9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe
Size

89KB
MD5

b4e634baeecde29b2599537d357f87a7
SHA1

29ca3fd61d1563184e8c6353520ac2b0b82c81f5
SHA256

9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6
SHA512

c26d975be9a020a11248147526d1bc0733e62e4dee1cf146775cc463419161e9bad886c4a5fe56d4608f03540ce1655abd250d90f1fb2637cc1c597f6b61e64e
SSDEEP

1536:lr9RFbR3XfYFHuI2Zod8+7gTSaSMi9xfQb+ng5aOmTcuOiFeR7Rkxr:fbR3XMuYd8jV5iQb+ngQZhYRV

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

12 1152 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

999575.exe

pid process

4476 999575.exe
Loads dropped DLL 2 IoCs

Processes:

999575.exe

pid process

4476 999575.exe
4476 999575.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1152 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
12	1152	powershell.exe

pid	process
1152	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exemsedge.exemsedge.exeidentity_helper.exe

pid process

1152 powershell.exe
1152 powershell.exe
3520 msedge.exe
3520 msedge.exe
4600 msedge.exe
4600 msedge.exe
1472 identity_helper.exe
1472 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4600 msedge.exe
4600 msedge.exe
4600 msedge.exe
4600 msedge.exe
4600 msedge.exe
4600 msedge.exe
4600 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1152 powershell.exe

pid	process
1152	powershell.exe
1152	powershell.exe
3520	msedge.exe
3520	msedge.exe
4600	msedge.exe
4600	msedge.exe
1472	identity_helper.exe
1472	identity_helper.exe

description	pid	process
Token: SeDebugPrivilege	1152	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

999575.exemsedge.exe

pid	process
4476	999575.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.execmd.exepowershell.exemsedge.exe

description	pid	process	target process
PID 2836 wrote to memory of 1132	2836	9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe	cmd.exe
PID 2836 wrote to memory of 1132	2836	9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe	cmd.exe
PID 2836 wrote to memory of 1132	2836	9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe	cmd.exe
PID 1132 wrote to memory of 1152	1132	cmd.exe	powershell.exe
PID 1132 wrote to memory of 1152	1132	cmd.exe	powershell.exe
PID 1132 wrote to memory of 1152	1132	cmd.exe	powershell.exe
PID 1152 wrote to memory of 4476	1152	powershell.exe	999575.exe
PID 1152 wrote to memory of 4476	1152	powershell.exe	999575.exe
PID 1152 wrote to memory of 4476	1152	powershell.exe	999575.exe
PID 1152 wrote to memory of 4600	1152	powershell.exe	msedge.exe
PID 1152 wrote to memory of 4600	1152	powershell.exe	msedge.exe
PID 4600 wrote to memory of 2852	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 2852	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3452	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3520	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3520	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3960	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3960	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3960	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3960	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3960	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3960	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3960	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3960	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 3960	4600	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe
"C:\Users\Admin\AppData\Local\Temp\9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\oculta.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\oculta.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\999575\Win999575\999575.exe
      "C:\999575\Win999575\999575.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://server.massgravs.pro/index.php
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa37e46f8,0x7ffaa37e4708,0x7ffaa37e4718
        5⤵
        
        PID:2852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
        5⤵
        
        PID:3452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
        5⤵
        
        PID:3960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
        5⤵
        
        PID:4076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
        5⤵
        
        PID:640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
        5⤵
        
        PID:4528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
        5⤵
        
        PID:1452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
        5⤵
        
        PID:4500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
        5⤵
        
        PID:4180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
        5⤵
        
        PID:3832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,10923174105337365644,8380069747548525095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
        5⤵
        
        PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\999575\Win999575\v8dll.dll

