hxxps://file[.]io/Eqdo2StAx4sJ

Analysis

max time kernel
137s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://file.io/Eqdo2StAx4sJ

Score

9^/10

evasion pyinstaller spyware stealer upx

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5152	netsh.exe
6408	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Security.exe	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Security.exe	nigga.exe

Executes dropped EXE 2 IoCs

pid	Process
6168	nigga.exe
2320	nigga.exe

Loads dropped DLL 36 IoCs

pid	Process
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002355c-619.dat	upx
behavioral1/memory/2320-623-0x00007FFB4F450000-0x00007FFB4FA38000-memory.dmp	upx
behavioral1/files/0x0007000000023518-625.dat	upx
behavioral1/files/0x0007000000023540-631.dat	upx
behavioral1/memory/2320-633-0x00007FFB6D7E0000-0x00007FFB6D7EF000-memory.dmp	upx
behavioral1/memory/2320-632-0x00007FFB63790000-0x00007FFB637B4000-memory.dmp	upx
behavioral1/files/0x0007000000023516-635.dat	upx
behavioral1/files/0x000700000002351b-636.dat	upx
behavioral1/memory/2320-638-0x00007FFB63690000-0x00007FFB636A9000-memory.dmp	upx
behavioral1/memory/2320-639-0x00007FFB4F420000-0x00007FFB4F44D000-memory.dmp	upx
behavioral1/files/0x000700000002353f-640.dat	upx
behavioral1/memory/2320-641-0x00007FFB63E70000-0x00007FFB63EA5000-memory.dmp	upx
behavioral1/memory/2320-643-0x00007FFB6D780000-0x00007FFB6D78D000-memory.dmp	upx
behavioral1/memory/2320-642-0x00007FFB63E50000-0x00007FFB63E69000-memory.dmp	upx
behavioral1/memory/2320-645-0x00007FFB63CF0000-0x00007FFB63D1E000-memory.dmp	upx
behavioral1/memory/2320-644-0x00007FFB6A200000-0x00007FFB6A20D000-memory.dmp	upx
behavioral1/memory/2320-646-0x00007FFB636B0000-0x00007FFB6376C000-memory.dmp	upx
behavioral1/memory/2320-647-0x00007FFB63B90000-0x00007FFB63BBB000-memory.dmp	upx
behavioral1/memory/2320-648-0x00007FFB63A20000-0x00007FFB63A4E000-memory.dmp	upx
behavioral1/memory/2320-650-0x00007FFB4F450000-0x00007FFB4FA38000-memory.dmp	upx
behavioral1/memory/2320-651-0x00007FFB52A30000-0x00007FFB52DA5000-memory.dmp	upx
behavioral1/memory/2320-649-0x00007FFB52FB0000-0x00007FFB53068000-memory.dmp	upx
behavioral1/memory/2320-653-0x00007FFB62E70000-0x00007FFB62E82000-memory.dmp	upx
behavioral1/memory/2320-652-0x00007FFB63E30000-0x00007FFB63E45000-memory.dmp	upx
behavioral1/memory/2320-657-0x00007FFB63E50000-0x00007FFB63E69000-memory.dmp	upx
behavioral1/memory/2320-656-0x00007FFB528B0000-0x00007FFB52A23000-memory.dmp	upx
behavioral1/memory/2320-655-0x00007FFB5EE90000-0x00007FFB5EEB3000-memory.dmp	upx
behavioral1/memory/2320-654-0x00007FFB5F860000-0x00007FFB5F878000-memory.dmp	upx
behavioral1/memory/2320-658-0x00007FFB4ED20000-0x00007FFB4F414000-memory.dmp	upx
behavioral1/memory/2320-659-0x00007FFB6D780000-0x00007FFB6D78D000-memory.dmp	upx
behavioral1/memory/2320-660-0x00007FFB52870000-0x00007FFB528A8000-memory.dmp	upx
behavioral1/memory/2320-662-0x00007FFB5EE70000-0x00007FFB5EE84000-memory.dmp	upx
behavioral1/memory/2320-661-0x00007FFB5F840000-0x00007FFB5F854000-memory.dmp	upx
behavioral1/memory/2320-663-0x00007FFB636B0000-0x00007FFB6376C000-memory.dmp	upx
behavioral1/memory/2320-664-0x00007FFB4EC00000-0x00007FFB4ED1C000-memory.dmp	upx
behavioral1/memory/2320-674-0x00007FFB52840000-0x00007FFB52862000-memory.dmp	upx
behavioral1/memory/2320-677-0x00007FFB4EB30000-0x00007FFB4EBFF000-memory.dmp	upx
behavioral1/memory/2320-676-0x00007FFB52FB0000-0x00007FFB53068000-memory.dmp	upx
behavioral1/memory/2320-675-0x00007FFB63A20000-0x00007FFB63A4E000-memory.dmp	upx
behavioral1/memory/2320-679-0x00007FFB66900000-0x00007FFB6690A000-memory.dmp	upx
behavioral1/memory/2320-678-0x00007FFB52A30000-0x00007FFB52DA5000-memory.dmp	upx
behavioral1/memory/2320-680-0x00007FFB63E30000-0x00007FFB63E45000-memory.dmp	upx
behavioral1/memory/2320-682-0x00007FFB52810000-0x00007FFB52836000-memory.dmp	upx
behavioral1/memory/2320-681-0x00007FFB63B60000-0x00007FFB63B6B000-memory.dmp	upx
behavioral1/memory/2320-683-0x00007FFB5EE90000-0x00007FFB5EEB3000-memory.dmp	upx
behavioral1/memory/2320-685-0x00007FFB4E8E0000-0x00007FFB4EB25000-memory.dmp	upx
behavioral1/memory/2320-684-0x00007FFB528B0000-0x00007FFB52A23000-memory.dmp	upx
behavioral1/memory/2320-698-0x00007FFB4ED20000-0x00007FFB4F414000-memory.dmp	upx
behavioral1/memory/2320-700-0x00007FFB638A0000-0x00007FFB638AF000-memory.dmp	upx
behavioral1/memory/2320-738-0x00007FFB52870000-0x00007FFB528A8000-memory.dmp	upx
behavioral1/memory/2320-811-0x00007FFB63E30000-0x00007FFB63E45000-memory.dmp	upx
behavioral1/memory/2320-822-0x00007FFB4EB30000-0x00007FFB4EBFF000-memory.dmp	upx
behavioral1/memory/2320-821-0x00007FFB52840000-0x00007FFB52862000-memory.dmp	upx
behavioral1/memory/2320-820-0x00007FFB4EC00000-0x00007FFB4ED1C000-memory.dmp	upx
behavioral1/memory/2320-817-0x00007FFB52870000-0x00007FFB528A8000-memory.dmp	upx
behavioral1/memory/2320-815-0x00007FFB528B0000-0x00007FFB52A23000-memory.dmp	upx
behavioral1/memory/2320-812-0x00007FFB62E70000-0x00007FFB62E82000-memory.dmp	upx
behavioral1/memory/2320-810-0x00007FFB52FB0000-0x00007FFB53068000-memory.dmp	upx
behavioral1/memory/2320-809-0x00007FFB52A30000-0x00007FFB52DA5000-memory.dmp	upx
behavioral1/memory/2320-796-0x00007FFB4F450000-0x00007FFB4FA38000-memory.dmp	upx
behavioral1/memory/2320-808-0x00007FFB63A20000-0x00007FFB63A4E000-memory.dmp	upx
behavioral1/memory/2320-804-0x00007FFB6A200000-0x00007FFB6A20D000-memory.dmp	upx
behavioral1/memory/2320-802-0x00007FFB63E50000-0x00007FFB63E69000-memory.dmp	upx
behavioral1/memory/2320-797-0x00007FFB63790000-0x00007FFB637B4000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
665	discord.com
674	discord.com
675	discord.com
673	discord.com
678	discord.com
694	discord.com
695	discord.com
700	discord.com
657	discord.com
658	discord.com
662	discord.com
679	discord.com
664	discord.com
677	discord.com
699	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
667	ip-api.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6696	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000700000002349f-385.dat	pyinstaller

