hxxps://github[.]com/lasvegasx/growpai

Analysis

max time kernel
146s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/lasvegasx/growpai

Score

9^/10

evasion pyinstaller spyware stealer upx

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

5124 netsh.exe
884 netsh.exe

pid	process
5124	netsh.exe
884	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Inzector_protected.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Inzector_protected.exe

Executes dropped EXE 6 IoCs

Processes:

Inzector_protected.exeInfinity.exeInfinity.exeloader.exeloader.exeloader.exe

pid process

1984 Inzector_protected.exe
1724 Infinity.exe
5336 Infinity.exe
1364 loader.exe
4812 loader.exe
1580 loader.exe

pid	process
1984	Inzector_protected.exe
1724	Infinity.exe
5336	Infinity.exe
1364	loader.exe
4812	loader.exe
1580	loader.exe

Loads dropped DLL 31 IoCs

Processes:

Infinity.exe

pid	process
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe
5336	Infinity.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI17242\python310.dll	upx
behavioral1/memory/5336-376-0x00007FFA54090000-0x00007FFA544FE000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\libffi-7.dll	upx
behavioral1/memory/5336-384-0x00007FFA69130000-0x00007FFA69154000-memory.dmp	upx
behavioral1/memory/5336-386-0x00007FFA6E4E0000-0x00007FFA6E4EF000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_socket.pyd	upx
behavioral1/memory/5336-392-0x00007FFA692E0000-0x00007FFA692ED000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_bz2.pyd	upx
behavioral1/memory/5336-398-0x00007FFA68170000-0x00007FFA6819D000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_lzma.pyd	upx
behavioral1/memory/5336-403-0x00007FFA67B20000-0x00007FFA67B3F000-memory.dmp	upx
behavioral1/memory/5336-404-0x00007FFA56EC0000-0x00007FFA57031000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\cryptography\hazmat\bindings\_rust.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_sqlite3.pyd	upx
behavioral1/memory/5336-396-0x00007FFA68320000-0x00007FFA68339000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\select.pyd	upx
behavioral1/memory/5336-389-0x00007FFA68580000-0x00007FFA68599000-memory.dmp	upx
behavioral1/memory/5336-408-0x000001353FA20000-0x0000013540114000-memory.dmp	upx
behavioral1/memory/5336-409-0x000001353FA20000-0x0000013540114000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_cffi_backend.cp310-win_amd64.pyd	upx
behavioral1/memory/5336-412-0x00007FFA67A20000-0x00007FFA67A58000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\libcrypto-1_1.dll	upx
behavioral1/memory/5336-419-0x00007FFA54090000-0x00007FFA544FE000-memory.dmp	upx
behavioral1/memory/5336-421-0x00007FFA57260000-0x00007FFA57318000-memory.dmp	upx
behavioral1/memory/5336-423-0x00007FFA69130000-0x00007FFA69154000-memory.dmp	upx
behavioral1/memory/5336-422-0x00007FFA53610000-0x00007FFA53985000-memory.dmp	upx
behavioral1/memory/5336-420-0x00007FFA5EAD0000-0x00007FFA5EAFE000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\libssl-1_1.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_ssl.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_asyncio.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_overlapped.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\unicodedata.pyd	upx
behavioral1/memory/5336-440-0x00007FFA68170000-0x00007FFA6819D000-memory.dmp	upx
behavioral1/memory/5336-438-0x00007FFA57240000-0x00007FFA57254000-memory.dmp	upx
behavioral1/memory/5336-443-0x00007FFA534F0000-0x00007FFA53608000-memory.dmp	upx
behavioral1/memory/5336-446-0x00007FFA56E90000-0x00007FFA56EB2000-memory.dmp	upx
behavioral1/memory/5336-445-0x00007FFA56EC0000-0x00007FFA57031000-memory.dmp	upx
behavioral1/memory/5336-444-0x00007FFA67B20000-0x00007FFA67B3F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\yarl\_quoting_c.cp310-win_amd64.pyd	upx
behavioral1/memory/5336-441-0x000001353FA20000-0x0000013540114000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_hashlib.pyd	upx
behavioral1/memory/5336-435-0x00007FFA5EA90000-0x00007FFA5EAA4000-memory.dmp	upx
behavioral1/memory/5336-433-0x00007FFA692E0000-0x00007FFA692ED000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI17242\multidict\_multidict.cp310-win_amd64.pyd	upx
behavioral1/memory/5336-449-0x00007FFA53480000-0x00007FFA534C1000-memory.dmp	upx
behavioral1/memory/5336-448-0x00007FFA534D0000-0x00007FFA534E5000-memory.dmp	upx
behavioral1/memory/5336-447-0x00007FFA546D0000-0x00007FFA546E3000-memory.dmp	upx
behavioral1/memory/5336-456-0x00007FFA53460000-0x00007FFA5347E000-memory.dmp	upx
behavioral1/memory/5336-455-0x00007FFA5EAB0000-0x00007FFA5EAC5000-memory.dmp	upx
behavioral1/memory/5336-454-0x00007FFA68310000-0x00007FFA6831A000-memory.dmp	upx
behavioral1/memory/5336-453-0x00007FFA53610000-0x00007FFA53985000-memory.dmp	upx
behavioral1/memory/5336-452-0x00007FFA688F0000-0x00007FFA688FE000-memory.dmp	upx
behavioral1/memory/5336-451-0x00007FFA57260000-0x00007FFA57318000-memory.dmp	upx
behavioral1/memory/5336-450-0x00007FFA5EAD0000-0x00007FFA5EAFE000-memory.dmp	upx
behavioral1/memory/5336-508-0x00007FFA69B90000-0x00007FFA69B9D000-memory.dmp	upx
behavioral1/memory/5336-430-0x00007FFA69010000-0x00007FFA69020000-memory.dmp	upx
behavioral1/memory/5336-429-0x00007FFA68580000-0x00007FFA68599000-memory.dmp	upx
behavioral1/memory/5336-428-0x00007FFA5EAB0000-0x00007FFA5EAC5000-memory.dmp	upx
behavioral1/memory/5336-525-0x00007FFA534F0000-0x00007FFA53608000-memory.dmp	upx
behavioral1/memory/5336-553-0x00007FFA56E90000-0x00007FFA56EB2000-memory.dmp	upx
behavioral1/memory/5336-560-0x00007FFA69B90000-0x00007FFA69B9D000-memory.dmp	upx
behavioral1/memory/5336-559-0x00007FFA53460000-0x00007FFA5347E000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

Processes:

flow	ioc
69	raw.githubusercontent.com
111	discord.com
129	discord.com
136	discord.com
138	discord.com
70	raw.githubusercontent.com
106	discord.com
107	discord.com
134	discord.com
135	discord.com
137	discord.com

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

99 ip-api.com
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1404 sc.exe

flow	ioc
99	ip-api.com

pid	process
1404	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infinity.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.

