hxxps://workupload[.]com/file/c6AtM9dfMUh

Analysis

max time kernel
562s
max time network
462s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/file/c6AtM9dfMUh

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

pid	Process
3444	winrar-x64-701.exe
3060	winrar-x64-701.exe
4212	winrar-x64-701.exe
4060	winrar-x64-701.exe
3716	winrar-x64-701.exe
856	Vantage Queue Bot.exe
3872	main.exe
2168	Vantage Queue Bot.exe
2616	main.exe
2200	Vantage Queue Bot.exe
2364	main.exe

Loads dropped DLL 64 IoCs

pid	Process
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
3872	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe
2616	main.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
133	discord.com
120	discord.com
121	discord.com
122	discord.com
130	discord.com
131	discord.com
116	discord.com
117	discord.com
118	discord.com
132	discord.com
134	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{7A2A25D6-8211-4298-82A9-F5B244E27E83}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 586791.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
4888	msedge.exe
4888	msedge.exe
1728	msedge.exe
1728	msedge.exe
3488	msedge.exe
3488	msedge.exe
2572	msedge.exe
2572	msedge.exe
4036	msedge.exe
4036	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2404	OpenWith.exe
3320	OpenWith.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2036	7zG.exe
Token: 35	2036	7zG.exe
Token: SeSecurityPrivilege	2036	7zG.exe
Token: SeSecurityPrivilege	2036	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3444	winrar-x64-701.exe
3444	winrar-x64-701.exe
3444	winrar-x64-701.exe
3060	winrar-x64-701.exe
3060	winrar-x64-701.exe
3060	winrar-x64-701.exe
4212	winrar-x64-701.exe
4212	winrar-x64-701.exe
4212	winrar-x64-701.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
2404	OpenWith.exe
4060	winrar-x64-701.exe
4060	winrar-x64-701.exe
4060	winrar-x64-701.exe
3716	winrar-x64-701.exe
3716	winrar-x64-701.exe
3716	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4276	4888	msedge.exe	82
PID 4888 wrote to memory of 4276	4888	msedge.exe	82
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 5004	4888	msedge.exe	83
PID 4888 wrote to memory of 60	4888	msedge.exe	84
PID 4888 wrote to memory of 60	4888	msedge.exe	84
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85
PID 4888 wrote to memory of 4408	4888	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://workupload.com/file/c6AtM9dfMUh
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d3746f8,0x7ff84d374708,0x7ff84d374718
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1972,5939259958656216255,15040956772866964388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3444
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3060
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\c9a09111c6c4458c94851f22b9a95e37 /t 1180 /p 3060
1⤵
PID:2216

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\94c86d3eb7fd4c63afd6914efa181e0a /t 2640 /p 3444
1⤵
PID:4856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4820

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4060

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e75e94392d1e4a60a4287cc64041bc0f /t 1656 /p 4212
1⤵
PID:4476

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\8515c5384e514cd79ad8755e8394ae78 /t 1456 /p 4060
1⤵
PID:776

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3716

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\403467060c614d1bb68d38b55eaa8e84 /t 2088 /p 3716
1⤵
PID:3664

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Queue Bot - Customer\" -ad -an -ai#7zMap3030:98:7zEvent756
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Users\Admin\Desktop\Queue Bot - Customer\Vantage Queue Bot.exe
"C:\Users\Admin\Desktop\Queue Bot - Customer\Vantage Queue Bot.exe"
1⤵
- Executes dropped EXE
PID:856
- C:\Users\Admin\AppData\Local\Temp\onefile_856_133620865119203089\main.exe
  "C:\Users\Admin\Desktop\Queue Bot - Customer\Vantage Queue Bot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4392

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3320
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Queue Bot - Customer\config.json
  2⤵
  PID:2524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:1152

C:\Users\Admin\Desktop\Queue Bot - Customer\Vantage Queue Bot.exe
"C:\Users\Admin\Desktop\Queue Bot - Customer\Vantage Queue Bot.exe"
1⤵
- Executes dropped EXE
PID:2168
- C:\Users\Admin\AppData\Local\Temp\onefile_2168_133620865557628350\main.exe
  "C:\Users\Admin\Desktop\Queue Bot - Customer\Vantage Queue Bot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:1768
- C:\Users\Admin\Desktop\Queue Bot - Customer\Vantage Queue Bot.exe
  "Vantage Queue Bot.exe"
  2⤵
  - Executes dropped EXE
  PID:2200
- - C:\Users\Admin\AppData\Local\Temp\onefile_2200_133620865662774706\main.exe
    "Vantage Queue Bot.exe"
    3⤵
    - Executes dropped EXE
    PID:2364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:4388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:3608

