9f3417d8ab80cbc56bdd73a8432802877f4e985d5511fa1fdf17720c8ca86eb0

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe
Size

89KB
MD5

b4e634baeecde29b2599537d357f87a7
SHA1

29ca3fd61d1563184e8c6353520ac2b0b82c81f5
SHA256

9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6
SHA512

c26d975be9a020a11248147526d1bc0733e62e4dee1cf146775cc463419161e9bad886c4a5fe56d4608f03540ce1655abd250d90f1fb2637cc1c597f6b61e64e
SSDEEP

1536:lr9RFbR3XfYFHuI2Zod8+7gTSaSMi9xfQb+ng5aOmTcuOiFeR7Rkxr:fbR3XMuYd8jV5iQb+ngQZhYRV

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow	pid	Process
2	4212	powershell.exe

Executes dropped EXE 1 IoCs

Processes:

99523.exe

pid	Process
2336	99523.exe

Loads dropped DLL 2 IoCs

Processes:

99523.exe

pid	Process
2336	99523.exe
2336	99523.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
4212	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exemsedge.exemsedge.exeidentity_helper.exe

pid	Process
4212	powershell.exe
4212	powershell.exe
4848	msedge.exe
4848	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4084	identity_helper.exe
4084	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	4212	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

99523.exemsedge.exe

pid	Process
2336	99523.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.execmd.exepowershell.exemsedge.exe

description	pid	Process	procid_target
PID 4464 wrote to memory of 1552	4464	9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe	81
PID 4464 wrote to memory of 1552	4464	9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe	81
PID 4464 wrote to memory of 1552	4464	9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe	81
PID 1552 wrote to memory of 4212	1552	cmd.exe	83
PID 1552 wrote to memory of 4212	1552	cmd.exe	83
PID 1552 wrote to memory of 4212	1552	cmd.exe	83
PID 4212 wrote to memory of 2336	4212	powershell.exe	86
PID 4212 wrote to memory of 2336	4212	powershell.exe	86
PID 4212 wrote to memory of 2336	4212	powershell.exe	86
PID 4212 wrote to memory of 4064	4212	powershell.exe	87
PID 4212 wrote to memory of 4064	4212	powershell.exe	87
PID 4064 wrote to memory of 4460	4064	msedge.exe	88
PID 4064 wrote to memory of 4460	4064	msedge.exe	88
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 2956	4064	msedge.exe	89
PID 4064 wrote to memory of 4848	4064	msedge.exe	90
PID 4064 wrote to memory of 4848	4064	msedge.exe	90
PID 4064 wrote to memory of 3772	4064	msedge.exe	91
PID 4064 wrote to memory of 3772	4064	msedge.exe	91
PID 4064 wrote to memory of 3772	4064	msedge.exe	91
PID 4064 wrote to memory of 3772	4064	msedge.exe	91
PID 4064 wrote to memory of 3772	4064	msedge.exe	91
PID 4064 wrote to memory of 3772	4064	msedge.exe	91
PID 4064 wrote to memory of 3772	4064	msedge.exe	91
PID 4064 wrote to memory of 3772	4064	msedge.exe	91
PID 4064 wrote to memory of 3772	4064	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe
"C:\Users\Admin\AppData\Local\Temp\9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\oculta.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\oculta.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\99523\Win99523\99523.exe
      "C:\99523\Win99523\99523.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://server.massgravs.pro/index.php
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa08bd46f8,0x7ffa08bd4708,0x7ffa08bd4718
        5⤵
        
        PID:4460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        5⤵
        
        PID:2956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
        5⤵
        
        PID:3772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:2528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        5⤵
        
        PID:3224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
        5⤵
        
        PID:2460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 /prefetch:8
        5⤵
        
        PID:1012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
        5⤵
        
        PID:1384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
        5⤵
        
        PID:3228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
        5⤵
        
        PID:3732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2730050270962376983,16839193817438280669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
        5⤵
        
        PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\99523\Win99523\v8dll.dll

Filesize
14.8MB

MD5
a83f105025e40d95a9de06ed52026439

SHA1
084032f9f86e80081a3312423891e67f23cbc753

SHA256
f7822fd1f8a9a66a2d4ec56e29cf95c43b9f76c3dc27a261ea2f7dba85f89db2

SHA512
e3698fbbf8e1ac7b55939266a76ea00e287be8af3873e99e2c705a51dd2088eb6e9b3be4172aeeabbd03142874bcb6495e759902de49c05b4b0c79f07953c801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ca056f4e37dfd76de37cc2370b2c622a

SHA1
a67a577ff45d3744d928af8110a7c50f0ad14c6b

SHA256
8f223443aae35a7fff835490c3458dd0475f243f0e838eeb3886630bee4dcee6

SHA512
10694a83c7c5a980d3126787a44caadafb9e07da97cc8c8c4b8e9c4365c64eb526d98df1ad3eac4f13556f4ab5d4f4f8fb6a713d066258a263b9f2690a2b5241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7a77acaafde8205b0259dc07ad3e3f8b

SHA1
eb0ab09ecd9b88f403985635ced58993c1fbee88

SHA256
5fb27486527e6e32406c7149c311da5e56b1caa9849f866146e9f16122b97f6e

SHA512
7c1fef40891499b8ddcb3e68aab44c9f8a493416e9f48061ab9a7b17688368ab3bb857ff9af01408371d6b66986cc31c50b5a2085716286d4f46057b190ea9cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79de4af5750a542546474e7be99a67d8

SHA1
70832e6d513ff6d878854d63f3840ee9d4e8546e

SHA256
d9260285baf785b940cf8ce89a27c92085238536e7f24629013ad5677c433faf

SHA512
bf7988271037c49b9dfb0f22210f880ed57af96c70acdba75fdb68c17b585c052b41e92455edafb4dbc7878fd7394b3f4fbaf019b95c7b1aefdb5cff3aef0184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
862e3cf017aadbbdc85d5c38b63a0ae4

SHA1
36d84c82222365d7af7f90e70c88d88be9bbb420

SHA256
3c0970534471e3f0b99b8787bef58136b8e45ec7d3276efec1ed6ffe71396ce1

SHA512
7c0d52624c8fa25ca6e38299f9d25c78702451e841c1ea57eb6a17dab4826190b69b64c562f41420b50aa8fc9f4265e5585f0c14c3b363138d37764a3a36a83a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
522ff76d2685053122718bb7e1a8fe42

SHA1
f1f5cec74f5ba35e97926245109a9de2921be1cf

SHA256
a6f2cfcfd1c15d8011b7d7ad06029ce8ecd03d8c9dcc1cda816a1f17df728ba0

SHA512
e0023a05ce2673fc06ff9203813f2d08a4346dfef0e203f3fe4088c53e6b91f2d1acd796bf6079566428847d17a2b630ff3c6bd4ecaf782056781b1684608525

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rko5d2jm.coo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\oculta.bat

Filesize
158B

MD5
54c2f3a00d5bc5ffd7f5338b8d7e265c

SHA1
5c4086ecf9a3508666b1bd4e27ba8f7a517813be

SHA256
a6aec3bbc95bc0a300857092e35a602c601397eefc8565f2bc42e7e77df1eddb

SHA512
05bf9854e0ba84f12e7ddbaf14886491d98a832ef3287b3affc08079b9d08c88d01c386737a3b3e1d9be3cd8850266bb9ea037269e027209410f1ea6c5cf685c

Download Submit
C:\Users\Admin\AppData\Local\Temp\oculta.ps1

Filesize
1KB

MD5
921c2fb8f2423f9fb469e274eed1d860

SHA1
48bf33a865d9415e514281ecb48ac8e8e43ad4bc

SHA256
ce0bd47287e5b4ebe9de5d050e27e36ba863af9a9b21c52a3e8bc5f135252220

SHA512
31d6a485ff59da843ce4048322d4357ec1eb832b7acb0bff4aa6a9005efdd26be97163cdc5e8da30684ce2b45b72b1b9d02bcec800c7726b26fb52f6dafb16db

