hxxps://gofile[.]io/d/WAHqqV

Analysis

max time kernel
339s
max time network
317s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04/06/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/WAHqqV

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\blackmailprogram.exe	blackmailprogram.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\blackmailprogram.exe	blackmailprogram.exe

Executes dropped EXE 6 IoCs

pid	Process
4152	blackmailprogram.exe
1160	blackmailprogram.exe
4560	blackmailprogram.exe
1144	blackmailprogram.exe
6108	blackmailprogram.exe
1104	blackmailprogram.exe

Loads dropped DLL 64 IoCs

pid	Process
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe
1160	blackmailprogram.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
117	discord.com
106	discord.com
107	discord.com
110	discord.com

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "233"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 9c5c3eb4b2b6da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a956c8afb2b6da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "1414"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "1305"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "23"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "1305"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e143b5afb2b6da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 397132b4b2b6da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "1515"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "124"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\blackmailprogram.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe
4684	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4684	taskmgr.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1800	MicrosoftEdgeCP.exe
1800	MicrosoftEdgeCP.exe
1800	MicrosoftEdgeCP.exe
1800	MicrosoftEdgeCP.exe
1800	MicrosoftEdgeCP.exe
1800	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4040	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4040	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4040	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1016	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1016	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3036	firefox.exe
Token: SeDebugPrivilege	3036	firefox.exe
Token: SeDebugPrivilege	5000	MicrosoftEdge.exe
Token: SeDebugPrivilege	5000	MicrosoftEdge.exe
Token: SeDebugPrivilege	1160	blackmailprogram.exe
Token: SeDebugPrivilege	1144	blackmailprogram.exe
Token: SeDebugPrivilege	700	taskmgr.exe
Token: SeSystemProfilePrivilege	700	taskmgr.exe
Token: SeCreateGlobalPrivilege	700	taskmgr.exe
Token: 33	700	taskmgr.exe
Token: SeIncBasePriorityPrivilege	700	taskmgr.exe
Token: SeDebugPrivilege	1104	blackmailprogram.exe
Token: SeDebugPrivilege	4716	taskmgr.exe
Token: SeSystemProfilePrivilege	4716	taskmgr.exe
Token: SeCreateGlobalPrivilege	4716	taskmgr.exe
Token: 33	4716	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4716	taskmgr.exe
Token: SeDebugPrivilege	4684	taskmgr.exe
Token: SeSystemProfilePrivilege	4684	taskmgr.exe
Token: SeCreateGlobalPrivilege	4684	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3036	firefox.exe
3036	firefox.exe
3036	firefox.exe
3036	firefox.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3036	firefox.exe
3036	firefox.exe
3036	firefox.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
700	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5000	MicrosoftEdge.exe
1800	MicrosoftEdgeCP.exe
4040	MicrosoftEdgeCP.exe
1800	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe
5000	MicrosoftEdge.exe
5000	MicrosoftEdge.exe
3036	firefox.exe
3036	firefox.exe
3036	firefox.exe
3036	firefox.exe
3036	firefox.exe
3036	firefox.exe
3036	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3244	1800	MicrosoftEdgeCP.exe	76
PID 1800 wrote to memory of 3244	1800	MicrosoftEdgeCP.exe	76
PID 1800 wrote to memory of 3244	1800	MicrosoftEdgeCP.exe	76
PID 1800 wrote to memory of 3244	1800	MicrosoftEdgeCP.exe	76
PID 1800 wrote to memory of 3244	1800	MicrosoftEdgeCP.exe	76
PID 1800 wrote to memory of 3244	1800	MicrosoftEdgeCP.exe	76
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 4072 wrote to memory of 3036	4072	firefox.exe	86
PID 3036 wrote to memory of 4520	3036	firefox.exe	87
PID 3036 wrote to memory of 4520	3036	firefox.exe	87
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88
PID 3036 wrote to memory of 4024	3036	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://gofile.io/d/WAHqqV"
1⤵
PID:3192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5000