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3172

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9ea547ebh1f47h4e72h8b2dhdcb08496c878
1⤵
PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff84d3746f8,0x7ff84d374708,0x7ff84d374718
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,15569806457660358296,5006264632180496776,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,15569806457660358296,5006264632180496776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,15569806457660358296,5006264632180496776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:2056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulte36797a7h472fh428eh8cc7h5b51b531c1e3
1⤵
PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff84d3746f8,0x7ff84d374708,0x7ff84d374718
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15269731645130963662,9176769067819974767,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,15269731645130963662,9176769067819974767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,15269731645130963662,9176769067819974767,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a110c551b09a6093d0700e4faad46fcf

SHA1
c6c8bb93945dee02b8cbb57cd69b430cfb41289b

SHA256
9e6713ce7eb9fd0dd8abf440e7b8a3c1ace63fc74630faa32554520391a89aa9

SHA512
0b7a75399edaaf9d34a313a82d5c1bbbdc66b6849a9a3ea276803e9beaa0c4a375096d9336db516eaa77af370c61c95753ba04ed3ed8e280cce5eeae9ecd7559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a7fdaf0f84079e8239cb8f0f91e6cf7b

SHA1
98fa6417da38ec923f2a6d6235cd2bf056385bf9

SHA256
9bacf3117b22950810a854be701068258a205f964f99bb18105fcb5b3b30adb9

SHA512
77fc9ec71d60ac2f87e908ebfc851e58a803acf56aee4cde80513eb6b41c24c277daa3bdc6de80ce6f5503dbe4c2a27113fe1a0ceac9332eddab9000619129fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
d7123c583fb6de9c12c3eedb082ed240

SHA1
d35a459542ad7e5dadc28ba2d5e6a2e5d4e1ec74

SHA256
7dbdedbc196b2868ec509c8de5e9ffc92c172bfd8df388e2f5b3bd48c4fa3fc1

SHA512
5a4e2394b28db5a744f4d4b5ae501c12f2a1f44a1b5b83906a75e5e229b33fa344e9172cf241f0046dd885335f4766a70f41ac75d415c1fd8bf8d3e715e78b8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
551B

MD5
438706769f56f5c1a10a5d4e87ca9451

SHA1
3d24840972708829ccbf6779b36846190c6fbe8e

SHA256
72291aa8ae536b0e60ff2509863821464069c02ac29b0d6cfb3e01e58b2db789

SHA512
77f87a7268afaa57ebd72576d6f49a432cb4004c7709888df2b70787b0a1f22e303148c473ceafa82ab57de52001afa1de503fb50de49fe56a1382b49f9c9cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
61B

MD5
4df4574bfbb7e0b0bc56c2c9b12b6c47

SHA1
81efcbd3e3da8221444a21f45305af6fa4b71907

SHA256
e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

SHA512
78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3875e799cf80873770e8efcac5b0e897

SHA1
b85fbc992a893c06451ff6050f15b2b2c093fa0a

SHA256
7024a0580c8cdcf640349fb501d2d5bba6fd8ad55a7e319c0e8dec49e3cbd10a

SHA512
0fe41f7a80eedcadf18a1ab30729ad002d8814894a74ffc099aca3754ce443e01a7af8eac30402e2c209aa6580caabf90b9d399bd5d8e4ecb8d8b05754beea80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04f0a26aa83893ab656934ba509cc1a0

SHA1
ce353b44f4814bd2bd91da789e60ed1d1fd28b4f

SHA256
c3ceeb4818b736aec7994938a35c916deca50340b365f142a41f58e79ce61a9f

SHA512
85d42b4496ceac530e1679f6537d8edd63573a031d57698653501502ffd242cc2a1533d6888496a2658c69917920437685e5860c8476f75894d15c795a213d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33e95a17c5a3b78a743fd794900ad418