Data from Local System
T1005

Processes:

WMIC.exe

pid process

2176 WMIC.exe
Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

2724 tasklist.exe
1080 tasklist.exe
3784 tasklist.exe
4392 tasklist.exe

pid	process
2176	WMIC.exe

pid	process
2724	tasklist.exe
1080	tasklist.exe
3784	tasklist.exe
4392	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

NETSTAT.EXEipconfig.exe

pid process

2576 NETSTAT.EXE
5480 ipconfig.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

5792 systeminfo.exe

pid	process
2576	NETSTAT.EXE
5480	ipconfig.exe

pid	process
5792	systeminfo.exe

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
5452	taskkill.exe
5664	taskkill.exe
732	taskkill.exe
3968	taskkill.exe
400	taskkill.exe
5236	taskkill.exe
404	taskkill.exe
3884	taskkill.exe
5212	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\NodeSlot = "17"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Mode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Mode = "6"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "3"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15	explorer.exe

Runs net.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

2396 explorer.exe

pid	process
2396	explorer.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exepowershell.exetaskmgr.exe

pid	process
4068	msedge.exe
4068	msedge.exe
4512	msedge.exe
4512	msedge.exe
5324	identity_helper.exe
5324	identity_helper.exe
2016	msedge.exe
2016	msedge.exe
5148	powershell.exe
5148	powershell.exe
5148	powershell.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4512 msedge.exe
4512 msedge.exe
4512 msedge.exe
4512 msedge.exe
4512 msedge.exe
4512 msedge.exe
4512 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exeWMIC.exetasklist.exetasklist.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetasklist.exepowershell.exeWMIC.exe

description	pid	process
Token: SeRestorePrivilege	5400	7zG.exe
Token: 35	5400	7zG.exe
Token: SeSecurityPrivilege	5400	7zG.exe
Token: SeSecurityPrivilege	5400	7zG.exe
Token: SeIncreaseQuotaPrivilege	5732	WMIC.exe
Token: SeSecurityPrivilege	5732	WMIC.exe
Token: SeTakeOwnershipPrivilege	5732	WMIC.exe
Token: SeLoadDriverPrivilege	5732	WMIC.exe
Token: SeSystemProfilePrivilege	5732	WMIC.exe
Token: SeSystemtimePrivilege	5732	WMIC.exe
Token: SeProfSingleProcessPrivilege	5732	WMIC.exe
Token: SeIncBasePriorityPrivilege	5732	WMIC.exe
Token: SeCreatePagefilePrivilege	5732	WMIC.exe
Token: SeBackupPrivilege	5732	WMIC.exe
Token: SeRestorePrivilege	5732	WMIC.exe
Token: SeShutdownPrivilege	5732	WMIC.exe
Token: SeDebugPrivilege	5732	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5732	WMIC.exe
Token: SeRemoteShutdownPrivilege	5732	WMIC.exe
Token: SeUndockPrivilege	5732	WMIC.exe
Token: SeManageVolumePrivilege	5732	WMIC.exe
Token: 33	5732	WMIC.exe
Token: 34	5732	WMIC.exe
Token: 35	5732	WMIC.exe
Token: 36	5732	WMIC.exe
Token: SeDebugPrivilege	2724	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5732	WMIC.exe
Token: SeSecurityPrivilege	5732	WMIC.exe
Token: SeTakeOwnershipPrivilege	5732	WMIC.exe
Token: SeLoadDriverPrivilege	5732	WMIC.exe
Token: SeSystemProfilePrivilege	5732	WMIC.exe
Token: SeSystemtimePrivilege	5732	WMIC.exe
Token: SeProfSingleProcessPrivilege	5732	WMIC.exe
Token: SeIncBasePriorityPrivilege	5732	WMIC.exe
Token: SeCreatePagefilePrivilege	5732	WMIC.exe
Token: SeBackupPrivilege	5732	WMIC.exe
Token: SeRestorePrivilege	5732	WMIC.exe
Token: SeShutdownPrivilege	5732	WMIC.exe
Token: SeDebugPrivilege	5732	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5732	WMIC.exe
Token: SeRemoteShutdownPrivilege	5732	WMIC.exe
Token: SeUndockPrivilege	5732	WMIC.exe
Token: SeManageVolumePrivilege	5732	WMIC.exe
Token: 33	5732	WMIC.exe
Token: 34	5732	WMIC.exe
Token: 35	5732	WMIC.exe
Token: 36	5732	WMIC.exe
Token: SeDebugPrivilege	1080	tasklist.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	5212	taskkill.exe
Token: SeDebugPrivilege	3968	taskkill.exe
Token: SeDebugPrivilege	400	taskkill.exe
Token: SeDebugPrivilege	5452	taskkill.exe
Token: SeDebugPrivilege	5236	taskkill.exe
Token: SeDebugPrivilege	5664	taskkill.exe
Token: SeDebugPrivilege	404	taskkill.exe
Token: SeDebugPrivilege	732	taskkill.exe
Token: SeDebugPrivilege	3784	tasklist.exe
Token: SeDebugPrivilege	5148	powershell.exe
Token: SeIncreaseQuotaPrivilege	2176	WMIC.exe
Token: SeSecurityPrivilege	2176	WMIC.exe
Token: SeTakeOwnershipPrivilege	2176	WMIC.exe
Token: SeLoadDriverPrivilege	2176	WMIC.exe
Token: SeSystemProfilePrivilege	2176	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zG.exetaskmgr.exe

pid	process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
5400	7zG.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe
4812	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

loader.exeloader.exeloader.exe

pid process

1364 loader.exe
4812 loader.exe
1580 loader.exe

pid	process
1364	loader.exe
4812	loader.exe
1580	loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4512 wrote to memory of 4052	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 4052	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 660	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 4068	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 4068	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe
PID 4512 wrote to memory of 2224	4512	msedge.exe	msedge.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2580 attrib.exe

pid	process
2580	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/lasvegasx/growpai
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa682d46f8,0x7ffa682d4708,0x7ffa682d4718
2⤵
PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
2⤵
PID:660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
2⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:5684

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
2⤵
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
2⤵
PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5036 /prefetch:8
2⤵
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
2⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,8881552825766123792,10267766708027740548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3028

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\v4.56 Hack\" -spe -an -ai#7zMap28419:82:7zEvent29869
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5400

C:\Users\Admin\Downloads\v4.56 Hack\Inzector_protected.exe
"C:\Users\Admin\Downloads\v4.56 Hack\Inzector_protected.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1984

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infinity.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infinity.exe"
2⤵
- Executes dropped EXE
PID:1724