Download Submit
\??\pipe\LOCAL\crashpad_4064_WBGUAWBWKQWVOAWX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2336-88-0x0000000004CC0000-0x0000000005BA2000-memory.dmp

Filesize
14.9MB

Download
memory/2336-156-0x0000000004CC0000-0x0000000005BA2000-memory.dmp

Filesize
14.9MB

Download
memory/2336-155-0x0000000000400000-0x0000000004836000-memory.dmp

Filesize
68.2MB

Download
memory/4212-43-0x0000000070040000-0x0000000070394000-memory.dmp

Filesize
3.3MB

Download
memory/4212-14-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4212-28-0x0000000005F30000-0x0000000006284000-memory.dmp

Filesize
3.3MB

Download
memory/4212-29-0x0000000006380000-0x000000000639E000-memory.dmp

Filesize
120KB

Download
memory/4212-30-0x0000000006410000-0x000000000645C000-memory.dmp

Filesize
304KB

Download
memory/4212-27-0x0000000005EC0000-0x0000000005F26000-memory.dmp

Filesize
408KB

Download
memory/4212-32-0x0000000007AA0000-0x000000000811A000-memory.dmp

Filesize
6.5MB

Download
memory/4212-33-0x0000000006880000-0x000000000689A000-memory.dmp

Filesize
104KB

Download
memory/4212-35-0x0000000006970000-0x0000000006992000-memory.dmp

Filesize
136KB

Download
memory/4212-34-0x0000000007620000-0x00000000076B6000-memory.dmp

Filesize
600KB

Download
memory/4212-11-0x0000000004E10000-0x0000000004E46000-memory.dmp

Filesize
216KB

Download
memory/4212-12-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4212-40-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4212-26-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download
memory/4212-42-0x000000006FFF0000-0x000000007003C000-memory.dmp

Filesize
304KB

Download
memory/4212-41-0x0000000007A10000-0x0000000007A42000-memory.dmp

Filesize
200KB

Download
memory/4212-45-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4212-55-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4212-54-0x0000000007A50000-0x0000000007A6E000-memory.dmp

Filesize
120KB

Download
memory/4212-57-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4212-58-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4212-56-0x0000000008120000-0x00000000081C3000-memory.dmp

Filesize
652KB

Download
memory/4212-59-0x0000000008200000-0x000000000820A000-memory.dmp

Filesize
40KB

Download
memory/4212-60-0x0000000008230000-0x0000000008241000-memory.dmp

Filesize
68KB

Download
memory/4212-61-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4212-62-0x0000000008280000-0x0000000008292000-memory.dmp

Filesize
72KB

Download
memory/4212-63-0x0000000008270000-0x000000000827A000-memory.dmp

Filesize
40KB

Download
memory/4212-21-0x0000000005BF0000-0x0000000005C12000-memory.dmp

Filesize
136KB

Download
memory/4212-15-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4212-13-0x0000000005480000-0x0000000005AA8000-memory.dmp

Filesize
6.2MB

Download
memory/4212-97-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4464-0-0x000000007509E000-0x000000007509F000-memory.dmp

Filesize
4KB

Download
memory/4464-39-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4464-36-0x000000007509E000-0x000000007509F000-memory.dmp

Filesize
4KB

Download
memory/4464-6-0x0000000005890000-0x00000000058E6000-memory.dmp

Filesize
344KB

Download
memory/4464-7-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4464-5-0x0000000005600000-0x000000000560A000-memory.dmp

Filesize
40KB

Download
memory/4464-4-0x0000000005650000-0x00000000056E2000-memory.dmp

Filesize
584KB

Download
memory/4464-3-0x0000000005B60000-0x0000000006104000-memory.dmp

Filesize
5.6MB

Download
memory/4464-1-0x0000000000B50000-0x0000000000B6A000-memory.dmp

Filesize
104KB

Download
memory/4464-2-0x0000000005510000-0x00000000055AC000-memory.dmp

Filesize
624KB

Download