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
6912	WMIC.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
6964	tasklist.exe
5336	tasklist.exe
6012	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5352	ipconfig.exe
6724	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5192	systeminfo.exe

Kills process with taskkill 26 IoCs

evasion

pid	Process
6040	taskkill.exe
6512	taskkill.exe
2448	taskkill.exe
3832	taskkill.exe
6352	taskkill.exe
6180	taskkill.exe
3596	taskkill.exe
1484	taskkill.exe
6856	taskkill.exe
5812	taskkill.exe
4372	taskkill.exe
4480	taskkill.exe
6356	taskkill.exe
2104	taskkill.exe
5660	taskkill.exe
2888	taskkill.exe
6844	taskkill.exe
6236	taskkill.exe
6376	taskkill.exe
1424	taskkill.exe
976	taskkill.exe
716	taskkill.exe
4524	taskkill.exe
2900	taskkill.exe
400	taskkill.exe
6888	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 565747.crdownload:SmartScreen	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
4520	msedge.exe
4520	msedge.exe
1032	identity_helper.exe
1032	identity_helper.exe
6832	msedge.exe
6832	msedge.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
2320	nigga.exe
4408	powershell.exe
4408	powershell.exe
4408	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	nigga.exe
Token: SeDebugPrivilege	6964	tasklist.exe
Token: SeDebugPrivilege	716	taskkill.exe
Token: SeDebugPrivilege	6352	taskkill.exe
Token: SeDebugPrivilege	6376	taskkill.exe
Token: SeDebugPrivilege	6040	taskkill.exe
Token: SeDebugPrivilege	4524	taskkill.exe
Token: SeDebugPrivilege	6512	taskkill.exe
Token: SeDebugPrivilege	3596	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	6844	taskkill.exe
Token: SeDebugPrivilege	1424	taskkill.exe
Token: SeDebugPrivilege	6856	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	6236	taskkill.exe
Token: SeDebugPrivilege	5812	taskkill.exe
Token: SeDebugPrivilege	976	taskkill.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	400	taskkill.exe
Token: SeDebugPrivilege	4372	taskkill.exe
Token: SeDebugPrivilege	2448	taskkill.exe
Token: SeDebugPrivilege	6180	taskkill.exe
Token: SeDebugPrivilege	6888	taskkill.exe
Token: SeDebugPrivilege	4480	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	6356	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	5660	taskkill.exe
Token: SeDebugPrivilege	5336	tasklist.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeIncreaseQuotaPrivilege	6912	WMIC.exe
Token: SeSecurityPrivilege	6912	WMIC.exe
Token: SeTakeOwnershipPrivilege	6912	WMIC.exe
Token: SeLoadDriverPrivilege	6912	WMIC.exe
Token: SeSystemProfilePrivilege	6912	WMIC.exe
Token: SeSystemtimePrivilege	6912	WMIC.exe
Token: SeProfSingleProcessPrivilege	6912	WMIC.exe
Token: SeIncBasePriorityPrivilege	6912	WMIC.exe
Token: SeCreatePagefilePrivilege	6912	WMIC.exe
Token: SeBackupPrivilege	6912	WMIC.exe
Token: SeRestorePrivilege	6912	WMIC.exe
Token: SeShutdownPrivilege	6912	WMIC.exe
Token: SeDebugPrivilege	6912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6912	WMIC.exe
Token: SeRemoteShutdownPrivilege	6912	WMIC.exe
Token: SeUndockPrivilege	6912	WMIC.exe
Token: SeManageVolumePrivilege	6912	WMIC.exe
Token: 33	6912	WMIC.exe
Token: 34	6912	WMIC.exe
Token: 35	6912	WMIC.exe
Token: 36	6912	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6912	WMIC.exe
Token: SeSecurityPrivilege	6912	WMIC.exe
Token: SeTakeOwnershipPrivilege	6912	WMIC.exe
Token: SeLoadDriverPrivilege	6912	WMIC.exe
Token: SeSystemProfilePrivilege	6912	WMIC.exe
Token: SeSystemtimePrivilege	6912	WMIC.exe
Token: SeProfSingleProcessPrivilege	6912	WMIC.exe
Token: SeIncBasePriorityPrivilege	6912	WMIC.exe
Token: SeCreatePagefilePrivilege	6912	WMIC.exe
Token: SeBackupPrivilege	6912	WMIC.exe
Token: SeRestorePrivilege	6912	WMIC.exe
Token: SeShutdownPrivilege	6912	WMIC.exe
Token: SeDebugPrivilege	6912	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 5076	4520	msedge.exe	83
PID 4520 wrote to memory of 5076	4520	msedge.exe	83
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 1712	4520	msedge.exe	84
PID 4520 wrote to memory of 3696	4520	msedge.exe	85
PID 4520 wrote to memory of 3696	4520	msedge.exe	85
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86
PID 4520 wrote to memory of 1868	4520	msedge.exe	86