SHA1
45fa96119feee54c5392766264b027200bff576b

SHA256
2393aab05271b01f3abc11087280b8a335efecc452e2cf1c6a776fc35db8ed74

SHA512
08062ba076bd59ac505053c1a344d3f2286418f3368d65d368afc4d73a3b631cfe76dae39b95b87995cd46b35fe31ed516e4253a4fabc4c57b9be105a728537f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da687a4f02450e7ba7c190ba428a7acf

SHA1
62ae5eb68664737adeb0ef4d113b6673ce4ff6fd

SHA256
4fc8649ee672e3c551b7b7e79544ac56c05b6bbf8b41ac784d537dffbba13c93

SHA512
37b53631ed5e9dbb40f3c151ffeaacdfc74b1e2a4f5942c8493af05336b3326de20ebc65087ab3471832374f4aa13ef3e3990e55e5900ed0470bbc7f68c44fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
966ee64b7ec554cc410cf7058db6aa82

SHA1
8208d87c4d87078083bf580337ee2a0aecee83d2

SHA256
83a53185b2aa33295d75c5da8fe8f404ec81f159d5b7a5928017ec742d0ee9c9

SHA512
e080ef4bdfaf7c7f2403aa5ddeb829fe553951d928ff323ecc7cd59a87447b83a4606a1a3225473188234b498c4ff23b7986e51b78a86d27660043bb61b57f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f47ad14a-a7f7-41e8-99fa-ba0b8e245383.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5db94266178f87f3daf0bb542f810d44

SHA1
61b24c39945a2c14be531589ed1f3ee977fc4cb3

SHA256
2f6fe0986277cae4805a0c0caa7dc74f646eb0e164e93d938525fa2b4efef0e7

SHA512
609d59d2c6ca5a9b7bfeb34b8182624dd0a8fc344a02aa18086538ebca12b5d1a4d1383c64e23274984fcfae0c6363fa220ab0ca608668e7284d76440ff53180

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9451aa6f8ec482f15e19d369ffdf1080

SHA1
991a81c0b0f14d64ff757808aec6d08620937446

SHA256
ac2dd28fd78abd49668a7882afc791b5db494c25c3261a5d14987ffbada1caaf

SHA512
b594519907b936394e9ade60e229c35e5c57ae8593f84589a8972b5ee49ca9c044307942a6e78320774b47e7dbb88e00155714c21f6636e344fe6d7434e69b90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
33267deb3b1bc099dd0aa3e40bcc3301

SHA1
d4b3f4b6355efe896fbf858ff63b2da4c5d2565f

SHA256
a3eeba80c0066aa12bcb1f48a198a2e096e2bc5b4b55c7f2ad113dc75f8d7ac6

SHA512
f74c86ebec6fdc7bb61f744cdcba0e1669509a97723c99386df88ad66c15a39e24d493a298bd9a68c3eb6c6e7511c1e886b66c0257b94e491a021ca8439bf176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
31a7a127655889c47097a8f20f8c57e5

SHA1
69665558852ff8136f3f1d2904a16781dd683712

SHA256
e0d3fc2b6d62ecd9f4cbdb2259b3eebe06112b0faccaa0c0ce516a7662f13e55

SHA512
412bbed27b356752b2fe369344735b626821607aae67483bc8192ce6a0e29fdb313ebb34601976da6934f9ef3a5c2a123cffb619baaabaf9a5a1695a237d887e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

Filesize
121KB

MD5
a25cdcf630c024047a47a53728dc87cd

SHA1
8555ae488e0226a272fd7db9f9bdbb7853e61a21

SHA256
3d43869a4507ed8ece285ae85782d83bb16328cf636170acb895c227ebb142ac

SHA512
f6a4272deddc5c5c033a06e80941a16f688e28179eab3dbc4f7a9085ea4ad6998b89fc9ac501c5bf6fea87e0ba1d9f2eda819ad183b6fa7b6ddf1e91366c12af

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_overlapped.pyd

Filesize
50KB

MD5
e2a301b3fd3bdfec3bf6ca006189b2ac

SHA1
86b29ee1a42de70135a6786cdce69987f1f61193

SHA256
4990f62e11c0a5ab15a9ffce9d054f06d0bc9213aea0c2a414a54fa01a5eb6dc

SHA512
4e5493cc4061be923b253164fd785685d5eccf16fd3acb246b9d840f6f7d9ed53555f53725af7956157d89eaa248a3505c30bd88c26e04aabdae62e4774ffa4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd

Filesize
172KB

MD5
e5b1a076e9828985ea8ea07d22c6abd0

SHA1
2a2827938a490cd847ea4e67e945deb4eef8cbb1

SHA256
591589dadc659d1ad4856d16cd25dc8e57eaa085bf68eb2929f8f93aba69db1b

SHA512
0afd20f581efb08a7943a1984e469f1587c96252e44b3a05ca3dfb6c7b8b9d1b9fd609e03a292de6ec63b6373aeacc822e30d550b2f2d35bf7bf8dd6fc11f54f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\multidict\_multidict.pyd

Filesize
45KB

MD5
53c003dec693f83c57f326b6df5d5f05

SHA1
6977ebcbf74a039501825697021c504d7cc63928

SHA256
32555defdb044714dbaaec281820fa7a0c226545d40561b905294d2e0bdba102

SHA512
2c4b9dff022d25906981d52f68a9bda8e7840597bea6cbea9bc8036392dea56fbecaedcd1b9f6547074c28b018266e424ca0ae8e66bad947544a8571f83fd2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd

Filesize
29KB

MD5
e07ae2f7f28305b81adfd256716ae8c6

SHA1
9222cd34c14a116e7b9b70a82f72fc523ef2b2f6

SHA256
fb06ac13f8b444c3f7ae5d2af15710a4e60a126c3c61a1f1e1683f05f685626c

SHA512
acb143194ca465936a48366265ae3e11a2256aeae333c576c8c74f8ed9b60987daff81647aef74e236b30687a28bc7e3aa21c6aedbfa47b1501658a2bfd117b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd

Filesize
1.1MB

MD5
5cc36a5de45a2c16035ade016b4348eb

SHA1
35b159110e284b83b7065d2cff0b5ef4ccfa7bf1

SHA256
f28ac3e3ad02f9e1d8b22df15fa30b2190b080261a9adc6855248548cd870d20

SHA512
9cccbf81e80c32976b7b2e0e3978e8f7350cce542356131b24ebab34b256efd44643d41ee4b2994b9152c2e5af302aa182a1889c99605140f47494a501ef46c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2200_133620865662774706\Crypto\Cipher\_raw_eksblowfish.pyd

Filesize
21KB

MD5
76f88d89643b0e622263af676a65a8b4

SHA1
93a365060e98890e06d5c2d61efbad12f5d02e06

SHA256
605c86145b3018a5e751c6d61fd0f85cf4a9ebf2ad1f3009a4e68cf9f1a63e49

SHA512
979b97aac01633c46c048010fa886ebb09cfdb5520e415f698616987ae850fd342a4210a8dc0fac1e059599f253565862892171403f5e4f83754d02d2ef3f366

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2200_133620865662774706\Crypto\Hash\_MD5.pyd

Filesize
15KB

MD5
34ebb5d4a90b5a39c5e1d87f61ae96cb

SHA1
25ee80cc1e647209f658aeba5841f11f86f23c4e

SHA256
4fc70cb9280e414855da2c7e0573096404031987c24cf60822854eaa3757c593

SHA512
82e27044fd53a7309abaeca06c077a43eb075adf1ef0898609f3d9f42396e0a1fa4ffd5a64d944705bbc1b1ebb8c2055d8a420807693cc5b70e88ab292df81b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2200_133620865662774706\Crypto\Hash\_SHA224.pyd

Filesize
21KB

MD5
c8fe3ff9c116db211361fbb3ea092d33

SHA1
180253462dd59c5132fbccc8428dea1980720d26

SHA256
25771e53cfecb5462c0d4f05f7cae6a513a6843db2d798d6937e39ba4b260765

SHA512
16826bf93c8fa33e0b5a2b088fb8852a2460e0a02d699922a39d8eb2a086e981b5aca2b085f7a7da21906017c81f4d196b425978a10f44402c5db44b2bf4d00a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2200_133620865662774706\Crypto\Hash\_SHA384.pyd