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:316

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4040

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3244

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4960

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.0.522185964\1668880227" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1460 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa91abde-5bea-4c77-97e9-5174b61b01b9} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 1780 1fb50af3c58 gpu
    3⤵
    PID:4520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.1.1604748079\657480320" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33952251-1eb5-4dc5-8d34-3f321060ee7d} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 2136 1fb50a04458 socket
    3⤵
    - Checks processor information in registry
    PID:4024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.2.805913690\1804404708" -childID 1 -isForBrowser -prefsHandle 2888 -prefMapHandle 2788 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0227a5d0-2c27-43d2-9453-19f65895a14c} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 2756 1fb548e3758 tab
    3⤵
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.3.1255878848\1627478928" -childID 2 -isForBrowser -prefsHandle 3592 -prefMapHandle 3588 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c20c6d24-bbac-4dda-b748-7311dc557176} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 3604 1fb45a65f58 tab
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.4.277261242\1531269876" -childID 3 -isForBrowser -prefsHandle 4272 -prefMapHandle 4268 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4853466-647e-4d3e-8ad8-a11141933545} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 4284 1fb56a9f858 tab
    3⤵
    PID:5880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.5.1013644763\553170516" -childID 4 -isForBrowser -prefsHandle 4792 -prefMapHandle 4712 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ca8b13a-85cc-4172-a2a9-c77f628b4a56} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 4800 1fb56a9d458 tab
    3⤵
    PID:5360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.6.379114689\280106637" -childID 5 -isForBrowser -prefsHandle 4932 -prefMapHandle 4936 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec033c10-a077-469b-a73e-8581eb1c19ca} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 4920 1fb57156d58 tab
    3⤵
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.7.1356332287\94208419" -childID 6 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f2d6e39-d06f-4064-bf54-7f1b6d54501a} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 5080 1fb57775d58 tab
    3⤵
    PID:5440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.8.341273019\1396658075" -childID 7 -isForBrowser -prefsHandle 5664 -prefMapHandle 5660 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18c0f4ef-262f-4c5c-891b-1117d8aace52} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 5672 1fb5867e358 tab
    3⤵
    PID:2684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.9.1636650981\731567762" -childID 8 -isForBrowser -prefsHandle 5876 -prefMapHandle 5872 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e838453-374c-46c1-b6fe-22d2192f46c1} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 5884 1fb548e5b58 tab
    3⤵
    PID:5584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1796

C:\Users\Admin\Downloads\blackmailprogram.exe
"C:\Users\Admin\Downloads\blackmailprogram.exe"
1⤵
- Executes dropped EXE
PID:4152
- C:\Users\Admin\Downloads\blackmailprogram.exe
  "C:\Users\Admin\Downloads\blackmailprogram.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1160

C:\Users\Admin\Downloads\blackmailprogram.exe
"C:\Users\Admin\Downloads\blackmailprogram.exe"
1⤵
- Executes dropped EXE
PID:4560
- C:\Users\Admin\Downloads\blackmailprogram.exe
  "C:\Users\Admin\Downloads\blackmailprogram.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1144

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:700

C:\Users\Admin\Downloads\blackmailprogram.exe
"C:\Users\Admin\Downloads\blackmailprogram.exe"
1⤵
- Executes dropped EXE
PID:6108
- C:\Users\Admin\Downloads\blackmailprogram.exe
  "C:\Users\Admin\Downloads\blackmailprogram.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1104

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4716

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XCFODRP5\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\Y3KUJMYI\favicon16[1].png

Filesize
503B

MD5
ad98355e85075a8ebc15a01f875e1aab

SHA1
de8398fdfeb3bbd48a58a8b12453e1fee61e5f2d

SHA256
6a437098dcbb8a0354ae28a5f7825685f471c13cecb83186cc950844df7c76c4

SHA512
1b5d5402256ec3ccc20f1b1b635a9ea16131c2aec49c94105c8b7d3e32c9bfd45e937bde8af35ced6b22f39526de2672ba145ec43f49aba4d7a66da79e13819a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF5232B4E93DE76F86.TMP