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6248	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://file.io/Eqdo2StAx4sJ
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb633a46f8,0x7ffb633a4708,0x7ffb633a4718
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7740 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7584 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8248 /prefetch:1
  2⤵
  PID:6260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8348 /prefetch:1
  2⤵
  PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8648 /prefetch:1
  2⤵
  PID:6280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8676 /prefetch:1
  2⤵
  PID:6288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8840 /prefetch:1
  2⤵
  PID:6296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9052 /prefetch:1
  2⤵
  PID:6304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9100 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:6544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8408 /prefetch:1
  2⤵
  PID:6580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9672 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10488 /prefetch:1
  2⤵
  PID:7088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10668 /prefetch:8
  2⤵
  PID:6196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8212 /prefetch:1
  2⤵
  PID:7032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9456 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10296 /prefetch:1
  2⤵
  PID:6524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10764 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11072 /prefetch:1
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,10438428920027431945,11765564227384515027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e4 0x4e8
1⤵
PID:5756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3256

C:\Users\Admin\Downloads\nigga.exe
"C:\Users\Admin\Downloads\nigga.exe"
1⤵
- Executes dropped EXE
PID:6168
- C:\Users\Admin\Downloads\nigga.exe
  "C:\Users\Admin\Downloads\nigga.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Security.exe""
    3⤵
    PID:6240
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Security.exe"
      4⤵
      Drops startup file
      Views/modifies file attributes
      PID:6248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4664
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4520"
    3⤵
    PID:2480
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4520
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5076"
    3⤵
    PID:436
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5076
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1712"
    3⤵
    PID:5612
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1712
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3696"
    3⤵
    PID:7104
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3696
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1868"
    3⤵
    PID:6412
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1868
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1880"
    3⤵
    PID:6576
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1880
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4972"
    3⤵
    PID:1856
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4972
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3580"
    3⤵
    PID:5448
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3580
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5192"
    3⤵
    PID:3224
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5192
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5280"
    3⤵
    PID:6868
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5280
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5288"
    3⤵
    PID:6812
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5288
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5656"
    3⤵
    PID:1956
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5656
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5864"
    3⤵
    PID:2248
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5864
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5980"
    3⤵
    PID:5552
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5980
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5996"
    3⤵
    PID:5576
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5996
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6004"
    3⤵
    PID:5556
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6004
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6012"
    3⤵
    PID:6840
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6012
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5400"
    3⤵
    PID:4100
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5400
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5512"
    3⤵
    PID:5444
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5512
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6260"
    3⤵
    PID:2244
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6260
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6280"
    3⤵
    PID:5644
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6280
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6588"
    3⤵
    PID:6020
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6588
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7032"
    3⤵
    PID:5696
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 7032
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6020"
    3⤵
    PID:5540
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6020
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6156"
    3⤵
    PID:3064
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6156
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6192"
    3⤵
    PID:5100
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6192
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:2824
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:6380
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:3744
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:2944
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3512
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    PID:2004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    PID:5708
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5192
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:6948
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      Suspicious use of AdjustPrivilegeToken
      PID:6912
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:6640
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:6660
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:6628
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:6116
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:6140
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:2336
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:6052
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:6056
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:6072
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:6088
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:3020
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:5436
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:5128
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:6012
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:5352
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:5356
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      PID:6720
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      Gathers network information
      PID:6724
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:6696
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      PID:5152
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      PID:6408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    PID:3080
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:6436
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:6744
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
546KB

MD5
64063f773ea8b996c2426f9f45391096

SHA1
b055c998e68ea937bf8618e8cba7c305095ca102

SHA256
a3726db021b143ed0ba751b1ba796828aa58bfdf17eae69a3d4ba55449de7ca0

SHA512
439eca42806de7a5b142c9bf583d1e7005398e3f1b32b6f6757e8e589396a3a41482bc546e3bba11f6679216c729f5e57ccc40f7658506593acdc0974533d77a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
250KB

MD5
29b1adf527657e404731bcb7271b79f8

SHA1
50aae42abf35013822edd2004b109c1dca12e96b

SHA256
4fbab2df29d82f1d5d1ab88a4cd42dfbfd777934ed5b177324542239df37bcc8

SHA512
17d123f7b9e62a158ab2589750da30e0d8290f910052d0d464a7f5a40d4e5011c8c33ee4804000fbc52f1c4e27b8d04cf7fd1bf13a9a9b07ac2376fad1e6ed56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
1024KB