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infinity.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infinity.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
4⤵
PID:2620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:2520

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:5732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:4948

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\InfinityUpdateService\Infinity.exe""
4⤵
PID:3184

C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Local\InfinityUpdateService\Infinity.exe"
5⤵
- Views/modifies file attributes
PID:2580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:508

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4512"
4⤵
PID:4740

C:\Windows\system32\taskkill.exe
taskkill /F /PID 4512
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4052"
4⤵
PID:5740

C:\Windows\system32\taskkill.exe
taskkill /F /PID 4052
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 660"
4⤵
PID:5456

C:\Windows\system32\taskkill.exe
taskkill /F /PID 660
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4068"
4⤵
PID:5852

C:\Windows\system32\taskkill.exe
taskkill /F /PID 4068
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2224"
4⤵
PID:2868

C:\Windows\system32\taskkill.exe
taskkill /F /PID 2224
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5684"
4⤵
PID:4960

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5684
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4060"
4⤵
PID:3428

C:\Windows\system32\taskkill.exe
taskkill /F /PID 4060
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5796"
4⤵
PID:5548

C:\Windows\system32\taskkill.exe
taskkill /F /PID 5796
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2860"
4⤵
PID:632

C:\Windows\system32\taskkill.exe
taskkill /F /PID 2860
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
4⤵
PID:744

C:\Windows\system32\cmd.exe
cmd.exe /c chcp
5⤵
PID:2724

C:\Windows\system32\chcp.com
chcp
6⤵
PID:5044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
4⤵
PID:5136

C:\Windows\system32\cmd.exe
cmd.exe /c chcp
5⤵
PID:3896

C:\Windows\system32\chcp.com
chcp
6⤵
PID:1384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
4⤵
PID:4848

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
4⤵
PID:2268

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Get-Clipboard
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
4⤵
PID:3184

C:\Windows\system32\netsh.exe
netsh wlan show profiles
5⤵
PID:2664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
4⤵
PID:2580

C:\Windows\system32\systeminfo.exe
systeminfo
5⤵
- Gathers system information
PID:5792

C:\Windows\system32\HOSTNAME.EXE
hostname
5⤵
PID:5768

C:\Windows\System32\Wbem\WMIC.exe
wmic logicaldisk get caption,description,providername
5⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\system32\net.exe
net user
5⤵
PID:5748

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user
6⤵
PID:3656

C:\Windows\system32\query.exe
query user
5⤵
PID:5844

C:\Windows\system32\quser.exe
"C:\Windows\system32\quser.exe"
6⤵
PID:3612

C:\Windows\system32\net.exe
net localgroup
5⤵
PID:5860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup
6⤵
PID:3320

C:\Windows\system32\net.exe
net localgroup administrators
5⤵
PID:3100

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup administrators
6⤵
PID:5652

C:\Windows\system32\net.exe
net user guest
5⤵
PID:4912

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user guest
6⤵
PID:5520

C:\Windows\system32\net.exe
net user administrator
5⤵
PID:6112

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user administrator
6⤵
PID:1488

C:\Windows\System32\Wbem\WMIC.exe
wmic startup get caption,command
5⤵
PID:5168

C:\Windows\system32\tasklist.exe
tasklist /svc
5⤵
- Enumerates processes with tasklist
PID:4392

C:\Windows\system32\ipconfig.exe
ipconfig /all
5⤵
- Gathers network information
PID:5480

C:\Windows\system32\ROUTE.EXE
route print
5⤵
PID:2224

C:\Windows\system32\ARP.EXE
arp -a
5⤵
PID:2912

C:\Windows\system32\NETSTAT.EXE
netstat -ano
5⤵
- Gathers network information
PID:2576

C:\Windows\system32\sc.exe
sc query type= service state= all
5⤵
- Launches sc.exe
PID:1404

C:\Windows\system32\netsh.exe
netsh firewall show state
5⤵
- Modifies Windows Firewall
PID:5124

C:\Windows\system32\netsh.exe
netsh firewall show config
5⤵
- Modifies Windows Firewall
PID:884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:4300

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:3884

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
PID:3972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:5820

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
PID:5612

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4812

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:2396

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3876

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4468

C:\Users\Admin\Downloads\v4.56 Hack\loader.exe
"C:\Users\Admin\Downloads\v4.56 Hack\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1364

C:\Users\Admin\Downloads\v4.56 Hack\loader.exe
"C:\Users\Admin\Downloads\v4.56 Hack\loader.exe" "C:\Users\Admin\Downloads\v4.56 Hack\Growpai.dll"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4812

C:\Users\Admin\Downloads\v4.56 Hack\loader.exe
"C:\Users\Admin\Downloads\v4.56 Hack\loader.exe" "C:\Users\Admin\Downloads\v4.56 Hack\Growpai.dll"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\04f0af57-9057-4f8f-a939-bf9b8c1fbe32.tmp

Filesize
11KB

MD5
769acd236e66aab1af4415ae075e9acd

SHA1
3e4a12eed9fdf69527860d2dc5beb9b7984f5b3d

SHA256
fbaa3836159a78f1b96d41537d36ae2b0ad3ddf2962caa097acb3bf66c057b19

SHA512
d08869c3e751bfca35de831b0415eaa8b4a496e848717e3465d5e88b15d1aa4ba83c4eacdb65df52978589a589a4d1d41df3d0488a0e3a10719cbfead790c8c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
afdc93575609944be5b4a7565a108a6e

SHA1
6a4cc9db8a3cc0c8d9b50d2c20612215adddbb1e

SHA256
0df651de916e0f9edc34482fde146fb0f1dcdfbab0b27fea18481ccfa5c5bd17

SHA512
d4aaef778ab7920b3888f51bf6d9a5ab707cfad83561dae67631b60571993a9e52a2d8123a5e9e0a5087a728d47a1d92844cf7f29bb09a252c69d469f29e6fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
6d9fcf290eda6f194c212059c3a7c558

SHA1
b441d1c7cced870998378f4a5d42326640b967c0

SHA256
a5194c7f9b2e7a254ab42604cfc2739bc14a1de4c41e5fbe6c684ed8b81f4493

SHA512
693c49c1a079e63c02164870c9c638e222d1ba9193ced6ebd92bbf0fffd63cab281844c1136402414410b00ee101872ec80207e337a35c9c23379f8605581c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
79ad874517077a15298e49eb188c9660

SHA1
1c8fdfda41c9463b6f0c049a6fec2ba80ce107ec

SHA256
820b20573c207a7337e5cfe7fd878c86f53b84dd51cd1707edeefa7b4d7c5ebd

SHA512
50354f1139540b5e885da2109c6ef93f4fca00a9274e79081919b9879753ef975e70ec0c0842d03d8e5caaa351387609c0e3b4c4c95b1b476135eaa1757fee52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5853b0f98ecfd43da96bf848ad5a421

