b4b537d423c6fa18a46ef5413

                                                                                            SHA1

                                                                                            f9c627a520dc0c145dbfdf8c1609b7c292584bc7

                                                                                            SHA256

                                                                                            be486af06af5613a10289b9e012b0a0d794501884d0d0d9776f7b4105b225a94

                                                                                            SHA512

                                                                                            ad6c8e3237c0dd76bbc3ba51504a98ee66f09d3f1f3f04172aaa9b5943396e27c2e9a5b87e172a6a030d9a5ee65e2035142817dec8eab65f7d859928e327a245

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                            Filesize

                                                                                            579B

                                                                                            MD5

                                                                                            54ddf9c40f694dc13aca228f491dcccc

                                                                                            SHA1

                                                                                            c2f659bb11c49b8f320422f5257a8891c48ab49c

                                                                                            SHA256

                                                                                            e707692882b3f30dd67d549d740f6453d7accc4d429cf21dbb267babbdd4b44a

                                                                                            SHA512

                                                                                            a8e0ff5d5289e9d707617bab67f7901cf88abb9c8532d616b37eb8217743e557fc0138f79bc681537518320748a8572a7902fe23726d1f96045eedb79b04c3d1

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            902585a655e352e07f9ae0993f63696b

                                                                                            SHA1

                                                                                            327fd36be3bb0fbe3f98dd33470aa149cf7255f8

                                                                                            SHA256

                                                                                            ae72da2a74ee759800c34e83f61ce40c2d25795fdefd2cd2daf1c8889452cb5c

                                                                                            SHA512

                                                                                            50bf431a7dd384bff3ee37ec05787810408e53c4c0a011deb81891ab38366edbf9f6d9c602d84b9946de148aae187c56cf462ced8ed7ec328f058c3805421af0

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            6405639619a33a6cd62c9df1f424ac87

                                                                                            SHA1

                                                                                            6133be49a124ceadd1327702d473d37a2ccbee3b

                                                                                            SHA256

                                                                                            80ddf6f67b1ce3d3ed74df1b56233115dfcb72b95a843fd45f4c5649461c3f78

                                                                                            SHA512

                                                                                            03b76ae8119a06230caac7af4c7390ead83c25fcbe18df10537284359aa5d19503706db293523bf80cc4f894ab5d324e813c07de6244de7ce1592e98ca406058

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            b46fc7afad6d287a06317ff0f46fe869

                                                                                            SHA1

                                                                                            1e369cd5a2550604575c1c97bc1302050491e359

                                                                                            SHA256

                                                                                            c24d7cb8137033114234dffe1917d1db99e1df70e7daa9ebe19da6d880a1dc22

                                                                                            SHA512

                                                                                            edcf63a715823d654efd294b8d966efbb6f74a128c87435585b6a22ceeef3996ab9045befd2a710e25fa4f8ebc6a4db6a287ceb79c13366576d034ba076296d1

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            ce5ce37bbaa9fae570fefe2f5ef56f54

                                                                                            SHA1

                                                                                            44a24e390958dc3b973bf78e04c77ee06aa0545e

                                                                                            SHA256

                                                                                            1e3e420416305d2c7f1ee9c543fa2b2a7999efa306ebac81cc50668b32f12478

                                                                                            SHA512

                                                                                            d672a076ee2a0d6d1b67aee39aec5dec49cc913ccf0021a44432e4307c95d5b19b61693a61be0c1917bdd299015f2b39cfb94bf5e06b88c02e02db8bc1e4d60f

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            50b1a41411e0242cea78b91776873623

                                                                                            SHA1

                                                                                            5b9933ec1b61be5873aeee1a3d1830c9fbdec5c2

                                                                                            SHA256

                                                                                            9f0ca4e9a1737570d25665043ecd44fd3bdd7640ae7a58eeb886bee4d1ef0153

                                                                                            SHA512

                                                                                            579f492951874a2e601ae9adf850665a832a692cd736a7fff7847115e052eea6ca2bab6e9fe206fc0ea5b825087bd0aa2892adf76021d1d10effd061f033f3bf

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            aa1a468150de68a56762278c8e3173ea

                                                                                            SHA1

                                                                                            97233d109639cf139ea560496a0d852d9600b29a

                                                                                            SHA256

                                                                                            38e54e0335b1c060ea4cc8d3bddfa0ba4fb3c4cfd351bc1d611ffb50ed2fb041

                                                                                            SHA512

                                                                                            61d089737ca9d4f1955c30dbfdfdf488b77404cf2ff503a725fd9881226901ed62ee743f66ec88ee581bd886d4fb82a3f3186bd7e3f6064fcfbcea28d56e70fc

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            3e3f31ff4b4cba24f577ce3ba1abe99b

                                                                                            SHA1

                                                                                            999ffe653d81553ddc3e56c5818bc410af47ddb0

                                                                                            SHA256

                                                                                            b8deeadd0ddcee72c19a4b888f9e2889dfe106a31c2816c39b87956a257103dc

                                                                                            SHA512

                                                                                            1f84c6028f2f08101663d7e98dd46196fe3db0ac913c9520e1f20bbb67ab7e05a1895d5030415dfe9bfc6a1d33a28908d1e7b8231b0f1aeaa64e0fb0f31be242

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            63e6e053addc3e0971afbfe9331aa928

                                                                                            SHA1

                                                                                            a88d840fe9fdb470f3a39ecb24ca145c686452a9

                                                                                            SHA256

                                                                                            535808c5617d263fcabfde0c1c4c1ef6964bf47b423b5f07758d4ade0aa9e104

                                                                                            SHA512

                                                                                            bc956aad260b3203313ff8dbda15dd9307dcbdcae1f7086bf89d5ec8166b5b1fc8cca2bae2c8459a005c9b7fb14d2eb31a105ab36ff7b086b254c1dc0b549428

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            4c4425a29fea997e01c6ad8544bb1d5e

                                                                                            SHA1

                                                                                            f3161c0383f027ad269d80dfa59a8660537273a1

                                                                                            SHA256

                                                                                            536439823b1ea70e94a18b36b5b3f7d02a20a31edb5e0c5eff7e63d1b27e02fa

                                                                                            SHA512

                                                                                            1bf8f640541d3124c703559b6f45b560c793fecf7ad9796c4dd43422d594c5306173446013ab6284633221cd93849b3f4bf394a305d3f8ca74455ea29f6bd224

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            eac641483e4c91ab43d926f58b52775c

                                                                                            SHA1

                                                                                            40fc405f03e113885851347b925edc425f9ee9e3

                                                                                            SHA256

                                                                                            28662db8a2cb4451267882d25523524a3126816f6944e46e3ffef996d886ca71

                                                                                            SHA512

                                                                                            734f69a6f4a9ab9158af269d32613145751e70983de7861c6e60ab88714e2b99043fdc7ae09d01cc3584af135ff9a04135307a74e1d73cb9ee68d09964972fc4

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            fb55970cb43fe3dcaec63b9f1b05056a

                                                                                            SHA1

                                                                                            ea77b397ca656883b228950c7fe58f83ce504ae2

                                                                                            SHA256

                                                                                            0d99a19b213459e3c438403e7aea1c2c381ccfff9faba07a3bb7963dbfe90ef4

                                                                                            SHA512

                                                                                            8ea9a93bae52625fd0da58aacf2c4a120ada69cb1824ee853aabcc8b9650157ca0d495f28e5924ec121ced75e91cb1872e7639b3270c2f3d37970169765b6f0d

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            880a63e167d2e868337e21d4c4faa3d7

                                                                                            SHA1

                                                                                            576621fe68dbfd1a6f62c31697bdfbcdd644078f

                                                                                            SHA256

                                                                                            3d4f2905c46de0c895ecc18e03629d7928e880324427c84d8f7e0760c234deee

                                                                                            SHA512

                                                                                            1a8eaa5e62b2fbc232458ab58da943dae53c4a4d1915e77e6548f6a4cdbbcbfea99effe7026ffd7bf75024e16749fbe0221ea1d022e17a46f06f493d251481a5

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            2a9c76c40635fd102d15fbd05cb7c8ed

                                                                                            SHA1

                                                                                            0a6056a5224fa06986f8d06a9e0269306ae83a78

                                                                                            SHA256

                                                                                            046c0ebe4690ce3f57e25250fc1d8c88b718543c5a1f38ffc2a9e57b1756e002

                                                                                            SHA512

                                                                                            535a9fd9f9dd31f63818a9238cfa73c6c01e9a6b44493cfc11f6c4fe257da5e846abdd58a03037775342529b06b4ff9e78a46e3402de1f229db17307a07ab7ba

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ac5d.TMP

                                                                                            Filesize

                                                                                            874B

                                                                                            MD5

                                                                                            d59490342687c13955dc853c6383f487

                                                                                            SHA1

                                                                                            208e10ddf8ee9ce4af3d2b48679177ac3e8909c7

                                                                                            SHA256

                                                                                            a356f6777a11d4cbc8aec8c16909a9152c5d6dddea9218d09bc73d795b63c6c8

                                                                                            SHA512

                                                                                            51f2205922666b44b9218c5de05b1a4378da44e6002081b92f3675740cf78e6062a165810c678d03b456ac4dce6bb76a1dd539792150cc6f2d3d6f58a320cf1f

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                            Filesize

                                                                                            16B

                                                                                            MD5

                                                                                            206702161f94c5cd39fadd03f4014d98

                                                                                            SHA1

                                                                                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                            SHA256

                                                                                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                            SHA512

                                                                                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                            Filesize

                                                                                            16B

                                                                                            MD5

                                                                                            46295cac801e5d4857d09837238a6394

                                                                                            SHA1

                                                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                            SHA256

                                                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                            SHA512

                                                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                            Filesize

                                                                                            11KB

                                                                                            MD5

                                                                                            2186142f1091acd34d13bd57296193fb

                                                                                            SHA1

                                                                                            4bc3370d682b3c04936b3b9c09eb4298323e3ebb

                                                                                            SHA256

                                                                                            c38801dd9b8398aa7018c7d58a29c8bc9d4e76b29a3933cd05be27549f6c9923

                                                                                            SHA512

                                                                                            7e20bd07c61179637cd62ea0a56907311734d4e78c939c51d00b97a80de6ccb6b74594f6325bf2e41d18b1a2ebe641f0fcd073ad4eac81c375c0c8544f0fa8f4

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                            Filesize

                                                                                            12KB

                                                                                            MD5

                                                                                            404c24b0c52943375ae936acf24bfb29

                                                                                            SHA1

                                                                                            2525c4da1feb37f33e5609c9119b51b53cbe5192

                                                                                            SHA256

                                                                                            b8d306d599ea909dc229550275be66f8976793e8493210b932e4786d57223f7c

                                                                                            SHA512

                                                                                            a776a77ffd34ae023b8658cc9c39aa3cbbef45b38aaf4ca333c03a6e6792f4c44403a167ebf269ef2a26b10423b12c3f280ff5b6f8d36ac503d9c08450d15aef

                                                                                          • C:\Users\Admin\AppData\Local\Temp\PCouNg0Kio\Browser\cc's.txt

                                                                                            Filesize

                                                                                            91B

                                                                                            MD5

                                                                                            5aa796b6950a92a226cc5c98ed1c47e8

                                                                                            SHA1

                                                                                            6706a4082fc2c141272122f1ca424a446506c44d

                                                                                            SHA256

                                                                                            c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c

                                                                                            SHA512

                                                                                            976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad

                                                                                          • C:\Users\Admin\AppData\Local\Temp\PCouNg0Kio\Browser\history.txt

                                                                                            Filesize

                                                                                            663B

                                                                                            MD5

                                                                                            6f11ccb8c0e0954b157e5d8f1d4e4915

                                                                                            SHA1

                                                                                            4dd2e5586088644406b3de7c66019fda6369d4fe

                                                                                            SHA256

                                                                                            842c6a9071696637c98ab6083d6a4da371bc44a5c3a12a0084028d92a1bd1c87

                                                                                            SHA512

                                                                                            43fcd71cb7c5acc0fab53831f3f9979a1be9228aea671184e6fca5f13f4b2c5a8ee0bfd27062330be7243913ea2b53df2d7231e465b7f96776dcbced94a40465

                                                                                          • C:\Users\Admin\AppData\Local\Temp\PCouNg0Kio\Browser\roblox cookies.txt

                                                                                            Filesize

                                                                                            23B

                                                                                            MD5

                                                                                            de9ec9fc7c87635cb91e05c792e94140

                                                                                            SHA1

                                                                                            3f0fbeaff23a30040e5f52b78b474e7cb23488ab

                                                                                            SHA256

                                                                                            aac2a87a65cbbe472000734bd6db5c76f0ffed78e80928f575d5573f3ac94d0f

                                                                                            SHA512

                                                                                            a18ff0f277d880cf249fe7ef20fa026fd8126121fbb6f1de33d3d4a08d37084c662724053c6e8e2035aa7c347000e14a9c12698017ac72b327db6473d6e4af56

                                                                                          • C:\Users\Admin\AppData\Local\Temp\Pi5ka6yvPQ\Browser\cookies.txt

                                                                                            Filesize

                                                                                            49B

                                                                                            MD5

                                                                                            357c18b5c470aa5214819ed2e11882f9

                                                                                            SHA1

                                                                                            262726528ac6ece5ef69b48cbf69e9d3c79bbc2d

                                                                                            SHA256

                                                                                            e04233c3a65810f382471c2c1484cc71df6f2078d56bd91f478ed99790ac11f5

                                                                                            SHA512

                                                                                            a84eaa0f8466ef145e765b3c340120a7947aad6ded63c301be5a5c4dea15f603ae0a295c8d7d9828a8f660edfa058edf96abc6950eebbbafe3af402a4b37d683

                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19282\VCRUNTIME140.dll

                                                                                            Filesize

                                                                                            116KB

                                                                                            MD5

                                                                                            be8dbe2dc77ebe7f88f910c61aec691a

                                                                                            SHA1

                                                                                            a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                                                            SHA256

                                                                                            4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                                                            SHA512

                                                                                            0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19282\libffi-8.dll

                                                                                            Filesize

                                                                                            38KB

                                                                                            MD5

                                                                                            0f8e4992ca92baaf54cc0b43aaccce21

                                                                                            SHA1

                                                                                            c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

                                                                                            SHA256

                                                                                            eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

                                                                                            SHA512

                                                                                            6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19282\python3.dll

                                                                                            Filesize

                                                                                            65KB

                                                                                            MD5

                                                                                            7e07c63636a01df77cd31cfca9a5c745

                                                                                            SHA1

                                                                                            593765bc1729fdca66dd45bbb6ea9fcd882f42a6

                                                                                            SHA256

                                                                                            db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6

                                                                                            SHA512

                                                                                            8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729

                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19282\wheel-0.43.0.dist-info\INSTALLER

                                                                                            Filesize

                                                                                            4B

                                                                                            MD5

                                                                                            365c9bfeb7d89244f2ce01c1de44cb85

                                                                                            SHA1

                                                                                            d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                            SHA256

                                                                                            ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                            SHA512

                                                                                            d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI60082\_bz2.pyd

                                                                                            Filesize

                                                                                            82KB

                                                                                            MD5

                                                                                            aa1083bde6d21cabfc630a18f51b1926

                                                                                            SHA1

                                                                                            e40e61dba19301817a48fd66ceeaade79a934389

                                                                                            SHA256

                                                                                            00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3

                                                                                            SHA512

                                                                                            2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c

                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI60082\_ctypes.pyd

                                                                                            Filesize

                                                                                            121KB

                                                                                            MD5

                                                                                            565d011ce1cee4d48e722c7421300090

                                                                                            SHA1

                                                                                            9dc300e04e5e0075de4c0205be2e8aae2064ae19

                                                                                            SHA256

                                                                                            c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7

                                                                                            SHA512

                                                                                            5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5

                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI60082\_lzma.pyd

                                                                                            Filesize

                                                                                            155KB

                                                                                            MD5

                                                                                            b86b9f292af12006187ebe6c606a377d

                                                                                            SHA1

                                                                                            604224e12514c21ab6db4c285365b0996c7f2139

                                                                                            SHA256

                                                                                            f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5

                                                                                            SHA512

                                                                                            d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312

                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI60082\base_library.zip

                                                                                            Filesize

                                                                                            1.4MB

                                                                                            MD5

                                                                                            0cbf40b73eb279c2ea5b3d1c9c626cf4

                                                                                            SHA1

                                                                                            d142a7046b8871ca83dfde051c67bd1c836d0bbe

                                                                                            SHA256

                                                                                            f5908f37a3e301cfac1d435a9ea728097717f204155c881536b17e4e5c83e5b7

                                                                                            SHA512

                                                                                            96765b3b9303c96a2b1d9ad0ca099ecd5c86024f7a2f1f0f1715202427c1350ed851b6954603e1d52af87e4244051237666bc6b112786c0334b8da008b81b49d

                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI60082\libcrypto-3.dll

                                                                                            Filesize

                                                                                            5.0MB

                                                                                            MD5

                                                                                            e547cf6d296a88f5b1c352c116df7c0c

                                                                                            SHA1

                                                                                            cafa14e0367f7c13ad140fd556f10f320a039783

                                                                                            SHA256

                                                                                            05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

                                                                                            SHA512

                                                                                            9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI60082\python311.dll

                                                                                            Filesize

                                                                                            5.5MB

                                                                                            MD5

                                                                                            387bb2c1e40bde1517f06b46313766be

                                                                                            SHA1

                                                                                            601f83ef61c7699652dec17edd5a45d6c20786c4

                                                                                            SHA256

                                                                                            0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364

                                                                                            SHA512

                                                                                            521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad

                                                                                          • C:\Users\Admin\AppData\Local\Temp\login.db

                                                                                            Filesize

                                                                                            46KB

                                                                                            MD5

                                                                                            8f5942354d3809f865f9767eddf51314

                                                                                            SHA1

                                                                                            20be11c0d42fc0cef53931ea9152b55082d1a11e

                                                                                            SHA256

                                                                                            776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

                                                                                            SHA512

                                                                                            fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

                                                                                          • C:\Users\Admin\Downloads\Unconfirmed 474144.crdownload

                                                                                            Filesize

                                                                                            22.0MB

                                                                                            MD5

                                                                                            6681c920d7aee94427fe968890e045ea

                                                                                            SHA1

                                                                                            659c6b06b328851d215c8e71719ae42bebbda201

                                                                                            SHA256

                                                                                            d313fc05d718536093f57ed6579ef860e656f57cde812af50b22653435c3a31e

                                                                                            SHA512

                                                                                            538b0bf50b26ec0b5a1c09b7f6068c4d59101d1bf6f338918f87cb16121b2f460775b30275f834f1d6e6726c4a05eaa8b19ce54ccec669d70de67abc5a7ccfe4

                                                                                          • C:\Users\Admin\Downloads\Unconfirmed 922051.crdownload

                                                                                            Filesize

                                                                                            41KB

                                                                                            MD5

                                                                                            83fc7bd48a7593fa2964cf3950a774a1

                                                                                            SHA1

                                                                                            4ace64228ae9cded13158373b03509276913b835

                                                                                            SHA256

                                                                                            bd37a2729ddadba13ec0e18c2f252164e276775ccf357a18e1cc38298ff6f3b7

                                                                                            SHA512

                                                                                            f2c2bf52f74c8fb9cf0ed3d0ce3b88fa0ee44da5946b0df8ed4b41119a538d9f3c85bf77458632c3b72d6e2d178d394fe05e3e5656b7d99ccb19417d7d8aa071

                                                                                          • C:\Users\Admin\tmp\FvKS8f93OkkNB2tMA0hL

                                                                                            Filesize

                                                                                            20KB

                                                                                            MD5

                                                                                            42c395b8db48b6ce3d34c301d1eba9d5

                                                                                            SHA1

                                                                                            b7cfa3de344814bec105391663c0df4a74310996

                                                                                            SHA256

                                                                                            5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

                                                                                            SHA512

                                                                                            7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

                                                                                          • memory/1624-268-0x00000000000E0000-0x00000000000F0000-memory.dmp

                                                                                            Filesize

                                                                                            64KB