Filesize
14.8MB

MD5
a83f105025e40d95a9de06ed52026439

SHA1
084032f9f86e80081a3312423891e67f23cbc753

SHA256
f7822fd1f8a9a66a2d4ec56e29cf95c43b9f76c3dc27a261ea2f7dba85f89db2

SHA512
e3698fbbf8e1ac7b55939266a76ea00e287be8af3873e99e2c705a51dd2088eb6e9b3be4172aeeabbd03142874bcb6495e759902de49c05b4b0c79f07953c801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
2cd083e022e9833331ae4a02e700aff6

SHA1
39322b53e547efcf9b35280f415dcc34b08ecf9f

SHA256
26bea514140d90aec9529a4afd1e5b041606c25825e382e8e146b81a3d24d46b

SHA512
23da14f0c1e09903ee6dd9396757a3d3f086067101e54d2c8dc4bf60ce57bd5a3e66df435ef44082b5775c9815283d6e23f1a423b2d9dafdf5da0dccd4dbe763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
97829c4a610de22dde358b362eacbf4c

SHA1
edb518609238fe89da2a33a5990b54eadb9508e0

SHA256
3aab8d510e94faa83d6666d483ad169d0c308543b5873c17c227d04fec958465

SHA512
b3dd1990c9d9cb6055a04fa3440aaea33c220590cc3f8ea5cde338ca0ad1801938727a3e65ca92bcd1bc5f8a3b81bec8d8f368eafccf1efbb88dc133a4c006e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d9aa964f349e41c2e6693b169a48055e

SHA1
8ba7ddc00747545a51187f808630f9e231bb5a9b

SHA256
4066c865f54f99e5f867ad4549443b8684f159082d71cde91c4dc932dc3994d9

SHA512
b9d382a20d45636814227cdddf53d4ff7d094451380615e4828108b36e4711b712f13d024fc3c5c9739cace28c3800a6c52c6be33143b432bd46b44c83f6ccaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
579df67e266bdbd6762409456eec00b8

SHA1
df53cfee123610d90ce72bb1c89015d5b8e3b831

SHA256
a5d44f11ee80b6d1f4f8ee8d08ff66a48b3a7c8b9d425027e182443099c4d88d

SHA512
baae812b318a6e604d0c8c111bf9ad9281b7f1292ceddfd2ad414ed3c8e065127ceb810af09bda4aa40fc45c4de464d5b4d51b1e00aaed53834eb154d77eaec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c39ea8e5e8f068d97af07cefa51e32f4

SHA1
8c9bf21f861dcc6702034526972864f03c8ddda2

SHA256
e15f36d666d3223e0f8e05e0eeffdb97685f5825c6ff8f95342029a065202038

SHA512
54199bb7eaf61d225434b3009511412dde5ea4d4b640a755c77f8c9682e6eb70dfca4ab1fcc27f44498296fa6c832b53b3928762c20f527dbafcc3b4e13385b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oyjjvwv1.j2x.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\oculta.bat

Filesize
158B

MD5
54c2f3a00d5bc5ffd7f5338b8d7e265c

SHA1
5c4086ecf9a3508666b1bd4e27ba8f7a517813be

SHA256
a6aec3bbc95bc0a300857092e35a602c601397eefc8565f2bc42e7e77df1eddb

SHA512
05bf9854e0ba84f12e7ddbaf14886491d98a832ef3287b3affc08079b9d08c88d01c386737a3b3e1d9be3cd8850266bb9ea037269e027209410f1ea6c5cf685c

Download Submit
C:\Users\Admin\AppData\Local\Temp\oculta.ps1

Filesize
1KB

MD5
921c2fb8f2423f9fb469e274eed1d860

SHA1
48bf33a865d9415e514281ecb48ac8e8e43ad4bc

SHA256
ce0bd47287e5b4ebe9de5d050e27e36ba863af9a9b21c52a3e8bc5f135252220

SHA512
31d6a485ff59da843ce4048322d4357ec1eb832b7acb0bff4aa6a9005efdd26be97163cdc5e8da30684ce2b45b72b1b9d02bcec800c7726b26fb52f6dafb16db

Download Submit
\??\pipe\LOCAL\crashpad_4600_VPENQLQGKEQSXGWI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1152-41-0x0000000007F10000-0x0000000007F42000-memory.dmp