MD5
099d8e1f3f8203715803f284eebd02a6

SHA1
0275efc65797bcdbe502594f2938e215a7bfe80b

SHA256
1bfdab24a0f2ad3a40a43db5afc6ce4f97e4a4092d35768300399ab99fa07730

SHA512
bc57372f13e4f1aa456b0a77621790bfaebe35665e44bfbe5ee1fc22707ebc98c34fa0fd7679cbc793b520160dbd4c387523f645bda5e6a90edbdbc20e61c7b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9fcd7fefc6887c528f145ba8692830f4

SHA1
368bc869e9f95e69e328e0a81b749e2dc8b20787

SHA256
f1b0ce26a3e7da958ed4da2412fc527b4adca785b973d0b6a7b12c13a62ac38c

SHA512
d4863eb63855842649659062f5d214c8f7066d90fa87f4a935f57b673fc2d1839adfe3ac302b334ab26f7f87699fc22a2fc891613d4be5d4cb70bcf061763e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
4c67def95d075e57c88a6e5722ccbba7

SHA1
3f4ff167d1e2f413909b4bb74481b9b1c31542dd

SHA256
fa3d6ac02638995634b8e68c0e5e7eda6093ea8b7b8d0d1bd7aa099ec74d3fc4

SHA512
d4905c64e0b7b1231f05987dbd05ef6d2e3ffd5240729eec62ad03aacd2cef9b9bc5145320fb384653d0c48e9fbaeaad4562f2c449513925ba7cd2f6933bb09a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c4fbd610770178973ac51ab4307a49e

SHA1
7e881c6df242b2f8cb5500b9aee98029f231b1ff

SHA256
190904a430fca9c39910868ca47d676f7b1b307c5c1d20437f5ea6ad4d7f9650

SHA512
cc5d0ce23a7255537c544fb0bbc00d2ba74ea15340eb2d21b3dcc0a6e5b32f6723f6f537c6389195b84b850983dad733d50d3d1c2994ac3619bf4e6b8d09bd39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
92cfba8e0158af1ad1cd759b396ae206

SHA1
0d2c5d12688f119848e1a5f7bfe9dddb67dd3f21

SHA256
2258706caee0b864044709436a0e52538982518f10197b4b0fb69d91ecf01ee1

SHA512
1632ae00d7b641e26f8f80390d4044bfb04f56d6820f36878c54125562191cc41810cbb0d0c4dedbf96be4912c4bcace5ea1f89ac350c7f87a558d463013393d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
d65101549348490cb60ab1e122b6c54b

SHA1
59c7afefc221a56edfff478419aaf27a6362d58b

SHA256
232ba76b3049f2126f5b89cc004a02eba728728251adf6485131388d7a6cd788

SHA512
c72a7fec0bc4c14b73c49cb5b0af854f93ca0e7d0502eaf806007d6c998cc7a19415fe9fe3243bd2f5f940bb7ff8b6b0607038d08919c8f76c1c832dc240833d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
12a8b80cfddce47d62cb1facef33c762

SHA1
05192b4eb9cb52e8cd6c9b79d68e0c4ea7494a9d

SHA256
514ab9d9c6c493cfe42c8d9c918b682c89a9a29e9a88ec67cc8e3a7113d6e489

SHA512
e7ede3b4cdcb0496d83a27e16d6f21e6a795fb043f28f8c9a500003752a0eb5f4210d44acb541c528f8a95c41e0560713961e1e44b131a59bde85a63dacd7ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
dffbf8a81973505862ebcf48ab6339b7

SHA1
47c50d7c2d6f0fb7d85043afcdfd4f47f9e61198

SHA256
9f6ff4aa5d16c73709b6a1a139d563a94ae1e76cb0764819ee2d619e2c2744c0

SHA512
22499625345b2366012ff06927d670d1b531c8d4fa64861eeece5001ced73e153586855f8cc710d4ab8b499bc6a6fe451a7a08753e285aa6347f7f19508e96d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
fc32f1ab99f2ec0b546483ff889b5679

SHA1
d7cf5094fb751b46220eae96ebcd29dba45a7c3c

SHA256
46212d731fcce2880ff878bc45f1a6d37a6f510eba8f01ba0d2bb6cfcb27734d

SHA512
fc6b9fb6529f79404853fdcc4754e20fb505c88352637e496cf082a0195c5c422e49a2ec9efad2e2f6b85c7a3378ed4cf5cb6e256950a38ad5d56acbf6f0bf4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578405.TMP

Filesize
1KB

MD5
96608d9faae2a69e609983f38abc054c

SHA1
18167bf2fc3470a8f882703395ba2018487ba2b0

SHA256
933c1ea22e734d31050781187a79e3d2d082335168fe0b12a253843c1cffa932

SHA512
c09acb6f7651ddf08b49212f28db4f9e1198d3629b6f545b3d63e07be2db6652454e33f69a60d672601c23c5102157fcb3867a6da4bdfa882084c0b1182df765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2a75b61a97b9d3e70b989134a98d4898

SHA1
c1ce9ac4b92ddd5ee181309c343a7f36cc764dda

SHA256
71a368598e2922dc1d03c675363d8e04d3667a49eb1fde605a51bcd8b9c27c29

SHA512
2c8a231f4b1f1caa39a9f60a27919c286389ebbbee9450347d2ac9819356503be4c7221f36befc0f26759bc005e1467c712a3f7acc599faac02122231a46135a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
013b70e786c455e3d43786b24fcdb156