Filesize
16KB

MD5
e2d4abf5f83ed089b08d3d40d8cb7b3f

SHA1
c0402227681926b19de6f0b44b7d4729f68b28d8

SHA256
fd921b9c2c73f30af13546f0bec2b1393c544b31c6345360b4f82ca07118687e

SHA512
1412def1782afaa1b41f28d412c488f19e4137661b00a7600db194dcc9e04414685ab110c642fe3770bc3958dbaa9113e0cccdbbb56bf9f1854e4b47bebe1006

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_asyncio.pyd

Filesize
63KB

MD5
7493f806acd8a867d90375362f8eed87

SHA1
d82ec9650a7fee1955078c42d7286f9d2b0026ff

SHA256
d1f458227ecf60d389145175fa0b61656ecac2fb80d9bb89e04cdf273e67c543

SHA512
e1139da5b0cdbebfc33e90c7617cc57e676c90e3d00236aaefc1aafa1c0247812b4ef2b605943810f41ebada5da7f2f24c998a8e07687cb1a3c89aa88e3ac7cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_cffi_backend.cp39-win_amd64.pyd

Filesize
177KB

MD5
f3f610b10a640a09b423e1c7e327cad1

SHA1
007bf7000df98e4591bdbfc75e7a363457c692fd

SHA256
d112ae33247d896008d79a1a5f96b98d0eaee80d13372e64c2d88ffbd94fadf8

SHA512
28726490d1026ad6f2bbad949b247f904e4ceceef7011e7408c11e4fab886e77e84317e7a14e3e86c1b7178666b06e0a774734a497f91afff76882756e03b6b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_ctypes.pyd

Filesize
123KB

MD5
b74f6285a790ffd7e9ec26e3ab4ca8df

SHA1
7e023c1e4f12e8e577e46da756657fd2db80b5e8

SHA256
c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a

SHA512
3a700638959cbd88e8a36291af954c7ccf00f6101287fc8bd3221ee31bd91b7bd1830c7847d8c2f4f07c94bc233be32a466b915283d3d2c66abed2c70570c299

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_decimal.pyd

Filesize
265KB

MD5
56302e90bc4fb799e094987f4556fc0f

SHA1
3ddb8b77676545905aadef5ba73583c4b904824b

SHA256
17f43bf9552fcf8194f4b32909beffa4238b76866f7dd50f4b70de799362f66c

SHA512
af962aeef8052f5a90855ce0fd6c99862a8a72f649331896737d57d67ccd400f92aec12f5ab958fb08ff101b606a82fe0cd307287616297a37e4532fa5fe657b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_hashlib.pyd

Filesize
64KB

MD5
60f420a9a606e2c95168d25d2c1ac12e

SHA1
1e77cf7de26ed75208d31751fe61da5eddbbaf12

SHA256
8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c

SHA512
aaf768176cf034004a6d13370b11f0e4bbf86b9b76de7fa06d0939e98915607d504e076ad8adb1a0ebfb6fd021c51764a772f8af6af7f6d15b0d376448aba1a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_multiprocessing.pyd

Filesize
29KB

MD5
2f9db319a0a37d7fa97f46f926132654

SHA1
8b1d25e5d2aa17717338d62ebbe78fb100ac8342

SHA256
ba672c65a51074505796efb52bf343f9d725e90106dacfd4441105d428457cc6

SHA512
12537a6b346eae952e0015ddad11654486d663a0ef3e05352492ce6ecf0d901b19a3fcc0b1b4b1e25a3e74a560235ae834c12db941afbaa825bcc19b52b282ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_overlapped.pyd

Filesize
45KB

MD5
e648ac1da13b47cd757b8ca5392e1e28

SHA1
1a16400c188a90b7d019364b3864d044155ab7b2

SHA256
c67bf0303c504f3605a6d4c396a1e30e35b64d1a1e39dd36943d8cc7f69a6097

SHA512
717f258d5a791359195856b9507dc7ca1403f424964490484fc9ffbcf42de451251764441cd5e4e9dd6b9bf51f6b035e79f1110c6ac5a8d0bae3d4589084846f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_queue.pyd