SHA1
dbcb286ac63e6304d78de286ecc5424efdf63782

SHA256
6953b45add2849dba7ddf7e9932cd1a9a3fdc2d560ba85705e526f115509ddb2

SHA512
1326be5657cbd91b470ecf55c9ae5ea466ba4c50bf345cc12d26c144ab4543d78377a89006cc2d42adf51e84fc821bc07e2b92269eb0ac86f921da590390899c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c0398c51fe1e8bc2f21f58358ca93aa

SHA1
11460b79fc14285824c6eb3be85942e429098b31

SHA256
d1cb02b4298b5391162d6602f2e9e689f3969949b300788388216319175a3cdf

SHA512
67a7e81bbe45793af7491f34a04098e04a11f3c00d6abab12eff1c2abd8fe6b8fcf2740c606b151797cdc7aa859d2a52dd3d13ea393338c6dedeb573de6ec9a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
1fa32a8eef226e6fc4b2143674e92c5c

SHA1
0b1dd1628dd8dbabd7a49887dadb80f7d97df978

SHA256
666e606f16175ef12b61544090090c64829550a52e0c934a9d5ab19a4206ca52

SHA512
e3a125472eb25a0a322060321dfd4fdab7b6effb2cde699b7b48624d06eb0cb02ca567652a5e60f4c412659e8256c6c6a8960f3cf999aa45a16fc016ba5d174f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9e691b86b15dc9ab487b39a0211f4ad6

SHA1
4d55e7c297fefae97d4509108eed3dcdaa2cf51d

SHA256
80e0727be4ed4b8c8fdfdbf63ecd7e9240e3a026957fbcb7687456c0e410d2de

SHA512
f69e87cf1e3da8c1222bce3915c992c72bf40471dfbb32da8b547f41e55d8ae64738751e3a89f6ec99e396ac9d38d35b17db652b96a847350ce39b98248c8261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\b3ddd642-99ae-43dc-8d8c-453672a16669\0

Filesize
15.0MB

MD5
0e8de0719bc56284885c32993400079b

SHA1
4a1ac48d5f61e63eb60106475b32f9a4b6bc2e96

SHA256
2798dc2ae0e458e5640b6023b09c7acd56220981e8db0a04b709da1233a0e812

SHA512
38cace940a77db82660702bdf0b9b666bbe1aeacddf48e3274096cfe73c755bf91f0c725b28b48cdbcfcb1759bbbde6443e1fbcaf0711a05b70c8b95623286b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
908184792e7e784fa5a0f39c2ae79599

SHA1
871d7e022128c4ef13a0a7d7a1c7ba20a6080cc4

SHA256
d3e7a60e5d3b5932f20d54389f2f2ca8175bb1fe73d33100df1cb49e2196a9cd

SHA512
16097cbd347c1e3bb315afd5579c4988d7a00c69019e0c89b2ee0fa76fb7fd0613613d0591edcc2b1f8e69b408096131dd9e87c6fce2ddaa57bd7a7339b7f1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Infinity.exe

Filesize
19.0MB

MD5
4d77ee0e142482b95b81efc75c4d2b9f

SHA1
cea8614f8d036a6776c39fc913383033a7eb180c

SHA256
83da21a800ab3e66de37a8a4f79d3caf2ad319b43f1ef8e5d5c8bff89289dc9f

SHA512
cff263ec84d395b7007924f67b6c0013954bccedda7dce51e5a7cd99b1a54270133fe9d410fdfa7d3cfbf7d84cce3af76f88cf0000b829841f1a31398ddcbec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Desktop\ConvertSync.mp4

Filesize
609KB

MD5
0cbd9f6aea748f73514c0e1d5b2cb8eb

SHA1
92fca20227860ddfc5c894c8f091286a46389d35

SHA256
bea4446228509a570f86823b30a81bea0e7fa12aafc8a5c9cf417226c54b3882

SHA512
c8da6ea1a38ba741940bdb8ab2aced9736931db685c6da57005c89df70f7580318a67c4ba561fd600162114b860cda97489c5e2ad395c6e437d83815f7953fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Desktop\GetDebug.xls

Filesize
913KB

MD5
8245ad76cbd7823d9ef2d664b58522ff

SHA1
f45de0043dff122d03dfe68706032d9c580ddb22

SHA256
449f52dc33e36add0880dbf2e86817088e3779d3a0b3925da680a9d4659a53a0

SHA512
b2ecb300d8afeb93ae76b47c45b54022fbd812ddd39a3c3c99575ccdbcb0054be1df586e4db93a48c8827a7b0ca531c7d97e21884f7e83932d1db43fa2ed3b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Documents\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Documents\Files.docx

Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Documents\LimitDismount.xlsx

Filesize
1.1MB

MD5
3bd7abc7e1f5ac170ec790abd0370fe6

SHA1
438181d02e236f13b2ba53ef6047279255a35078

SHA256
93a84690760d20eb4d153612efd7791e05db70e39f02c93dce770c9ad093dc6b

SHA512
a34668a0540133fa4385c73e37537470cf47c4c802eb13652ba51cea71298987e532119835d6cdb03274787481a8bc9666f7e6f77b6fe04aba8c4ac572b69fea

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Documents\Opened.docx

Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Documents\Recently.docx

Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Documents\These.docx

Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Downloads\BackupLock.vst

Filesize
568KB

MD5
0ee6dfe697026f06a796ad279e640731

SHA1
628c3dd3540dd952bf8a277bc75f89aa91ed7af0

SHA256
06e226fa1dccc4b325040ee0b334e04cb49151a322103ebd747d78a4ee115e85

SHA512
8e86c03fcc8b46d3093d79fd487fce727dc76410c4c0d7ec133ecbcfdeb88f14cb7f37378d66860ec4d1206590c60fe8af577e57ac2927e80a6915705ec75bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Downloads\HideRestore.docx

Filesize
341KB

MD5
45e042541ef535527e11a2cf14f11d61

SHA1
4ed9c685edc8e3afe3f005ea858a2630098c78aa

SHA256
25e780cd1f90fdf0eaf1631da86868dcaade5c9438898d17bb67e3e8c4759053

SHA512
f50c5f47df42000afb08b37e2de36ccb01b5cc17127c0b4aa3337d3457c4c33ff67706a8d11c3911da9adf12650a8a2d816506e551de2882fee9e2fc3dea383a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Downloads\RenameResume.mp4

Filesize
837KB

MD5
24f5a6ae0bb4ec289caed7890ec88ab5

SHA1
71b4a64b2cf0d9e64d0fee93dcd476b6e42c0d9f

SHA256
9889338766159673628a2903522e8eff619433b7bf8b60d37874177902137086

SHA512
83c02e593d0d55387ae22e56dd60f87f2e90c3e3648843616eaa6d87bdc2034967cc9fde20f78825b974591c00836c220ca01d5838c6136a7db1ce59cac260f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Downloads\WaitUninstall.docx

Filesize
548KB

MD5
fddb9efe0fd0faa2746d035492ce6938

SHA1
f805af91f8284243877ede451f54807831c8f138

SHA256
996d603bb0676d39aa3423be85dccb0b0ba6e77c6c58625b6d66930cf29c8e29

SHA512
7d6ddb1346dbcedea49469535b442546380aa314de6df5daf1236ce80d05c937e7ec5f4f25295693979c35104f2162169ca884600643104474405d6af85ad236

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Pictures\DismountReset.jpeg

Filesize
1.0MB

MD5
89413b1da072f142f0deb52f4902e496

SHA1
a9adf1580e2fd1e8f9c3b63f46a6767f4b4625c3

SHA256
ea02c4d81fbf5dd9487643e23555024a1f5ddf5757958a898e7a45c6a5016291

SHA512
f88c44cab95ca223229ab4b2e8654352bc5d54252295f4077673095043db7ba439760c892765329639f5429aefe4b05ca8facd3ef35482bad2b91b2dfd36e92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByInfinity\Pictures\RevokeCheckpoint.png

Filesize
583KB

MD5
b4e600407a0aa4b46cbeeb55741ee011

SHA1
2d988d28684b4cefaee67e4f63a99140448a0ca6

SHA256
98fb85352ce911ad957ee199bbcae25987e180aba76ae140c681383a413ad39a

SHA512
26f9a81f21195331e7e0c7297e8d6b0094161fb327ed937dfed9d9d04e0a32e70b651edfaa089784cfd57ba94f0ad9cd1f306db7e590b5950a19f827ed8ace80

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_asyncio.pyd

Filesize
34KB

MD5
6de61484aaeedf539f73e361eb186e21

SHA1
07a6ae85f68ca9b7ca147bf587b4af547c28e986

SHA256
2c308a887aa14b64f7853730cb53145856bacf40a1b421c0b06ec41e9a8052ff

SHA512
f9c4a6e8d4c5cb3a1947af234b6e3f08c325a97b14adc371f82430ec787cad17052d6f879575fc574abb92fd122a3a6a14004dce80b36e6e066c6bc43607463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_bz2.pyd

Filesize
46KB

MD5
d584d4cfc04f616d406ec196997e706c

SHA1
b7fe2283e5b882823ee0ffcf92c4dd05f195dc4c

SHA256
e1ea9bb42b4184bf3ec29cbe10a6d6370a213d7a40aa6d849129b0d8ec50fda4

SHA512
ccf7cfbf4584401bab8c8e7d221308ca438779849a2eea074758be7d7afe9b73880e80f8f0b15e4dc2e8ae1142d389fee386dc58b603853760b0e7713a3d0b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_cffi_backend.cp310-win_amd64.pyd

Filesize
71KB

MD5
0d43a42cb44ecb9785ccc090a3de3d8f

SHA1
2f77cfa195cfe024d42e2ed287e2194685ec5d7d

SHA256
fdaa50a83947ec292e1773043f077cddfefbb52e53d5575b175eab5987de3242

SHA512
5968654a976699b4653d44912b34fc67a59d821d9e45f271d7d94b18b1a255c265f9e85460b570be04983b15268547a451e5385064616ab750b825b156c4643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_ctypes.pyd

Filesize
56KB

MD5
f0077496f3bb6ea93da1d7b5ea1511c2

SHA1
a901ad6e13c1568d023c0dcb2b7d995c68ed2f6a

SHA256
0269ae71e9a7b006aab0802e72987fc308a6f94921d1c9b83c52c636e45035a0

SHA512
4f188746a77ad1c92cefa615278d321912c325a800aa67abb006821a6bdffc145c204c9da6b11474f44faf23376ff7391b94f4a51e6949a1d2576d79db7f27ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_hashlib.pyd

Filesize
33KB

MD5
0d8ffe48eb5657e5ac6725c7be1d9aa3

SHA1
a39a3dc76f3c7a4b8645bb6c1dc34e50d7e9a287

SHA256
5ad4b3a6287b9d139063383e2bfdc46f51f6f3aaca015b59f9ed58f707fa2a44

SHA512
c26c277196395291a4a42e710af3560e168535e59b708b04343b4a0a926277a93e16fe24673903469b7c96545d6fbf036f149ef21231a759a13147d533d4fc3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_lzma.pyd

Filesize
84KB

MD5
213a986429a24c61eca7efed8611b28a

SHA1
348f47528a4e8d0a54eb60110db78a6b1543795e

SHA256
457114386ce08d81cb7ac988b1ff60d2fdffc40b3de6d023034b203582d32f5d

SHA512
1e43c2cacc819a2e578437d1329fa1f772fe614167d3ec9b5612b44f216175500e56e3d60a7107b66a5b3121e9e2e49344ebe9ff1b752cae574bb8b60eec42ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_overlapped.pyd

Filesize
30KB

MD5
b05bce7e8a1ef69679da7d1b4894208f

SHA1
7b2dd612cf76da09d5bd1a9dcd6ba20051d11595

SHA256
9c8edf15e9f0edbc96e3310572a231cdd1c57c693fbfc69278fbbc7c2fc47197

SHA512
27cef9b35a4560c98b4d72e5144a68d068263506ac97f5f813b0f6c7552f4c206c6f9a239bc1d9161aff79742cd4516c86f5997c27b1bd084e03854d6410b8e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_socket.pyd

Filesize
41KB

MD5
02adf34fc4cf0cbb7da84948c6e0a6ce

SHA1
4d5d1adaf743b6bd324642e28d78331059e3342b

SHA256
e92b5042b4a1ca76b84d3070e4adddf100ba5a56cf8e7fcd4dd1483830d786a5

SHA512
da133fc0f9fefed3b483ba782948fcdc508c50ffc141e5e1e29a7ec2628622cdd606c0b0a949098b48ee3f54cdb604842e3ca268c27bc23f169fced3d2fbd0a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_sqlite3.pyd

Filesize
48KB

MD5
b2b86c10944a124a00a6bcfaf6ddb689

SHA1
4971148b2a8d07b74aa616e2dd618aaf2be9e0db

SHA256
874783af90902a7a8f5b90b018b749de7ddb8ec8412c46f7abe2edfe9c7abe84

SHA512
0a44b508d2a9700db84bd395ff55a6fc3d593d2069f04a56b135ba41fc23ea7726ae131056123d06526c14284bce2dbadd4abf992b3eb27bf9af1e083763556f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\_ssl.pyd

Filesize
60KB

MD5
1af0fbf618468685c9a9541be14b3d24

SHA1
27e8c76192555a912e402635765df2556c1c2b88

SHA256
a46968ca76d6b17f63672a760f33664c3ea27d9356295122069e23d1c90f296a

SHA512
7382a0d3ec2ce560efd2ddd43db8423637af341ce6889d335165b7876b15d08f4de0f228f959dcb90b47814f9f4e0edd02d38a78ddad152ed7bc86791d46bc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\base_library.zip

Filesize
812KB

MD5
678d03034d0a29770e881bcb5ce31720

SHA1
a55befcf5cd76ceb98719bafc0e3dfb20c0640e3

SHA256
9c0e49af57460f5a550044ff40436615d848616b87cff155fcad0a7d609fd3cb

SHA512
19a6e2dc2df81ffc4f9af19df0a75cf2531ba1002dca00cd1e60bdc58ede08747dafa3778ab78781a88c93a3ece4e5a46c5676250ed624f70d8a38af2c75395f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\cryptography\hazmat\bindings\_rust.pyd

Filesize
2.0MB

MD5
29029cacb83854cc386584efd26b4ecf

SHA1
2e7b1bdb625184f1a814ad7c5b8b6a817c1a84cf

SHA256
b3906df5b31bf7f0604df4a449a67bd9aea37701e0c2d78a78ac0935a55c37e9

SHA512
fecd5368a51004685e78edc54d254e49c9361c588a0f2d4ea1de5971584d48d161fa88d46de22fabba7f6aef6c8b5d0fbcd2526a426d100c3a4d8933ed97e05d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\libcrypto-1_1.dll

Filesize
1.1MB

MD5
9c2ffedb0ae90b3985e5cdbedd3363e9

SHA1
a475fbe289a716e1fbe2eab97f76dbba1da322a9

SHA256
7c9418ad6fb6d15acb7d340b7a6533f76337ad302a18e2b4e08d4ee37689913a

SHA512
70d2635d42e24c7426cf5306ed010808f2222049915adb43ffc12c13259c8e7a9fee3a49e096d5ba2b6b733fef18574823d00df2e8d7fb1532e1d65d0c478008

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\libffi-7.dll

Filesize
23KB

MD5
8e1d2a11b94e84eaa382d6a680d93f17

SHA1
07750d78022d387292525a7d8385687229795cf1

SHA256
090a90cd17b74abefddf9f82d145effe5c676e7c62cf1a59834528f512d7ee82

SHA512
213bf92a707b14211941e5e071f1926be4b5795babc6df0d168b623ecd6cb7c7e0ae4320369c51d75c75b38ec282b5bf77f15eb94018ae74c8fd14f328b45a4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\libssl-1_1.dll

Filesize
203KB

MD5
87bb1a8526b475445b2d7fd298c57587

SHA1
aaad18ea92b132ca74942fd5a9f4c901d02d9b09

SHA256
c35a97d8f24ea84d1e39a8621b6b3027c9ac24885bdd37386c9fcaad1858419d

SHA512
956bd8e9f35c917cbfb570fc633bb2df0d1c2686731fa7179f5e7cd8789e665dd6ff8443e712eafa4e3f8d8661f933cb5675aeb1a2efc195c3bb32211e6d2506

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\multidict\_multidict.cp310-win_amd64.pyd

Filesize
20KB

MD5
d282e94282a608185de94e591889e067

SHA1
7d510c2c89c9bd5546cee8475e801df555e620bc

SHA256
84726536b40ff136c6d739d290d7660cd9514e787ab8cefbcbb7c3a8712b69aa

SHA512
e413f7d88dd896d387af5c3cfe3943ba794925c70ffb5f523a200c890bf9ceb6e4da74abe0b1b07d5e7818628cd9bc1f45ebc4e9d1e4316dd4ae27ea5f5450d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\python3.dll

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\python310.dll

Filesize
1.4MB

MD5
196deb9a74e6e9e242f04008ea80f7d3

SHA1
a54373ebad306f3e6f585bcdf1544fbdcf9c0386

SHA256
20b004bfe69166c4961fee93163e795746df39fb31dc67399c0fde57f551eb75

SHA512
8c226d3ef21f3ddeee14a098c60ef030fa78590e9505d015ce63ea5e5bbcea2e105ff818e94653df1bddc9ba6ed3b376a1dff5c19266b623fa22cd75ac263b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\select.pyd

Filesize
24KB

MD5
16be2c5990fe8df5a6d98b0ba173084d

SHA1
572cb2107ff287928501dc8f5ae4a748e911d82d

SHA256
65de0eb0f1aa5830a99d46a1b2260aaa0608ed28e33a4b0ffe43fd891f426f76

SHA512
afa991c407548da16150ad6792a5233688cc042585538d510ac99c2cb1a6ee2144f31aa639065da4c2670f54f947947860a90ec1bde7c2afaa250e758b956dbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\sqlite3.dll

Filesize
608KB

MD5
4357c9ab90f329f6cbc8fe6bc44a8a97

SHA1
2ec6992da815dcdb9a009d41d7f2879ea8f8b3f3

SHA256
eb1b1679d90d6114303f490de14931957cdfddf7d4311b3e5bacac4e4dc590ba

SHA512
a245971a4e3f73a6298c949052457fbaece970678362e2e5bf8bd6e2446d18d157ad3f1d934dae4e375ab595c84206381388fb6de6b17b9df9f315042234343a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\unicodedata.pyd

Filesize
287KB

MD5
d296d76daf56777da51fec9506d07c6a

SHA1
c012b7d74e68b126a5c20ac4f8408cebacbbf98d

SHA256
05201ceb3dba9395f6ac15a069d94720b9c2b5c6199447105e9bc29d7994c838

SHA512
15eed0ab1989e01b57e10f886a69a0cca2fff0a37cc886f4e3bc5c08684536cb61ff2551d75c62137c97aa455d6f2b99aab7ae339ea98870bb4116f63508deb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17242\yarl\_quoting_c.cp310-win_amd64.pyd

Filesize
40KB

MD5
50dee02b7fe56be5b7ae5bd09faa41ef

SHA1
69123e3aabd7070a551e44336f9ed83d96d333f8

SHA256
91067e48b7dff282a92995afaffff637f8a3b1164d05a25aea0393d5366c6b52

SHA512
7a67c23513a695b2fc527df264564ee08d29d98f0d99ff0700d1c54fbca0c519fa224fc2b5ff696cf016da9001e41842d35afb4fb4c06acf9e9aff08ca2d7dd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hjfjlapl.siw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\v4.56 Hack.rar

Filesize
20.0MB

MD5
fffa4667248f8adfb96d09bed4fe6e0e

SHA1
64aa2e119dec356bcc7177364d566e8d1137f47d

SHA256
115016f5ae9086484db680cdd696617a43628101bca60d1530b6ebf28d99ffc7

SHA512
5740c773d0826a662da10b76b923360a71b3d1c31a49f538b0a361a81b64371af761d137056f306ed28a8133d80aa0053ac315526725299251cdd71e428f35ed

Download Submit
C:\Users\Admin\Downloads\v4.56 Hack\Inzector_protected.exe

Filesize
15.1MB

MD5
4530073b72038f9e50f315ee341a331b

SHA1
240795dbaebaa8934d8d8a07609b6cc78675de4f

SHA256
3a230dc298c9f64320596e97f89e98d6a84f6bf3b9ab41cca29f3ff28f0343df

SHA512
8639eaed0c79c74360203389971ef88648afcb318d5d1ea6d81187d6b5ed1e779eb442bdd7737f4ecc6b17d4d65e86b86eb23fb46ff4889ba3934c52f19c86d7

Download Submit
\??\pipe\LOCAL\crashpad_4512_HHVTXGKMDKEBKQNB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4812-573-0x000001E31D860000-0x000001E31D861000-memory.dmp

Filesize
4KB

Download
memory/4812-570-0x000001E31D860000-0x000001E31D861000-memory.dmp

Filesize
4KB

Download
memory/4812-572-0x000001E31D860000-0x000001E31D861000-memory.dmp

Filesize
4KB

Download
memory/4812-571-0x000001E31D860000-0x000001E31D861000-memory.dmp

Filesize
4KB

Download
memory/4812-569-0x000001E31D860000-0x000001E31D861000-memory.dmp

Filesize
4KB

Download
memory/4812-565-0x000001E31D860000-0x000001E31D861000-memory.dmp

Filesize
4KB

Download
memory/4812-574-0x000001E31D860000-0x000001E31D861000-memory.dmp

Filesize
4KB

Download
memory/4812-564-0x000001E31D860000-0x000001E31D861000-memory.dmp

Filesize
4KB

Download
memory/4812-563-0x000001E31D860000-0x000001E31D861000-memory.dmp

Filesize
4KB

Download
memory/4812-575-0x000001E31D860000-0x000001E31D861000-memory.dmp

Filesize
4KB

Download
memory/5148-516-0x000002B5AB500000-0x000002B5AB522000-memory.dmp

Filesize
136KB

Download
memory/5336-396-0x00007FFA68320000-0x00007FFA68339000-memory.dmp

Filesize
100KB

Download
memory/5336-590-0x00007FFA57260000-0x00007FFA57318000-memory.dmp

Filesize
736KB

Download
memory/5336-456-0x00007FFA53460000-0x00007FFA5347E000-memory.dmp

Filesize
120KB

Download
memory/5336-455-0x00007FFA5EAB0000-0x00007FFA5EAC5000-memory.dmp

Filesize
84KB

Download
memory/5336-454-0x00007FFA68310000-0x00007FFA6831A000-memory.dmp

Filesize
40KB

Download
memory/5336-453-0x00007FFA53610000-0x00007FFA53985000-memory.dmp

Filesize
3.5MB

Download
memory/5336-452-0x00007FFA688F0000-0x00007FFA688FE000-memory.dmp

Filesize
56KB

Download
memory/5336-451-0x00007FFA57260000-0x00007FFA57318000-memory.dmp

Filesize
736KB

Download
memory/5336-450-0x00007FFA5EAD0000-0x00007FFA5EAFE000-memory.dmp

Filesize
184KB

Download
memory/5336-508-0x00007FFA69B90000-0x00007FFA69B9D000-memory.dmp

Filesize
52KB

Download
memory/5336-448-0x00007FFA534D0000-0x00007FFA534E5000-memory.dmp

Filesize
84KB

Download
memory/5336-449-0x00007FFA53480000-0x00007FFA534C1000-memory.dmp

Filesize
260KB

Download
memory/5336-430-0x00007FFA69010000-0x00007FFA69020000-memory.dmp

Filesize
64KB

Download
memory/5336-429-0x00007FFA68580000-0x00007FFA68599000-memory.dmp

Filesize
100KB

Download
memory/5336-428-0x00007FFA5EAB0000-0x00007FFA5EAC5000-memory.dmp

Filesize
84KB

Download
memory/5336-525-0x00007FFA534F0000-0x00007FFA53608000-memory.dmp

Filesize
1.1MB

Download
memory/5336-553-0x00007FFA56E90000-0x00007FFA56EB2000-memory.dmp

Filesize
136KB

Download
memory/5336-560-0x00007FFA69B90000-0x00007FFA69B9D000-memory.dmp

Filesize
52KB

Download
memory/5336-559-0x00007FFA53460000-0x00007FFA5347E000-memory.dmp

Filesize
120KB

Download
memory/5336-556-0x00007FFA53480000-0x00007FFA534C1000-memory.dmp

Filesize
260KB

Download
memory/5336-555-0x00007FFA534D0000-0x00007FFA534E5000-memory.dmp

Filesize
84KB

Download
memory/5336-554-0x00007FFA546D0000-0x00007FFA546E3000-memory.dmp

Filesize
76KB

Download
memory/5336-549-0x00007FFA69010000-0x00007FFA69020000-memory.dmp

Filesize
64KB

Download
memory/5336-534-0x00007FFA54090000-0x00007FFA544FE000-memory.dmp

Filesize
4.4MB

Download
memory/5336-542-0x00007FFA56EC0000-0x00007FFA57031000-memory.dmp

Filesize
1.4MB

Download
memory/5336-541-0x00007FFA67B20000-0x00007FFA67B3F000-memory.dmp

Filesize
124KB

Download
memory/5336-535-0x00007FFA69130000-0x00007FFA69154000-memory.dmp

Filesize
144KB

Download
memory/5336-548-0x00007FFA5EAB0000-0x00007FFA5EAC5000-memory.dmp

Filesize
84KB

Download
memory/5336-433-0x00007FFA692E0000-0x00007FFA692ED000-memory.dmp

Filesize
52KB

Download
memory/5336-435-0x00007FFA5EA90000-0x00007FFA5EAA4000-memory.dmp

Filesize
80KB

Download
memory/5336-441-0x000001353FA20000-0x0000013540114000-memory.dmp

Filesize
7.0MB

Download
memory/5336-444-0x00007FFA67B20000-0x00007FFA67B3F000-memory.dmp

Filesize
124KB

Download
memory/5336-445-0x00007FFA56EC0000-0x00007FFA57031000-memory.dmp

Filesize
1.4MB

Download
memory/5336-446-0x00007FFA56E90000-0x00007FFA56EB2000-memory.dmp

Filesize
136KB

Download
memory/5336-443-0x00007FFA534F0000-0x00007FFA53608000-memory.dmp

Filesize
1.1MB

Download
memory/5336-438-0x00007FFA57240000-0x00007FFA57254000-memory.dmp

Filesize
80KB

Download
memory/5336-440-0x00007FFA68170000-0x00007FFA6819D000-memory.dmp

Filesize
180KB

Download
memory/5336-420-0x00007FFA5EAD0000-0x00007FFA5EAFE000-memory.dmp

Filesize
184KB

Download
memory/5336-576-0x00007FFA534D0000-0x00007FFA534E5000-memory.dmp

Filesize
84KB

Download
memory/5336-588-0x00007FFA5EAD0000-0x00007FFA5EAFE000-memory.dmp

Filesize
184KB

Download
memory/5336-577-0x00007FFA54090000-0x00007FFA544FE000-memory.dmp

Filesize
4.4MB

Download
memory/5336-596-0x00007FFA56E90000-0x00007FFA56EB2000-memory.dmp

Filesize
136KB

Download
memory/5336-591-0x00007FFA5EAB0000-0x00007FFA5EAC5000-memory.dmp

Filesize
84KB

Download
memory/5336-447-0x00007FFA546D0000-0x00007FFA546E3000-memory.dmp

Filesize
76KB

Download
memory/5336-589-0x00007FFA53610000-0x00007FFA53985000-memory.dmp

Filesize
3.5MB

Download
memory/5336-422-0x00007FFA53610000-0x00007FFA53985000-memory.dmp

Filesize
3.5MB

Download
memory/5336-423-0x00007FFA69130000-0x00007FFA69154000-memory.dmp

Filesize
144KB

Download
memory/5336-421-0x00007FFA57260000-0x00007FFA57318000-memory.dmp

Filesize
736KB

Download
memory/5336-419-0x00007FFA54090000-0x00007FFA544FE000-memory.dmp

Filesize
4.4MB

Download
memory/5336-412-0x00007FFA67A20000-0x00007FFA67A58000-memory.dmp

Filesize
224KB

Download
memory/5336-409-0x000001353FA20000-0x0000013540114000-memory.dmp

Filesize
7.0MB

Download
memory/5336-408-0x000001353FA20000-0x0000013540114000-memory.dmp

Filesize
7.0MB

Download
memory/5336-389-0x00007FFA68580000-0x00007FFA68599000-memory.dmp

Filesize
100KB

Download
memory/5336-404-0x00007FFA56EC0000-0x00007FFA57031000-memory.dmp

Filesize
1.4MB

Download
memory/5336-403-0x00007FFA67B20000-0x00007FFA67B3F000-memory.dmp

Filesize
124KB

Download
memory/5336-398-0x00007FFA68170000-0x00007FFA6819D000-memory.dmp

Filesize
180KB

Download
memory/5336-392-0x00007FFA692E0000-0x00007FFA692ED000-memory.dmp

Filesize
52KB

Download
memory/5336-386-0x00007FFA6E4E0000-0x00007FFA6E4EF000-memory.dmp

Filesize
60KB

Download
memory/5336-384-0x00007FFA69130000-0x00007FFA69154000-memory.dmp

Filesize
144KB

Download
memory/5336-376-0x00007FFA54090000-0x00007FFA544FE000-memory.dmp

Filesize
4.4MB

Download
memory/5336-847-0x00007FFA54090000-0x00007FFA544FE000-memory.dmp

Filesize
4.4MB

Download
memory/5336-849-0x00007FFA5EA90000-0x00007FFA5EAA4000-memory.dmp

Filesize
80KB

Download
memory/5336-854-0x00007FFA546D0000-0x00007FFA546E3000-memory.dmp

Filesize
76KB

Download
memory/5336-859-0x00007FFA69B90000-0x00007FFA69B9D000-memory.dmp

Filesize
52KB

Download
memory/5336-858-0x00007FFA534F0000-0x00007FFA53608000-memory.dmp

Filesize
1.1MB

Download
memory/5336-857-0x00007FFA53460000-0x00007FFA5347E000-memory.dmp

Filesize
120KB

Download
memory/5336-856-0x00007FFA688F0000-0x00007FFA688FE000-memory.dmp

Filesize
56KB

Download
memory/5336-855-0x00007FFA67A20000-0x00007FFA67A58000-memory.dmp

Filesize
224KB

Download
memory/5336-853-0x00007FFA56E90000-0x00007FFA56EB2000-memory.dmp

Filesize
136KB

Download
memory/5336-852-0x00007FFA68310000-0x00007FFA6831A000-memory.dmp

Filesize
40KB

Download
memory/5336-851-0x00007FFA57240000-0x00007FFA57254000-memory.dmp

Filesize
80KB

Download
memory/5336-850-0x000001353FA20000-0x0000013540114000-memory.dmp

Filesize
7.0MB

Download
memory/5336-848-0x00007FFA5EAB0000-0x00007FFA5EAC5000-memory.dmp

Filesize
84KB

Download
memory/5336-846-0x00007FFA57260000-0x00007FFA57318000-memory.dmp

Filesize
736KB

Download
memory/5336-845-0x00007FFA5EAD0000-0x00007FFA5EAFE000-memory.dmp

Filesize
184KB

Download
memory/5336-844-0x00007FFA53480000-0x00007FFA534C1000-memory.dmp

Filesize
260KB

Download
memory/5336-843-0x00007FFA534D0000-0x00007FFA534E5000-memory.dmp

Filesize
84KB

Download
memory/5336-842-0x00007FFA69010000-0x00007FFA69020000-memory.dmp

Filesize
64KB

Download
memory/5336-841-0x00007FFA56EC0000-0x00007FFA57031000-memory.dmp

Filesize
1.4MB

Download
memory/5336-840-0x00007FFA67B20000-0x00007FFA67B3F000-memory.dmp

Filesize
124KB

Download
memory/5336-839-0x00007FFA68170000-0x00007FFA6819D000-memory.dmp

Filesize
180KB

Download
memory/5336-838-0x00007FFA68320000-0x00007FFA68339000-memory.dmp

Filesize
100KB

Download
memory/5336-837-0x00007FFA692E0000-0x00007FFA692ED000-memory.dmp

Filesize
52KB

Download
memory/5336-836-0x00007FFA68580000-0x00007FFA68599000-memory.dmp

Filesize
100KB

Download
memory/5336-835-0x00007FFA6E4E0000-0x00007FFA6E4EF000-memory.dmp

Filesize
60KB

Download
memory/5336-834-0x00007FFA69130000-0x00007FFA69154000-memory.dmp

Filesize
144KB

Download
memory/5336-833-0x00007FFA53610000-0x00007FFA53985000-memory.dmp

Filesize
3.5MB

Download