SHA1
ebccd2ea2d3c70ba4630f4ba63864f4dd9ad07c4

SHA256
9029a1ce302973e85b7455a7a397488d9cbf8cfafb78355e8dad12de724932e2

SHA512
4dafeedcb4484c7577b98c1f16188d41d0b4923215587630743d94e75e9f5f0b4c149205d60076799a0fcf550cd7dd42ff35cab9c5a43173eb1be4a79e5610cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f60fb5ed075dd238abf5849cb9705d75

SHA1
83378b228e46840d71bb150129e6710d08fdac59

SHA256
118fc6b24de3fd8a869ee53e268d7dc44850edd10a027332c2b7a25c45f0637c

SHA512
e0f3afed1c50478a25beb9c274764440f9955f68c1f82c55e6de397ae74a3126e83e978c810f66f250da52378a82b90ba48819482efa342f2b986dd5060d1ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Desktop\ExportBackup.dib

Filesize
625KB

MD5
583386f2bacb7613df583dcc44691817

SHA1
5dc4867015b7133761c52eac48622f208a2afffb

SHA256
49d01e684fc4890b5d5cbd2b9c3bcc423cc0c32cee60e25d02dbddd0ae16dd9c

SHA512
bf525cd5cbe464a396a4083866ec11c107a4af23c00b0b4377e725df4d0b460b7e48d5f7fd1ef68f7704cc78682197ba476573cecbebf83b07e63327075e00c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Documents\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Documents\Files.docx

Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Documents\Opened.docx

Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Documents\Recently.docx

Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Documents\These.docx

Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Downloads\ConvertJoin.mp4

Filesize
486KB

MD5
a86522c7b7cdbe0955539348b95bbbb8

SHA1
68de97ce8ef56b8b9aad4f94b937b2e2aa30cb31

SHA256
8b18e08de9bc01b58f4275dc9f90382f62199d299e445e7af1cb2ff3976b6791

SHA512
8243b0f1ea29b572b81d008cd366c38a66a34fd091d621093ecdb06063a1df9d77979f997d82c74ff88dc1b7966782b4b8e15ec78ff48bb66a805b8e8972062b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Downloads\DebugReceive.zip

Filesize
288KB

MD5
8627b6e4a69adae0dcae0d02ce1907ef

SHA1
557ca3856dcbae15bdd412c323ade57d518d9bd6

SHA256
8063692c0a626f0bf8cfcd2e2d9be0f267867bde7b767b5364642b2180fa7d50

SHA512
8df0db6b5a0f5dc79c2a807afe29f0b3ec8610c1f5512cd6f3b8fe2bc9583a1aa1b2543ec6378266114d48b629bd5fcb8b41ff1a8e2157277eb327b733de178a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Downloads\DisableBackup.AAC

Filesize
378KB

MD5
9993bea308620741651e87e51727706b

SHA1
dbc26e8d8e3dc2c56b8b993ffa86980be12fb79a

SHA256
caee36760cc1662eef769997462a9c8a8da91fade9c5eaad63c2698e4c764c3f

SHA512
b81eb9233a1fb8a511c9e490744bdbf9110f8a66b6e71a0d4761e216616069f4d4bba72a2ae132937b7e598dc06efaed71320cc5c55f9af94ff36a1af38285d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Downloads\SplitLimit.txt

Filesize
666KB

MD5
c7e8679dcb7d697c47f0a782df700f08

SHA1
177db7f0b31601797d246731b91deec890e0da47

SHA256
d13b598b7573bd4b358eaa056162e2dd551b158eb1ead16625bd485424d20a16

SHA512
b0c79022f41a0129fc92fe3c42e8461d56d9a3c6bdb8c09c578227d08851ad179378231f895a0711d0403406c51bdf5d64b1b9dcb6e54d413a471b6bf6964313

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Music\BlockEdit.mp4

Filesize
964KB

MD5
9beb90cf6a035749789d1a5964a4aea4

SHA1
feb6104f721127c3c6e748ac3fe23deb8f320d5d

SHA256
07719086a7322f55b04c2c2997e8af87fbd36dbeccc3d4c04cfd2d6a2d61cdff

SHA512
6c82f58ccfee4308e4433b261f2abfbd150b70147251d1a93cd69b68ea4b65328b5540a3a0e3159e9d22d731692fe670d1e43fb7115464f95e3e0871ff9cc40b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Music\EnterBackup.emf

Filesize
643KB

MD5
627c8a61858e806b78ac627295e2eaac

SHA1
7dcdf87565cc764eae73c7b4b95983b0b0e2b7cd

SHA256
c5768134090d09db32ebb8dd3637e0d77edec7bcb34f8d7c6158fe3a4be6a5fa

SHA512
7407282d5a50d1d3ec8590a038df1f65a07ae5b24c34b7c5b968929719526deab24844933ef8e48838ea70f38cdaa7f6e18aff00e22a89cd3dc052afb3d9485e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Music\RestartDisable.zip

Filesize
683KB

MD5
df9b7b2664c9038cb0816be9f2e0c975

SHA1
fdd2996d7a956a3f44f51317597ff764bca8ccb9

SHA256
23c828162d71b80f4d513eb30a8e5d3e47561e0fc8f86e635801ef786621bd83

SHA512
553ad3f83130763925b6f57b6233a3c3ed4ddf8ad8399f53d60ec0942b3d5db69a64525623124bdd179a22e378c78546afba75c96a9fae8c7ad9d22b1f546ba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Music\WaitLimit.pdf

Filesize
1.2MB

MD5
1655defba4697d47fc0e467ee66b9260

SHA1
a97cfc421050da414edc4f745533328c5d782554

SHA256
fd2dba494c2cc3badff1f97046f376e0ab80f8774a63f1af6c8d725ace1d614a

SHA512
46940cadc1a0188c36672dc2eee849d5a7ec6fd7806db2fc5c87585f458c03472a89ed346704a069bfa86264b3d89733ea7a5e2f9b77754b96de9b0f0b3dfaf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Pictures\OutStop.jpg