Filesize
28KB

MD5
34537f5b9da004c623a61911e19cbee5

SHA1
9d78f6cd2960c594ec98e837d992c08751c61d51

SHA256
a7cdedaa58c7ba9aba98193fce599598d2cd35ed9c80d1ad7fc9e6182c9a25d5

SHA512
70bf8e8e3216050e8519b683097e958f1fcba60333eb1f18e3736bbcc195d0fad6657b24e4c3902d24b84a462c35a560eb4c7b8a15f7123249c0770143b67467

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_ssl.pyd

Filesize
150KB

MD5
66172f2e3a46d2a0f04204d8f83c2b1e

SHA1
e74fee81b719effc003564edb6b50973f7df9364

SHA256
2b16154826a417c41cda72190b0cbcf0c05c6e6fe44bf06e680a407138402c01

SHA512
123b5858659b8a0ac1c0d43c24fbb9114721d86a2e06be3521ad0ed44b2e116546b7b6332fd2291d692d031ec598e865f476291d3f8f44131aacc8e7cf19f283

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_tkinter.pyd

Filesize
63KB

MD5
426a61990ded0d75ec892b475888caa3

SHA1
a382595a3481949ecd9d88683f585b1d95d285e4

SHA256
7b42c10c651931b8984e4797fc713656bcce4db420197881f9d9946daad0cf6a

SHA512
eb23ae788178f9a26a2254db79abe8ddb8a12ba8b188a473a59eaa7574883452b79e2dee792598d8f3f03893448d7edcdc9b22c2b5f728a4a7a71380877000ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\_uuid.pyd

Filesize
22KB

MD5
1c76a51dd15102e04b95ce6f53c28ec3

SHA1
57897767fcdad111171ccaf9e6cf581fd968fab5

SHA256
cb195b5aae6a7969174e8c7c6f9e2b40683190f6b4e410233022df1b6dade731

SHA512
f39668a7683f22c8baede141c3e0624c90a2fd8ade92ac4aa2950090dfdf02e611af998caad3de783f215877b8951f8b22afaef3b2b0bcce7e294eb70d176e55

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\base_library.zip

Filesize
822KB

MD5
8c6e026e2e7867af97d5231b86cb35d4

SHA1
46f7b262d82ec044cb68b4f81fdba5775e7d4499

SHA256
2c4921453ef057ce597c793a0a229e3107acf015192b779a8f96e35c72eb735f

SHA512
021f70dc6ce4de9ebb400b9ca198ed8e0a1dc70b838c61a5748cf7070d0390954b899a3c9361e5242f21c286defd5492d7647471266d569babffb8e48698a554

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\cv2\__init__.py

Filesize
6KB

MD5
eab99b31f1fd18e46e6e081ba3b5c06e

SHA1
9ca76b1097d58ef9c652aebfbeff32bfec17b25b

SHA256
b05b8000c71987cd4df824c1ed134b7fcd34617665e437b1aaec128f93d7f1c3

SHA512
7c4ea4a28f7876249b503155187bd59bcd9cf18a80264c8892e59e9fd7f3d461c91afc4c3c177dba48e1dfdd0feb5705b54b504f7daa886a2a0b72fddd1e80fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\libcrypto-1_1.dll

Filesize
3.2MB

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll

Filesize
36.4MB

MD5
5e46c3d334c90c3029eb6ae2a3fe58f2

SHA1
ad3d806f720289ccb90ce8bfd0da49fa99e7777b

SHA256
57b87772bf676b5c2d718c79dddc9f039d79ec3319fee1398cc305adff7b69e5

SHA512
4bd29d19b619076a64a928f3871edcce8416bcf100c1aa1250932479d6536d9497f2f9a2668c90b3479d0d4ab4234ffa06f81bc6b107fad1be5097fa2b60ab28