Filesize
200KB

Download
memory/1152-56-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/1152-16-0x00000000058C0000-0x0000000005926000-memory.dmp

Filesize
408KB

Download
memory/1152-15-0x0000000005720000-0x0000000005742000-memory.dmp

Filesize
136KB

Download
memory/1152-23-0x0000000006100000-0x0000000006454000-memory.dmp

Filesize
3.3MB

Download
memory/1152-28-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/1152-29-0x0000000006870000-0x000000000688E000-memory.dmp

Filesize
120KB

Download
memory/1152-30-0x0000000006990000-0x00000000069DC000-memory.dmp

Filesize
304KB

Download
memory/1152-13-0x0000000005AD0000-0x00000000060F8000-memory.dmp

Filesize
6.2MB

Download
memory/1152-32-0x0000000007FA0000-0x000000000861A000-memory.dmp

Filesize
6.5MB

Download
memory/1152-33-0x0000000006DA0000-0x0000000006DBA000-memory.dmp

Filesize
104KB

Download
memory/1152-34-0x0000000007B20000-0x0000000007BB6000-memory.dmp

Filesize
600KB

Download
memory/1152-35-0x0000000006E40000-0x0000000006E62000-memory.dmp

Filesize
136KB

Download
memory/1152-11-0x0000000002EC0000-0x0000000002EF6000-memory.dmp

Filesize
216KB

Download
memory/1152-12-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/1152-39-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/1152-91-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/1152-43-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/1152-42-0x0000000070200000-0x000000007024C000-memory.dmp

Filesize
304KB

Download
memory/1152-44-0x00000000708A0000-0x0000000070BF4000-memory.dmp

Filesize
3.3MB

Download
memory/1152-54-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/1152-17-0x0000000005930000-0x0000000005996000-memory.dmp

Filesize
408KB

Download
memory/1152-57-0x0000000008620000-0x00000000086C3000-memory.dmp

Filesize
652KB

Download
memory/1152-55-0x0000000007F50000-0x0000000007F6E000-memory.dmp

Filesize
120KB

Download
memory/1152-58-0x0000000008700000-0x000000000870A000-memory.dmp

Filesize
40KB

Download
memory/1152-59-0x0000000008730000-0x0000000008741000-memory.dmp

Filesize
68KB

Download
memory/1152-60-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/1152-61-0x0000000008780000-0x0000000008792000-memory.dmp

Filesize
72KB

Download
memory/1152-62-0x0000000008770000-0x000000000877A000-memory.dmp

Filesize
40KB

Download
memory/1152-14-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/2836-5-0x00000000059F0000-0x00000000059FA000-memory.dmp

Filesize
40KB

Download
memory/2836-0-0x00000000752AE000-0x00000000752AF000-memory.dmp

Filesize
4KB

Download
memory/2836-38-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/2836-37-0x00000000752AE000-0x00000000752AF000-memory.dmp

Filesize
4KB

Download
memory/2836-7-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/2836-6-0x0000000005B50000-0x0000000005BA6000-memory.dmp

Filesize
344KB

Download
memory/2836-4-0x0000000005A50000-0x0000000005AE2000-memory.dmp

Filesize
584KB

Download
memory/2836-3-0x0000000005F60000-0x0000000006504000-memory.dmp

Filesize
5.6MB

Download
memory/2836-2-0x00000000058F0000-0x000000000598C000-memory.dmp

Filesize
624KB

Download
memory/2836-1-0x0000000000F40000-0x0000000000F5A000-memory.dmp

Filesize
104KB

Download
memory/4476-87-0x0000000004D20000-0x0000000005C02000-memory.dmp

Filesize
14.9MB

Download
memory/4476-153-0x0000000004D20000-0x0000000005C02000-memory.dmp

Filesize
14.9MB

Download
memory/4476-152-0x0000000000400000-0x0000000004836000-memory.dmp

Filesize
68.2MB

Download