Filesize
627KB

MD5
7cfb736867cbc9523dea3771d34865aa

SHA1
20ff9fa4742fe121d8f1e159236fd87d5baa1bfe

SHA256
ab728883562e1d9b3d36f996657370a9d5256fb2b33b79446528efed7c2b5dd7

SHA512
14ccb91ddb0077ebed5724fa186b890af6ac45cf72d843fe5264776a746ac4733dcff89a1393cbd1d2e92f01941a17cc38c3b723b8da2ea948efbf76323902ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Pictures\SendMeasure.jpeg

Filesize
741KB

MD5
d7a05c28b975944a76a9bcc8dc4f9ea7

SHA1
c5005f3203e31fdc58040b90bbb378022cd359df

SHA256
9d5458738a2519e7b40d3b0dca69975893bfd8477b4c02fd2391c4c543e79bbd

SHA512
6516d80b952b60f9441324e3c645a7e432a1806ed6e5c2451279c0ec988aad101462cc983b9cb52a884c9b4b008ce39e6fb065340a9bba9c5cbb4fb7df21be11

Download Submit
C:\Users\Admin\AppData\Local\Temp\AZFILESTEALER\Pictures\UnpublishResolve.png

Filesize
456KB

MD5
b6d353a0b71a43ced837601010ee6295

SHA1
8665824f11e861cbb54385ac8df61bb57738a44b

SHA256
fa062f138d520cabb9d0fde423a684d5aeae893739853ad193011b23609cb99e

SHA512
c822a6b5173ebdd7b148ed6ff7bbc9409831743c40c75fc76f60f7209d3cf497adb332d1923f7f6bb7003f53bafd20ae3c7bc0cb809d6caa57270dd6243592a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI61682\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI61682\_bz2.pyd

Filesize
46KB

MD5
80c69a1d87f0c82d6c4268e5a8213b78

SHA1
bae059da91d48eaac4f1bb45ca6feee2c89a2c06

SHA256
307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87

SHA512
542cf4ba19dd6a91690340779873e0cb8864b28159f55917f98a192ff9c449aba2d617e9b2b3932ddfeee13021706577ab164e5394e0513fe4087af6bc39d40d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI61682\_ctypes.pyd

Filesize
57KB

MD5
b4c41a4a46e1d08206c109ce547480c7

SHA1
9588387007a49ec2304160f27376aedca5bc854d

SHA256
9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9

SHA512
30debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI61682\_lzma.pyd

Filesize
84KB

MD5
bfca96ed7647b31dd2919bedebb856b8

SHA1
7d802d5788784f8b6bfbb8be491c1f06600737ac

SHA256
032b1a139adcff84426b6e156f9987b501ad42ecfb18170b10fb54da0157392e

SHA512
3a2926b79c90c3153c88046d316a081c8ddfb181d5f7c849ea6ae55cb13c6adba3a0434f800c4a30017d2fbab79d459432a2e88487914b54a897c4301c778551

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI61682\base_library.zip

Filesize
1.4MB

MD5
07ef59a56c38d5aaee0672d20f757a51

SHA1
f128fa74612de3216c59df1d979b2c317cfbf11b

SHA256
72bb14623f99894b4ebae881eb2a244b671f3282f10f73fb71d18f062d555f03

SHA512
2da75546b211fcb1d1136e4655b4de52c7aa2b91be62e6e94d9966722f25ae7738d38953866aa62f6931a7cf4d4cf828c618dcb950a8b780fe0a029d684b9d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI61682\libcrypto-1_1.dll

Filesize
1.1MB

MD5
86cfc84f8407ab1be6cc64a9702882ef

SHA1
86f3c502ed64df2a5e10b085103c2ffc9e3a4130

SHA256
11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

SHA512
b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI61682\libffi-8.dll

Filesize
24KB

MD5
decbba3add4c2246928ab385fb16a21e

SHA1
5f019eff11de3122ffa67a06d52d446a3448b75e

SHA256
4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d

SHA512
760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI61682\python3.dll

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI61682\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_czlrgx1e.mwv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 565747.crdownload

Filesize
26.7MB

MD5
72c8e2038f465c91184013b19ca93783

SHA1
9efba59252dad3752c87b3423326842399c84dd5

SHA256
d976ea1923cb0fea3eea95f6f7d9eda30fa4b32fa361f32e7873ebf971e777c5

SHA512
aba9a52e90ea92a377c0d9bb9964a7e6af8f88e95585e3d49eb251d01e44b2e5423f385804aa3f8debda4f012676692b197160adb01c5027e80b578fed412b10

Download Submit
memory/2320-646-0x00007FFB636B0000-0x00007FFB6376C000-memory.dmp

Filesize
752KB

Download
memory/2320-653-0x00007FFB62E70000-0x00007FFB62E82000-memory.dmp

Filesize
72KB

Download
memory/2320-660-0x00007FFB52870000-0x00007FFB528A8000-memory.dmp

Filesize
224KB

Download
memory/2320-662-0x00007FFB5EE70000-0x00007FFB5EE84000-memory.dmp

Filesize
80KB

Download
memory/2320-661-0x00007FFB5F840000-0x00007FFB5F854000-memory.dmp

Filesize
80KB

Download
memory/2320-663-0x00007FFB636B0000-0x00007FFB6376C000-memory.dmp

Filesize
752KB

Download
memory/2320-664-0x00007FFB4EC00000-0x00007FFB4ED1C000-memory.dmp

Filesize
1.1MB

Download
memory/2320-658-0x00007FFB4ED20000-0x00007FFB4F414000-memory.dmp

Filesize
7.0MB

Download
memory/2320-674-0x00007FFB52840000-0x00007FFB52862000-memory.dmp

Filesize
136KB

Download
memory/2320-677-0x00007FFB4EB30000-0x00007FFB4EBFF000-memory.dmp

Filesize
828KB

Download
memory/2320-676-0x00007FFB52FB0000-0x00007FFB53068000-memory.dmp

Filesize
736KB

Download
memory/2320-675-0x00007FFB63A20000-0x00007FFB63A4E000-memory.dmp

Filesize
184KB

Download
memory/2320-679-0x00007FFB66900000-0x00007FFB6690A000-memory.dmp

Filesize
40KB

Download
memory/2320-678-0x00007FFB52A30000-0x00007FFB52DA5000-memory.dmp

Filesize
3.5MB

Download
memory/2320-680-0x00007FFB63E30000-0x00007FFB63E45000-memory.dmp

Filesize
84KB

Download
memory/2320-682-0x00007FFB52810000-0x00007FFB52836000-memory.dmp

Filesize
152KB

Download
memory/2320-681-0x00007FFB63B60000-0x00007FFB63B6B000-memory.dmp

Filesize
44KB

Download
memory/2320-683-0x00007FFB5EE90000-0x00007FFB5EEB3000-memory.dmp

Filesize
140KB

Download
memory/2320-685-0x00007FFB4E8E0000-0x00007FFB4EB25000-memory.dmp

Filesize
2.3MB

Download
memory/2320-684-0x00007FFB528B0000-0x00007FFB52A23000-memory.dmp

Filesize
1.4MB

Download
memory/2320-698-0x00007FFB4ED20000-0x00007FFB4F414000-memory.dmp

Filesize
7.0MB

Download
memory/2320-700-0x00007FFB638A0000-0x00007FFB638AF000-memory.dmp

Filesize
60KB

Download
memory/2320-654-0x00007FFB5F860000-0x00007FFB5F878000-memory.dmp

Filesize
96KB

Download
memory/2320-655-0x00007FFB5EE90000-0x00007FFB5EEB3000-memory.dmp

Filesize
140KB

Download
memory/2320-738-0x00007FFB52870000-0x00007FFB528A8000-memory.dmp

Filesize
224KB

Download
memory/2320-1075-0x00007FFB63790000-0x00007FFB637B4000-memory.dmp

Filesize
144KB

Download
memory/2320-656-0x00007FFB528B0000-0x00007FFB52A23000-memory.dmp

Filesize
1.4MB

Download
memory/2320-811-0x00007FFB63E30000-0x00007FFB63E45000-memory.dmp

Filesize
84KB

Download
memory/2320-822-0x00007FFB4EB30000-0x00007FFB4EBFF000-memory.dmp

Filesize
828KB

Download
memory/2320-821-0x00007FFB52840000-0x00007FFB52862000-memory.dmp

Filesize
136KB

Download
memory/2320-820-0x00007FFB4EC00000-0x00007FFB4ED1C000-memory.dmp

Filesize
1.1MB

Download
memory/2320-817-0x00007FFB52870000-0x00007FFB528A8000-memory.dmp

Filesize
224KB

Download
memory/2320-815-0x00007FFB528B0000-0x00007FFB52A23000-memory.dmp

Filesize
1.4MB

Download
memory/2320-812-0x00007FFB62E70000-0x00007FFB62E82000-memory.dmp

Filesize
72KB

Download
memory/2320-810-0x00007FFB52FB0000-0x00007FFB53068000-memory.dmp

Filesize
736KB

Download
memory/2320-809-0x00007FFB52A30000-0x00007FFB52DA5000-memory.dmp

Filesize
3.5MB

Download
memory/2320-796-0x00007FFB4F450000-0x00007FFB4FA38000-memory.dmp

Filesize
5.9MB

Download
memory/2320-808-0x00007FFB63A20000-0x00007FFB63A4E000-memory.dmp

Filesize
184KB

Download
memory/2320-804-0x00007FFB6A200000-0x00007FFB6A20D000-memory.dmp

Filesize
52KB

Download
memory/2320-802-0x00007FFB63E50000-0x00007FFB63E69000-memory.dmp

Filesize
100KB

Download
memory/2320-797-0x00007FFB63790000-0x00007FFB637B4000-memory.dmp

Filesize
144KB

Download
memory/2320-816-0x00007FFB4ED20000-0x00007FFB4F414000-memory.dmp

Filesize
7.0MB

Download
memory/2320-859-0x00007FFB52840000-0x00007FFB52862000-memory.dmp

Filesize
136KB

Download
memory/2320-846-0x00007FFB63A20000-0x00007FFB63A4E000-memory.dmp

Filesize
184KB

Download
memory/2320-849-0x00007FFB63E30000-0x00007FFB63E45000-memory.dmp

Filesize
84KB

Download
memory/2320-834-0x00007FFB4F450000-0x00007FFB4FA38000-memory.dmp

Filesize
5.9MB

Download
memory/2320-861-0x00007FFB4E8E0000-0x00007FFB4EB25000-memory.dmp

Filesize
2.3MB

Download
memory/2320-657-0x00007FFB63E50000-0x00007FFB63E69000-memory.dmp

Filesize
100KB

Download
memory/2320-652-0x00007FFB63E30000-0x00007FFB63E45000-memory.dmp

Filesize
84KB

Download
memory/2320-659-0x00007FFB6D780000-0x00007FFB6D78D000-memory.dmp

Filesize
52KB

Download
memory/2320-649-0x00007FFB52FB0000-0x00007FFB53068000-memory.dmp

Filesize
736KB

Download
memory/2320-651-0x00007FFB52A30000-0x00007FFB52DA5000-memory.dmp

Filesize
3.5MB

Download
memory/2320-650-0x00007FFB4F450000-0x00007FFB4FA38000-memory.dmp

Filesize
5.9MB

Download
memory/2320-648-0x00007FFB63A20000-0x00007FFB63A4E000-memory.dmp

Filesize
184KB

Download
memory/2320-647-0x00007FFB63B90000-0x00007FFB63BBB000-memory.dmp

Filesize
172KB

Download
memory/2320-644-0x00007FFB6A200000-0x00007FFB6A20D000-memory.dmp

Filesize
52KB

Download
memory/2320-645-0x00007FFB63CF0000-0x00007FFB63D1E000-memory.dmp

Filesize
184KB

Download
memory/2320-642-0x00007FFB63E50000-0x00007FFB63E69000-memory.dmp

Filesize
100KB

Download
memory/2320-643-0x00007FFB6D780000-0x00007FFB6D78D000-memory.dmp

Filesize
52KB

Download
memory/2320-641-0x00007FFB63E70000-0x00007FFB63EA5000-memory.dmp

Filesize
212KB

Download
memory/2320-639-0x00007FFB4F420000-0x00007FFB4F44D000-memory.dmp

Filesize
180KB

Download
memory/2320-638-0x00007FFB63690000-0x00007FFB636A9000-memory.dmp

Filesize
100KB

Download
memory/2320-632-0x00007FFB63790000-0x00007FFB637B4000-memory.dmp

Filesize
144KB

Download
memory/2320-633-0x00007FFB6D7E0000-0x00007FFB6D7EF000-memory.dmp

Filesize
60KB

Download
memory/2320-623-0x00007FFB4F450000-0x00007FFB4FA38000-memory.dmp

Filesize
5.9MB

Download
memory/2320-1074-0x00007FFB52A30000-0x00007FFB52DA5000-memory.dmp

Filesize
3.5MB

Download
memory/2320-1086-0x00007FFB63A20000-0x00007FFB63A4E000-memory.dmp

Filesize
184KB

Download
memory/2320-1085-0x00007FFB63B90000-0x00007FFB63BBB000-memory.dmp

Filesize
172KB

Download
memory/2320-1096-0x00007FFB528B0000-0x00007FFB52A23000-memory.dmp

Filesize
1.4MB

Download
memory/2320-1105-0x00007FFB638A0000-0x00007FFB638AF000-memory.dmp

Filesize
60KB

Download
memory/2320-1104-0x00007FFB4E8E0000-0x00007FFB4EB25000-memory.dmp

Filesize
2.3MB

Download
memory/2320-1103-0x00007FFB52810000-0x00007FFB52836000-memory.dmp

Filesize
152KB

Download
memory/2320-1102-0x00007FFB63B60000-0x00007FFB63B6B000-memory.dmp

Filesize
44KB

Download
memory/2320-1101-0x00007FFB66900000-0x00007FFB6690A000-memory.dmp

Filesize
40KB

Download
memory/2320-1100-0x00007FFB4EB30000-0x00007FFB4EBFF000-memory.dmp

Filesize
828KB

Download
memory/2320-1099-0x00007FFB52840000-0x00007FFB52862000-memory.dmp

Filesize
136KB

Download
memory/2320-1098-0x00007FFB4EC00000-0x00007FFB4ED1C000-memory.dmp

Filesize
1.1MB

Download
memory/2320-1097-0x00007FFB4ED20000-0x00007FFB4F414000-memory.dmp

Filesize
7.0MB

Download
memory/2320-1095-0x00007FFB52870000-0x00007FFB528A8000-memory.dmp

Filesize
224KB

Download
memory/2320-1094-0x00007FFB5EE70000-0x00007FFB5EE84000-memory.dmp

Filesize
80KB

Download
memory/2320-1093-0x00007FFB4F420000-0x00007FFB4F44D000-memory.dmp

Filesize
180KB

Download
memory/2320-1092-0x00007FFB5EE90000-0x00007FFB5EEB3000-memory.dmp

Filesize
140KB

Download
memory/2320-1091-0x00007FFB5F860000-0x00007FFB5F878000-memory.dmp

Filesize
96KB

Download
memory/2320-1090-0x00007FFB62E70000-0x00007FFB62E82000-memory.dmp

Filesize
72KB

Download
memory/2320-1089-0x00007FFB63E30000-0x00007FFB63E45000-memory.dmp

Filesize
84KB

Download
memory/2320-1088-0x00007FFB4F450000-0x00007FFB4FA38000-memory.dmp

Filesize
5.9MB

Download
memory/2320-1084-0x00007FFB636B0000-0x00007FFB6376C000-memory.dmp

Filesize
752KB

Download
memory/2320-1083-0x00007FFB63CF0000-0x00007FFB63D1E000-memory.dmp

Filesize
184KB

Download
memory/2320-1082-0x00007FFB6A200000-0x00007FFB6A20D000-memory.dmp

Filesize
52KB

Download
memory/2320-1081-0x00007FFB63E50000-0x00007FFB63E69000-memory.dmp

Filesize
100KB

Download
memory/2320-1080-0x00007FFB6D780000-0x00007FFB6D78D000-memory.dmp

Filesize
52KB

Download
memory/2320-1079-0x00007FFB63E70000-0x00007FFB63EA5000-memory.dmp

Filesize
212KB

Download
memory/2320-1078-0x00007FFB5F840000-0x00007FFB5F854000-memory.dmp

Filesize
80KB

Download
memory/2320-1077-0x00007FFB63690000-0x00007FFB636A9000-memory.dmp

Filesize
100KB

Download
memory/2320-1087-0x00007FFB52FB0000-0x00007FFB53068000-memory.dmp

Filesize
736KB

Download
memory/2320-1076-0x00007FFB6D7E0000-0x00007FFB6D7EF000-memory.dmp

Filesize
60KB

Download
memory/4408-787-0x000002E474CA0000-0x000002E474CC2000-memory.dmp

Filesize
136KB

Download