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\python3.DLL

Filesize
58KB

MD5
eb0a803cf72653c78fe900551f961da4

SHA1
d76cb52625e9cf88c588c34ba1759d8987acc8e7

SHA256
e9e4a9b271b692c331dc091825ac1ff51b01cd159f2e5c2553756c79ff272fa2

SHA512
2d77a84fe905d969f1789764a4138f6c461bff44bc264bf1883883cacec35d6e98abce1129312119eb2f8aca2ad6a899e6956c7287ae5b83430cea3f5e845697

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\pywin32_system32\pywintypes39.dll

Filesize
131KB

MD5
f20fd2e2ac9058a9fd227172f8ff2c12

SHA1
89eba891352be46581b94a17db7c2ede9a39ab01

SHA256
20bde8e50e42f7aabf59106eea238fcc0dece0c6e362c0a7feeb004ab981db8a

SHA512
42a86fa192aea7adb4283dc48a323a4f687dad40060ea3ffddcd8fd7670bb535d31a7764706e5c5473da28399fec048ae714a111ee238bb25e1aad03e12078d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\tcl86t.dll

Filesize
1.6MB

MD5
c0b23815701dbae2a359cb8adb9ae730

SHA1
5be6736b645ed12e97b9462b77e5a43482673d90

SHA256
f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768

SHA512
ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\tcl\encoding\cp1252.enc

Filesize
1KB

MD5
5900f51fd8b5ff75e65594eb7dd50533

SHA1
2e21300e0bc8a847d0423671b08d3c65761ee172

SHA256
14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0

SHA512
ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\tk86t.dll

Filesize
1.4MB

MD5
fdc8a5d96f9576bd70aa1cadc2f21748

SHA1
bae145525a18ce7e5bc69c5f43c6044de7b6e004

SHA256
1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5

SHA512
816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\unicodedata.pyd

Filesize
1.1MB

MD5
5753efb74fcb02a31a662d9d47a04754

SHA1
e7bf5ea3a235b6b661bf6d838e0067db0db0c5f4

SHA256
9be2b4c7db2c3a05ec3cbd08970e622fcaeb4091a55878df12995f2aeb727e72

SHA512
86372016c3b43bfb85e0d818ab02a471796cfad6d370f88f54957dfc18a874a20428a7a142fcd5a2ecd4a61f047321976af736185896372ac8fd8ca4131f3514

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41522\win32\win32api.pyd

Filesize
130KB

MD5
05e4b3b876e5fa6a2b8951f764559623

SHA1
4ad50f70eef4feaa9d051c2f161fbac8a862a4bc

SHA256
a52f8bd28b5b9558cde10333ce452a7d6f338ce1005a2b8451755005868e4a98

SHA512
5648306af7c056c9250731b7d5a508664294bbb8ba865f9dc06fd7216adf7b8cc31b1cfbc0175c7f2752680744f6546a1959e7f7d1ec7a8a845f75642ce034d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45602\pip-24.0.dist-info\top_level.txt

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI61082\tcl\encoding\euc-cn.enc

Filesize
83KB

MD5
9a60e5d1ab841db3324d584f1b84f619

SHA1
bccc899015b688d5c426bc791c2fcde3a03a3eb5

SHA256
546392237f47d71cee1daa1aae287d94d93216a1fabd648b50f59ddce7e8ae35

SHA512
e9f42b65a8dfb157d1d3336a94a83d372227baa10a82eb0c6b6fb5601aa352a576fa3cdfd71edf74a2285abca3b1d3172bb4b393c05b3b4ab141aaf04b10f426

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
b5f67e89c84c35473548e444cd053b80

SHA1
1a88732b901057bcb3c610f9de41d30246dac077

SHA256
db7b7d051a66905838fb2b8404c9c1c5554e093519fed76b079f741e6d5f1c10

SHA512
5e02c327f63cffee0c07c19c166a9417cc22cc558d60180afa62bb4ee0fcba2904a64b99ddfb7d71dc297ea140853c452dc4e730858311d7781f234b80f01ae0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
5KB