Filesize
26KB

MD5
59ba0e05be85f48688316ee4936421ea

SHA1
1198893f5916e42143c0b0f85872338e4be2da06

SHA256
c181f30332f87feecbf930538e5bdbca09089a2833e8a088c3b9f3304b864968

SHA512
d772042d35248d25db70324476021fb4303ef8a0f61c66e7ded490735a1cc367c2a05d7a4b11a2a68d7c34427971f96ff7658d880e946c31c17008b769e3b12f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2200_133620865662774706\Crypto\Hash\_SHA512.pyd

Filesize
26KB

MD5
8194d160fb215498a59f850dc5c9964c

SHA1
d255e8ccbce663ee5cfd3e1c35548d93bfbbfcc0

SHA256
55defcd528207d4006d54b656fd4798977bd1aae6103d4d082a11e0eb6900b08

SHA512
969eeaa754519a58c352c24841852cf0e66c8a1adba9a50f6f659dc48c3000627503ddfb7522da2da48c301e439892de9188bf94eeaf1ae211742e48204c5e42

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2200_133620865662774706\Crypto\Hash\_keccak.pyd

Filesize
16KB

MD5
1e201df4b4c8a8cd9da1514c6c21d1c4

SHA1
3dc8a9c20313af189a3ffa51a2eaa1599586e1b2

SHA256
a428372185b72c90be61ac45224133c4af6ae6682c590b9a3968a757c0abd6b4

SHA512
19232771d4ee3011938ba2a52fa8c32e00402055038b5edf3ddb4c8691fa7ae751a1dc16766d777a41981b7c27b14e9c1ad6ebda7ffe1b390205d0110546ee29

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2200_133620865662774706\_multiprocessing.pyd

Filesize
33KB

MD5
758128e09779a4baa28e68a8b9ee2476

SHA1
4e81c682cf18e2a4b46e50f037799c43c6075f11

SHA256
3c5b0823e30810aee47fdfad567491bc33dd640c37e35c8600e75c5a8d05ce2a

SHA512
5096f0daacf72012a7ad08b177c366b4fe1ded3a18aebfe438820b79c7cb735350ef831a7fb7d10482eefd4c0b8a41511042bb41f4507bbc0332c52df9288088

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2200_133620865662774706\pyexpat.pyd

Filesize
193KB

MD5
d7ecc2746314fec5ca46b64c964ea93e

SHA1
39fc49d4058a65f0aa4fbdc3d3bcc8c7beecaa01

SHA256
58b95f03a2d7ec49f5260e3e874d2b9fb76e95ecc80537e27abef0c74d03cb00

SHA512
d5a595aaf3c7603804deae4d4cc34130876a4c38ccd9f9f29d8b8b11906fa1a03dd9a1f8f5dbde9dc2c62b89fe52dfe5b4ee409a8d336edf7b5b8141d12e82d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2200_133620865662774706\pythoncom311.dll

Filesize
654KB

MD5
f98264f2dacfc8e299391ed1180ab493

SHA1
849551b6d9142bf983e816fef4c05e639d2c1018

SHA256
0fe49ec1143a0efe168809c9d48fe3e857e2ac39b19db3fd8718c56a4056696b

SHA512
6bb3dbd9f4d3e6b7bd294f3cb8b2ef4c29b9eff85c0cfd5e2d2465be909014a7b2ecd3dc06265b1b58196892bb04d3e6b0aa4b2ccbf3a716e0ff950eb28db11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_856_133620865119203089\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_856_133620865119203089\_asyncio.pyd

Filesize
63KB

MD5
41806866d74e5edce05edc0ad47752b9

SHA1
c3d603c029fdac45bac37bb2f449fab86b8845dd

SHA256
76db93bd64cb4a36edb37694456f89bb588db98cf2733eb436f000b309eec3b2

SHA512
2a019efaf3315b8b98be93ac4bea15cec8b9ecc6eab298fa93d3947bad2422b5a126d52cb4998363bdc82641fba9b8f42d589afe52d02914e55a5a6116989fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_856_133620865119203089\_bz2.pyd

Filesize
82KB

MD5
37eace4b806b32f829de08db3803b707

SHA1
8a4e2bb2d04685856d1de95b00f3ffc6ea1e76b9

SHA256
1be51ef2b5acbe490217aa1ff12618d24b95df6136c6844714b9ca997b4c7f9b

SHA512
1591a263de16373ee84594943a0993721b1e1a2f56140d348a646347a8e9760930df4f632adcee9c9870f9c20d7818a3a8c61b956723bf94777e0b7fb7689b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_856_133620865119203089\_lzma.pyd