MD5
bf983404783e557e5464eb630414e329

SHA1
73e7e142d02b382706807e8c84938a397397dd8f

SHA256
b909d9e40e7079df9f5f358848aa5043c1f9871bb0b0cf4438a279a32b3a2c19

SHA512
cc7791dfab64e507ea829207e814664587d36a45c2aacc45ce5f4ffec885891cbe3a4b744e6aadcf8f95ebc8c756b025dc15309de157bb699b2702b14a4f601f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\bd0903e3-25ea-44e3-9df6-1fbc70ab9fce

Filesize
746B

MD5
d648168a1980766bcaeee24e4a95b590

SHA1
8fb2d561257bb3083e5e4f16f5129ddf6e7f3cad

SHA256
a50b250a442eb5bb1bcaed02ff5aa6f3308732a48820bcb7f4393dfe509ef242

SHA512
77afe7710508a902357d32927af68a26f50d61b38b97b6c29de5902c687b0d0b3c67f7780591d44a76b62ac048053ae52aead01c6b6b07c7b1fa9ae74c459208

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\e2ef9db9-e85d-4e30-a762-8d53a2eb8508

Filesize
10KB

MD5
9f1b3b55ed4de8e7b93ca7556de78c6f

SHA1
5d4f2c674a6204a47e3763a744b721122d9f4768

SHA256
1a01397ece19cb23e6c0986a163fd8414c1b56db1fa5a1675819ab1d55b88763

SHA512
bf8122f3d242143aa45bf763371ecd263189dcd52244eff3fb62f888eccdd133a62fcbcccfd34d6bedac4ed0d1bb9e6310354c7310ea4add59c0e656a5d17aea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
8d1b2a8f9f97a7ac247a9c6fd88debc3

SHA1
ef8aa113094f701d8cd6278acffef76e50195fa3

SHA256
b2c6d23177857ae29c75c5d7150e8b262ca1c65e765436a372d6ab3642303609

SHA512
ea9c3935844f1586ba6e4ee1486d13a336129da8f7effde744b6de4527b0fd6b8de3372a7948d0896ce4d5d58494340bc1e06e0fde3ce4fe130c6d07749e4b7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
edae3827167fbf36bd79d604d191f011

SHA1
b015d433af432ae05a843f13c1eda80992258b24

SHA256
354bb8a2467543d8241a366011455d2b53e69a36a199df9f70b8edfe084e1c33

SHA512
01ff1125df840966e6ebef8ffa44a93cb58804af2514bbfa28ae5a71b2139fb05f9a6927587457ec3a40040879d711d113e2e810f86c2d992af26ae52e818148

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
49ca9759bc97e6afdee908f92bb1836b

SHA1
5d71d31689feaa51d3100da68f494a82edf9843b

SHA256
4ea11e27df769506606acde165e538cd1b15a235c55c7e73b09b35c02749a9c5

SHA512
24f6d896c6a927329a5ab9057d3842c4099c3b5b93f46753cfd7678fe8612346da5c0b5d87c05f2155000f3e4d3430b178f15ef8487ad573d006ebe5683074ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
75e7dc5571a3410d9bbe4e8418f5c234

SHA1
483ca34e440d26b9684d07ff745565763be48334

SHA256
397075758ed4cc1e86ce75906920f3f258b0d0fd32d6e98de527e0011d0a96a6

SHA512
08fe3562bfcf2de33690bc4d24a8d247267dcfbf7952df5b454ebd218438f9560d7a6af573b3424c874e5b77d1d3a1fbffb66a03f2fc34768261589f15c62e46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
392a1e84d5b38f1a052502da5a6165b4

SHA1
8a20e6b42f937acbe722fa0958673a215a987ff5

SHA256
70efe59cced9d93921859dab58a8518e52904aff0fa9c5cd8893b40ed1d854ae

SHA512
e1ae476049d96c8ada2205fe12882f71d398e8f11b512816b4f54453ed3d5e0552105ad3352e667782d7155cd049192fa37e8b49a8a55bebf6fdccf4d3f3ea8f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
7f868e557b098795d645df9ea302427f

SHA1
001f3306144559b4049a8ab139b4139f51e59c0e

SHA256
b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5

SHA512
56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a

Download Submit
C:\Users\Admin\Downloads\blackmailprogram.pXmK-Hrs.exe.part

Filesize
8KB

MD5
83c5d182c981265ac8929786a5750b01

SHA1
9f08014c402803a5ec1124b8c132de3961db4b05

SHA256
dd1dba2a2acbc8745248a3cf14ca7f9eb70e6b12f7df9619b7bca1d4b94b9353

SHA512
d42d9ec31631448be8faf494235f69a272fdefb720dab1e9d8eaae2a934f73b9c152d756221902db816742874556c23ac620a7a23bd0ecb982e0c3e7ee188e57

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\PIL\_imaging.cp39-win_amd64.pyd

Filesize
2.2MB

MD5
233e5ac5bc5a7d60d240136a90985fd4

SHA1
5d69e021b2260c906f7cc5c1a5a92a488dd20853

SHA256
5dcfcb0cae3406d2efb4c008f0b58868060ba73f441402884b54735f8ff2918a

SHA512
d71f5858dc7626714cc0f182953ca0ab60247152cdbfa33283d86bcb30c4ef4e2ea2d1ac47e687bd1a9e81e0fd4bf3e149f4f4cf2135097e9d4baa8cff8968f7

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\VCRUNTIME140.dll

Filesize
91KB

MD5
7942be5474a095f673582997ae3054f1

SHA1
e982f6ebc74d31153ba9738741a7eec03a9fa5e8

SHA256
8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c

SHA512
49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\VCRUNTIME140_1.dll

Filesize
35KB

MD5
ab03551e4ef279abed2d8c4b25f35bb8

SHA1
09bc7e4e1a8d79ee23c0c9c26b1ea39de12a550e

SHA256
f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44

SHA512
0e7533b8d7e5019ffd1e73937c1627213711725e88c6d7321588f7fffe9e1b4ef5c38311548adbd2c0ee9b407135646593bf1498cbee92275f4e0a22ace78909

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\_bz2.pyd

Filesize
84KB

MD5
499462206034b6ab7d18cc208a5b67e3

SHA1
1cd350a9f5d048d337475e66dcc0b9fab6aebf78

SHA256
6c2bbed242c399c4bc9b33268afe538cf1dea494c75c8d0db786030a0dcc4b7e

SHA512
17a1191f1d5ca00562b80eff2363b22869f7606a2a17f2f0b361d9b36b6e88cb43814255a5bac49d044ea7046b872bac63bd524f9442c9839ab80a54d96f1e6b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\_lzma.pyd

Filesize
158KB

MD5
bc118fb4e14de484452bb1be413c082a

SHA1
25d09b7fbc2452457bcf7025c3498947bc96c2d1

SHA256
ac0ceb8e6b5e67525b136b5ce97500fe4f152061b1bf2783f127eff557b248a3

SHA512
68a24d137b8641cd474180971142511d8708738096d865a73fb928315dd9edf46c4ebf97d596f4a9e207ec81828e5db7e90c7b8b00d5f416737ba8bffc2887bf

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\_socket.pyd

Filesize
78KB

MD5
0df2287791c20a764e6641029a882f09

SHA1
8a0aeb4b4d8410d837469339244997c745c9640c

SHA256
09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869

SHA512
60c24e38ba5d87f9456157e3f4501f4ffabce263105ff07aa611b2f35c3269ade458dbf857633c73c65660e0c37aee884b1c844b51a05ced6aed0c5d500006de

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\numpy\core\_multiarray_umath.cp39-win_amd64.pyd

Filesize
2.7MB

MD5
f5604fe675f54e081a2e522461371670

SHA1
5430bd0fe7ab9abab2ba657a603485a105c325d4

SHA256
174fa7b850775f0224764bb754d4c0ca5515885480aac14a08a2ea8c305aac16

SHA512
584c7f8510384e8095afc3008a84da38fc3ada4de4e8cbf14f1a6eb83b2180edbae1353a8bcc249dc89f6c5516c84b1ea8dd5f8fc8ac91bbf95628f4077837b7

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\pyexpat.pyd

Filesize
185KB

MD5
ed82c3f14a839092d2d9d27092a19640

SHA1
41ffcd82998b003c1e83961c329379d3512c863f

SHA256
2d59ddb10d0fa2516da1e879d2b3f180272160a4325f705d4e71ed21b90438b8

SHA512
1b25165bda699c8e1a37e022d3412a4a6e780c1f93b2880aa67902811b0971fee0b100ad561271d23c4b7dc36eae6ee5af40b19481df75285db35d15c0904bf9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\pywin32_system32\pythoncom39.dll

Filesize
654KB

MD5
8d4cd39cf6b1e5d3743ac1bcdcab4f12

SHA1
2ecfd93164920a60c273b1d000df14351816dbd7

SHA256
0789f9321abfa3a6403a483cb3ba684da5cfc39d26195fce8669a77c6367c413

SHA512
7734d61b7b2c5f829d05488b26d958b85d0cf87776b91e8a63b58debf5d32db42bc2d203cc5a27ab426672c282bf95b41b8429ee3ea1f0e0d9ca55f9f68e77bd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI41522\select.pyd

Filesize
27KB

MD5
a2a4cf664570944ccc691acf47076eeb

SHA1
918a953817fff228dbd0bdf784ed6510314f4dd9

SHA256
b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434

SHA512
d022da9e2606c5c3875c21ba8e1132ad8b830411d6ec9c4ddf8ebd33798c44a7e9fe64793b8efb72f3e220bb5ce1512769a0398ecc109f53f394ea47da7a8767

Download Submit
memory/168-230-0x000001D8D8A80000-0x000001D8D8AA0000-memory.dmp

Filesize
128KB

Download
memory/168-235-0x000001D8D8D10000-0x000001D8D8D30000-memory.dmp

Filesize
128KB

Download
memory/168-181-0x000001D8C8600000-0x000001D8C8700000-memory.dmp

Filesize
1024KB

Download
memory/3244-62-0x000001AA46710000-0x000001AA46712000-memory.dmp

Filesize
8KB

Download
memory/3244-102-0x000001AA48C10000-0x000001AA48C12000-memory.dmp

Filesize
8KB

Download
memory/3244-98-0x000001AA48BB0000-0x000001AA48BB2000-memory.dmp

Filesize
8KB

Download
memory/3244-94-0x000001AA48B90000-0x000001AA48B92000-memory.dmp

Filesize
8KB

Download
memory/3244-65-0x000001AA46740000-0x000001AA46742000-memory.dmp

Filesize
8KB

Download
memory/3244-67-0x000001AA46800000-0x000001AA46802000-memory.dmp

Filesize
8KB

Download
memory/4040-45-0x0000028454500000-0x0000028454600000-memory.dmp

Filesize
1024KB

Download
memory/5000-137-0x0000025BC82B0000-0x0000025BC82B1000-memory.dmp

Filesize
4KB

Download
memory/5000-35-0x0000025BBECF0000-0x0000025BBECF2000-memory.dmp

Filesize
8KB

Download
memory/5000-367-0x0000025BC5960000-0x0000025BC5962000-memory.dmp

Filesize
8KB

Download
memory/5000-0-0x0000025BC1620000-0x0000025BC1630000-memory.dmp

Filesize
64KB

Download
memory/5000-136-0x0000025BC7DF0000-0x0000025BC7DF1000-memory.dmp

Filesize
4KB

Download
memory/5000-16-0x0000025BC1720000-0x0000025BC1730000-memory.dmp

Filesize
64KB

Download
memory/5000-374-0x0000025BBEC00000-0x0000025BBEC01000-memory.dmp

Filesize
4KB

Download
memory/5000-370-0x0000025BC5820000-0x0000025BC5821000-memory.dmp

Filesize
4KB

Download