Filesize
155KB

MD5
3273720ddf2c5b75b072a1fb13476751

SHA1
5fe0a4f98e471eb801a57b8c987f0feb1781ca8b

SHA256
663f1087c2ed664c5995a3ffa64546d2e33a0fce8a9121b48cc7c056b74a2948

SHA512
919dbbfcc2f5913655d77f6c4ae9baa3a300153a5821dc9f23e0aceb89f69cb9fb86d6ce8f367b9301e0f7b6027e6b2f0911a2e73255ab5150a74b862f8af18e

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_856_133620865119203089\_socket.pyd

Filesize
77KB

MD5
485d998a2de412206f04fa028fe6ba90

SHA1
286e29d4f91a46171ba1e3c8229e6de94b499f1d

SHA256
8f9ede5044643413c3b072cd31a565956498ca07cdd17fb6a04483d388fdad76

SHA512
68591522e9188f06ff81cd2b3506b40b9ad508d6e34f0111819bf5eff47ed9adf95ebfae5d05b685c4f53b186d15cc45e0d831d96be926f7a5762ee2f1341f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_856_133620865119203089\python311.dll

Filesize
5.5MB

MD5
d06da79bfd21bb355dc3e20e17d3776c

SHA1
610712e77f80d2507ffe85129bfeb1ff72fa38bf

SHA256
2835e0f24fb13ef019608b13817f3acf8735fbc5f786d00501c4a151226bdff1

SHA512
e4dd839c18c95b847b813ffd0ca81823048d9b427e5dcf05f4fbe0d77b8f7c8a4bd1c67c106402cd1975bc20a8ec1406a38ad4764ab466ef03cb7eb1f431c38a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_856_133620865119203089\yarl\_quoting_c.pyd

Filesize
93KB

MD5
3ccc89b98dab137bc5af9c1e62923829

SHA1
55d93e9782094925d80e4ce27d13a0a9761b7002

SHA256
40e91aaa369a5c171c0d30630707ae9bb64412fedf149aeecfa5707a2324f770

SHA512
4ebe427c75d83c019f8d378a030ae21e07decf30cd10623115eb0cc6ad7a689159e95c7fabac82ce82cea3720fae6c6faf712b600236dad039255884872eb6c0

Download Submit
C:\Users\Admin\Desktop\Queue Bot - Customer\Vantage Queue Bot.exe

Filesize
18.0MB

MD5
faf0bfedad29d0adcb3fbc3ae544bf8b

SHA1
399d8e04e0e019dd12b4b1bdacfff74a157951af

SHA256
abf180426eb89753f8c762afd4bd62c5b84be93207362e2b9ab9f57d552cdb33

SHA512
e8d943cbd35de7c67ebdd005aaa49e4f8e2b9f7e13d9c476df77282be743044ab84c60cd58275e6ea77445f6fb91b30ec1e78568c98bf18ed664c795d78249e4

Download Submit
C:\Users\Admin\Desktop\Queue Bot - Customer\start.bat

Filesize
32B

MD5
40705d9209de65fe7d433d1fc9c8882a

SHA1
28f51e9958031c90a0cc1c24ab0c75b3bfcd83b9

SHA256
e998f40ef073abcea6729b68c563e3988426b3c8586e83160c408cdf103c72be

SHA512
f8e6fff4abb0995146b61d61ef19f8fff9897e3e442ee557a2569a5ca245a91836be55244fa5d2fe55e7b4fae2da2f05aab1892281bc95e1d545594115760149

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 690468.crdownload

Filesize
17.8MB

MD5
105a3211d2036d69d01f893b1dce77ca

SHA1
ab7697b3de50d62a2dce2ae9c2019014c3f1d363

SHA256
a37f9bb8374fb39a4fc112d2e03918ae9a62c4d948aa7a92ecde6e0f7f10f5cd

SHA512
19ef9ba27ddbc7227d86d2dc02cb83ac37a78867559daa6d605a036411c89e6ff732c60bb71144ea95562b4c373cd233b58438c9a8c119275d55e4ee7e730926

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit