hxxps://github[.]com/v-Cx/aio-generator/releases/download/1[.]0/AIO[.]Generator[.]v1[.]exe

Analysis

max time kernel
720s
max time network
791s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/v-Cx/aio-generator/releases/download/1.0/AIO.Generator.v1.exe

Score

8^/10

pyinstaller

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
2812	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
8904	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
4728	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe

Loads dropped DLL 50 IoCs

pid	Process
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
5252	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
65	discord.com
66	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
5252	AIO.Generator.v1.exe
9052	AIO.Generator.v1.exe
6896	AIO.Generator.v1.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00050000000229e0-53.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-701583114-2636601053-947405450-1000\{E8411453-5A29-4DC2-A616-892167A9C5F9}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 518844.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6072	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
5004	msedge.exe
5004	msedge.exe
2940	identity_helper.exe
2940	identity_helper.exe
1944	msedge.exe
1944	msedge.exe
8024	msedge.exe
8024	msedge.exe
7612	msedge.exe
7612	msedge.exe
7612	msedge.exe
7612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	10184	WMIC.exe
Token: SeSecurityPrivilege	10184	WMIC.exe
Token: SeTakeOwnershipPrivilege	10184	WMIC.exe
Token: SeLoadDriverPrivilege	10184	WMIC.exe
Token: SeSystemProfilePrivilege	10184	WMIC.exe
Token: SeSystemtimePrivilege	10184	WMIC.exe
Token: SeProfSingleProcessPrivilege	10184	WMIC.exe
Token: SeIncBasePriorityPrivilege	10184	WMIC.exe
Token: SeCreatePagefilePrivilege	10184	WMIC.exe
Token: SeBackupPrivilege	10184	WMIC.exe
Token: SeRestorePrivilege	10184	WMIC.exe
Token: SeShutdownPrivilege	10184	WMIC.exe
Token: SeDebugPrivilege	10184	WMIC.exe
Token: SeSystemEnvironmentPrivilege	10184	WMIC.exe
Token: SeRemoteShutdownPrivilege	10184	WMIC.exe
Token: SeUndockPrivilege	10184	WMIC.exe
Token: SeManageVolumePrivilege	10184	WMIC.exe
Token: 33	10184	WMIC.exe
Token: 34	10184	WMIC.exe
Token: 35	10184	WMIC.exe
Token: 36	10184	WMIC.exe
Token: SeIncreaseQuotaPrivilege	10184	WMIC.exe
Token: SeSecurityPrivilege	10184	WMIC.exe
Token: SeTakeOwnershipPrivilege	10184	WMIC.exe
Token: SeLoadDriverPrivilege	10184	WMIC.exe
Token: SeSystemProfilePrivilege	10184	WMIC.exe
Token: SeSystemtimePrivilege	10184	WMIC.exe
Token: SeProfSingleProcessPrivilege	10184	WMIC.exe
Token: SeIncBasePriorityPrivilege	10184	WMIC.exe
Token: SeCreatePagefilePrivilege	10184	WMIC.exe
Token: SeBackupPrivilege	10184	WMIC.exe
Token: SeRestorePrivilege	10184	WMIC.exe
Token: SeShutdownPrivilege	10184	WMIC.exe
Token: SeDebugPrivilege	10184	WMIC.exe
Token: SeSystemEnvironmentPrivilege	10184	WMIC.exe
Token: SeRemoteShutdownPrivilege	10184	WMIC.exe
Token: SeUndockPrivilege	10184	WMIC.exe
Token: SeManageVolumePrivilege	10184	WMIC.exe
Token: 33	10184	WMIC.exe
Token: 34	10184	WMIC.exe
Token: 35	10184	WMIC.exe
Token: 36	10184	WMIC.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5376	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4428	5004	msedge.exe	85
PID 5004 wrote to memory of 4428	5004	msedge.exe	85
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 2120	5004	msedge.exe	86
PID 5004 wrote to memory of 3276	5004	msedge.exe	87
PID 5004 wrote to memory of 3276	5004	msedge.exe	87
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88
PID 5004 wrote to memory of 2196	5004	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/v-Cx/aio-generator/releases/download/1.0/AIO.Generator.v1.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0d6b46f8,0x7ffe0d6b4708,0x7ffe0d6b4718
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Users\Admin\Downloads\AIO.Generator.v1.exe
  "C:\Users\Admin\Downloads\AIO.Generator.v1.exe"
  2⤵
  - Executes dropped EXE
  PID:2812
- - C:\Users\Admin\Downloads\AIO.Generator.v1.exe
    "C:\Users\Admin\Downloads\AIO.Generator.v1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title Fcxgen • Netflix Gift Card and MalwareByte Code Generator ••• Fcxgen.com - Sellthing.co - Cracked.to/Styx
      4⤵
      PID:6356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://fcxgen.com/
      4⤵
      PID:6580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe0d6b46f8,0x7ffe0d6b4708,0x7ffe0d6b4718
        5⤵
        
        PID:6600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/HFFc5Mr
      4⤵
      PID:6608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0x114,0x124,0x7ffe0d6b46f8,0x7ffe0d6b4708,0x7ffe0d6b4718
        5⤵
        
        PID:6660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cracked.to/Styx
      4⤵
      PID:6684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe0d6b46f8,0x7ffe0d6b4708,0x7ffe0d6b4718
        5⤵
        
        PID:6712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:6704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:6836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:7052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:7152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:7160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:7640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:7664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:8016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:8024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:8568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16581065611406216959,12042020853580757602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:9104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:8872

C:\Users\Admin\Downloads\AIO.Generator.v1.exe
"C:\Users\Admin\Downloads\AIO.Generator.v1.exe"
1⤵
- Executes dropped EXE
PID:8904
- C:\Users\Admin\Downloads\AIO.Generator.v1.exe
  "C:\Users\Admin\Downloads\AIO.Generator.v1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:9052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Fcxgen • Netflix Gift Card and MalwareByte Code Generator ••• Fcxgen.com - Sellthing.co - Cracked.to/Styx
    3⤵
    PID:6420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Fcxgen • Module Netflix Gift Card Generator
    3⤵
    PID:4308

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Netflix ~ [20-07-2024==21-40-46].txt
1⤵
- Suspicious use of FindShellTrayWindow
PID:5376

C:\Users\Admin\Downloads\AIO.Generator.v1.exe
"C:\Users\Admin\Downloads\AIO.Generator.v1.exe"
1⤵
- Executes dropped EXE
PID:4728
- C:\Users\Admin\Downloads\AIO.Generator.v1.exe
  "C:\Users\Admin\Downloads\AIO.Generator.v1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:6896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Fcxgen • Netflix Gift Card and MalwareByte Code Generator ••• Fcxgen.com - Sellthing.co - Cracked.to/Styx
    3⤵
    PID:9356
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C wmic csproduct get uuid
    3⤵
    PID:10160
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:10184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://shoppy.gg/@DarkHia/groups/6oruvmW
    3⤵
    PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe0d6b46f8,0x7ffe0d6b4708,0x7ffe0d6b4718
      4⤵
      PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Fcxgen • Module Netflix Gift Card Generator
    3⤵
    PID:8824

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\key.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6072

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Netflix ~ [20-07-2024==21-43-43].txt
1⤵
PID:5196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
754aca42b166210d749d55edbbe7b02f

SHA1
3bd20352395e462f6fdd6a118994e8043d51fdaa

SHA256
53a3639e0a3360e96f83b146c7ea5a46c2292f0f2342d8f2884ed19b1cb19bb3

SHA512
db684e991fc99b6cd321e8bc2ade700dc9875925a5836c8fc4ef9a2e16131693453033f73095d56f9a54121bc62d3cea7d1a147ff475591d6c378366cee6f5b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
30b175df4a758093aa26c79750c7f3c6

SHA1
5bdd09d8e94fa47073dbf0029f0aaf07ea3a553b

SHA256
0f7c26484633daf9f70fb4362eb14c95ef45d52993ad63f396c763c00395863c

SHA512
77d745460867446c69e09987cf59ca90b48b7c386a896bca7bbb9833dfe5d65918a82f04817d8e76c08b2750777fad71c86f5e7ff2856a03ce23cadfcaea6eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fe803919179947b224fe56b4e7cf30e0

SHA1
7eb5c1e88691fefe7af395f8374301bc24f731e6

SHA256
40583a3128afe7519ce37ad627733f480e0cd927e2ffbe0a25cabce23b77447d

SHA512
2ced8c29f28c2894ad72d481bec52b6ad403bcdafc7293d28cade6331d402672cc562539d22e03e84b0cd6d2ccc20d53d233716d59a6b0b0578ae16e96e60a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
207e782e1a43b4abbbe3e946817525cb

SHA1
9c13e972aafceefab3a76fc51152dc2e09fe65bf

SHA256
9d3892efd1866dcf12d6d5524dcdd27373156b8ab6efddc7256eff526024f9be

SHA512
4e5cc1cb75bb5fe5d5a38c26412da1aa5b98615334dfe80f271169af7d5927a7d3484554e8d0dbc7a88613df227dbbff59c9727c42e3001726a6b0ec9208dec4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8e2fe56d84dc827ef704e58c39d4f430

SHA1
b6aca1693a9534965f602cc96ce66a95cb95252b

SHA256
137ab73cd7ca49f47c72bd9553ce7b1795b37ad74d5b2c01b2f3a0fe9b55321f

SHA512
010eec52ec0f4425c54a6082599472ae834b8aec648120f9da8f9aa49fd8fecd34e0f1519668304b6bf33040152146e4ad10a02ca86c4970572e97f34d6d5783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1b051e5213e8c1000b9b6532fcde19a0

SHA1
66012ede11cdbed18741529d9a69426df5adff2c

SHA256
421b741758df85604298b5e66a3d76eb4ed2cc0e4fef65a6b41815192a549b97

SHA512
53ab718b0464b49348290d97d4e05da1fe98b0a83925a737ff94cc5f6f3168061d29f7d932e04873e52eb53cd6e4b509739b247b4a33be99386f81c8d7050607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c8d4eb66f0dc2352870c2962a911e00

SHA1
d65c3fcb0d3c67f518804569188ac5d9571fb080

SHA256
d23166425dc31a1b4f86ef79ec4999670b514b4712899193166d787a163e0316

SHA512
55ba4763b85c3860200487557e26b6dba1433e8313408554f8988641903967ff2b1baf321b904311340b60e4b2305219ac80c81d590af9b6733ea091ce3c4a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
095a6614f93e463fd2e5a69cad59b019

SHA1
424e4ed5aa28bd3f8f415636e369cbad4fcce81e

SHA256
e9d3cfbb7ab7e1661b26568f3744ad2832cca6b29ddfe41f98bb0a98953e22cd

SHA512
54fb92c6007bd067bc0718ba1c027dfed8467ed6a1610b05b2c08e06225dabbd880ce4abb7acf09c4a65e0e291f2274531f5ff8d96e4f7d9d30eb61cab9fb23b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
018fe7b3a0e9439608c8c038c6aef1fc

SHA1
c30de539a712a005158daff3cf500e790ded3c6b

SHA256
333977c9d824ea0d8da80030929b68e53f0755b7f8a948d34ff115c993741621

SHA512
632b5b0f48608267f3dde900262fd763aef9c8dc25646483a24a55d512c8e18b6b6b9a6dacc2f66e327c915291716aa2454c1d3d90a48b35a861f9e74414f8ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6df95047bc344bd1a1f4e71d3f47e52d

SHA1
40fc6561854f24601f859fec1db61cd076f945cf

SHA256
11891677edbf805977ce7360a9f8f3c18318034d2c5fb8e4e4882fba4eb87bb8

SHA512
04be6bcb6710c3b59e055cb461d71f8f3c0082857a7177490ed40f6687b18c58a186ac2dbad3ac542343f56f1fa467fc89b52afe521d1facecdfc9f7cb2be1a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12ecbb56b11ac160b9a52e10097b050f

SHA1
a5617e5b97bf40edad62fa13bf79f5a787e8d6f5

SHA256
b8ed56a4cdf9e75c1dbb0c3104ecd581a4c86f9195fc43a20989e9411fa4b20c

SHA512
4ee4408ab76a2f6c957fbe0a4de4a9ac5d5af97fc14064d2e4419ee55e1f938986a7e20fb7678dc86851bd34fe65c8fab0879ef7a4b2c42c6f1223160672b180

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0cf7f0725082b72c77448a6d7a3f3548

SHA1
5415ad44502d7fd3a159b0fbd5a242bb7f8ebe8e

SHA256
a4560b97d892913dd55557629f96dbd1b596f07c2447965c5c3ff356eb21d17e

SHA512
eff72acab3a4a4f2f0347d31c4133a50831e0e628790311e2b6fdc87e2c81ba51e861785fa69675655d678dd964dbb3ccaac4287dddf58bdd86e0d0f34c5779f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
26fbc8e2858a828812f2d01477975b5c

SHA1
c7150952c1aaf7111a88fe5e7b1f2eca30988a37

SHA256
6124951fd492b06f12131a5352cb6344bc222d5b25dbddd326a37a9c34a34a46

SHA512
f8e043230368f0918ef7e0e2238713adb7ebe97dfcbd48c668ae3f3e9067945b1c783c6bb88e0b9c08b16a3e9b75b8ecfed4295f8cfc87d15b07ef81709cb20f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e4b3325c1e668e8c64e1c0d456393a69

SHA1
3eed1292a732e3776852305a8fcf5b86b16ce6a4

SHA256
2aeb3c121029bee94fea8e1aec356e183edf68527e808d0fa868d6f5b82f9650

SHA512
0d9e3a78bf8e66751688403174ae94a46905479ae2d5e3471bf9004bc3c81dba664c8944dbec22c7917d941789ec5b22e089029b89624f05e18cf75c06382ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8e549d435718af5f7d4f81fc931b97b4

SHA1
576a7fe250245a324df2c1964de803524204a3ea

SHA256
a384a2eb06724b696b8f39bc1904568f6a76ced5c3173ad3a3c86b3caebc2637

SHA512
7c617b3a9871f855c8af162a27a192145d8ded7d442c2312d755fe9e050388fe6389deb66cecf90d7a175845ad1a965c140485572d0b47a1cf916ea85b4bbfe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585fbf.TMP

Filesize
203B

MD5
174ebece2cf2ba0208c0c80ffff5a519

SHA1
cb33fda3e43e5a08c162cd85086a09bb69128a7c

SHA256
2d06287d2f49057fcd85b01c94f671ff66a84d72b0815913ce21c575c148e676

SHA512
df68d7c4ecc870d2ac86344367e849a0407451f2ea7b5ef79aa7ab9811ad7aad4734168df209ae50326118df1c5b35a3efa7a79260244d92ebd73eb9149c0e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eafc267480041764d9d69e6efa731353

SHA1
7f7bb4ad2c570394de03ed129237b2e69fc1c3ff

SHA256
c097f5567f63de47831dcee8b52ca67001da4a9b73ea0764eeac3545434dcaf8

SHA512
cedfee3ed28d4afb0bd25142035340cfa036fd6dfe40b8b853299c294268ee5cbe3bb6e52d3f3020a35d34661b262bd1fc8bd0d9a47aa2621de08c95ffdbb2ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
990af8110c68e64867dd75adf5ebad75

SHA1
7db1a14fed9241d8d01520fc968c185530cda667

SHA256
b4dc16d0b4b44a3f25f633c761a4c7c743fed4b5809567ad098c057e9a282ba1

SHA512
450cd38bdd29e046c497199ad6419cd6ddac91bc28583d2de7bbf4bfdfe69199d1fda548b1a0c982d0a220768f971b11aec33a14499822a6eacfa6f1ef0a6e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9c58a91c9d4892aec65b1fa06e8317c5

SHA1
978f8e3691266120a194e0eae8654e88b5f6937d

SHA256
e9454ec03726aa5f30828c2ef71eba8d625f446ba32a3a88fd0b2df1770a344b

SHA512
7eea7ebe4a7e4b7824cd42b42414a2323731cc9b0e187969204c99e4d24f01022b858f54278748428376d4b64c483d76fb0515ff661c04082789f7b369aa319a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8972dffaae5c81dd83573218656e8db0

SHA1
1d4c06f676b19b5e83b8ebd2cf771a8d2600ef53

SHA256
313ad80aaea14555315e4ca2f4ac472f061bdec0616725673ce92a767028d60f

SHA512
2e3d860415aa4da79097e9e275fbde57add375ec4e58458c31fd7dc408dd4bd4ccce58b06e0105d3e9d3c86ada33b37ef9ac55511006232737c3559ce431481f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
436866f11e325d8c7cb3907276ddec27

SHA1
3a8ecb181d025ba34657dcbebbee4e318cb047a7

SHA256
10891790a2b48ca5a5a8ae2eaace28590fce91c4eba0c12334c8855bc914c90b

SHA512
8cce38fab1d53efca63c5957b3a647be118827cff093c180721035fde89f426f6571295a200810cf4ee721b23e2c488de36e9b6a32175f4648cbdcd8d883078b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\VCRUNTIME140.dll

Filesize
91KB

MD5
7942be5474a095f673582997ae3054f1

SHA1
e982f6ebc74d31153ba9738741a7eec03a9fa5e8

SHA256
8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c

SHA512
49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\_bz2.pyd

Filesize
84KB

MD5
499462206034b6ab7d18cc208a5b67e3

SHA1
1cd350a9f5d048d337475e66dcc0b9fab6aebf78

SHA256
6c2bbed242c399c4bc9b33268afe538cf1dea494c75c8d0db786030a0dcc4b7e

SHA512
17a1191f1d5ca00562b80eff2363b22869f7606a2a17f2f0b361d9b36b6e88cb43814255a5bac49d044ea7046b872bac63bd524f9442c9839ab80a54d96f1e6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\_ctypes.pyd

Filesize
123KB

MD5
b74f6285a790ffd7e9ec26e3ab4ca8df

SHA1
7e023c1e4f12e8e577e46da756657fd2db80b5e8

SHA256
c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a

SHA512
3a700638959cbd88e8a36291af954c7ccf00f6101287fc8bd3221ee31bd91b7bd1830c7847d8c2f4f07c94bc233be32a466b915283d3d2c66abed2c70570c299

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\_elementtree.pyd

Filesize
173KB

MD5
087351dd1e9508a29633e03dbdc7d2ae

SHA1
284a7662e548ea9179906bc4ae013d04d4f5d09c

SHA256
a048bae40ececd2d56a79216c8552e3a3e6f9c4bfa1f6fb1c4987b954b80bcb1

SHA512
cf3e9b146ef20c0c50ef07650cc13c4b9f70632dcff9783df761d2a8b6e0e0f25f78a290db3b6150bbc83684ecb000bc8bb2d7b7fe283d40822b7d09a605228f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\_hashlib.pyd

Filesize
64KB

MD5
60f420a9a606e2c95168d25d2c1ac12e

SHA1
1e77cf7de26ed75208d31751fe61da5eddbbaf12

SHA256
8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c

SHA512
aaf768176cf034004a6d13370b11f0e4bbf86b9b76de7fa06d0939e98915607d504e076ad8adb1a0ebfb6fd021c51764a772f8af6af7f6d15b0d376448aba1a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\_lzma.pyd

Filesize
158KB

MD5
bc118fb4e14de484452bb1be413c082a

SHA1
25d09b7fbc2452457bcf7025c3498947bc96c2d1

SHA256
ac0ceb8e6b5e67525b136b5ce97500fe4f152061b1bf2783f127eff557b248a3

SHA512
68a24d137b8641cd474180971142511d8708738096d865a73fb928315dd9edf46c4ebf97d596f4a9e207ec81828e5db7e90c7b8b00d5f416737ba8bffc2887bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\_pytransform.dll

Filesize
1.1MB

MD5
9b8fe77aa3e6703759bc75a6adf81af2

SHA1
159290de306540744ba3ed0f09aa108bcb004101

SHA256
0f355037096c4c08ba98bba4a8e8fc1f178fa06a3e06b0f1f5206a190e221a00

SHA512
114fcd5ecf97756437cd759cc5172b3a2ed4f209f88c0ff8def6d948177150b82cab1d335a9a24278384ff7a0a2a47da6a06612e86118c39c8a805c53650445d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\_socket.pyd

Filesize
78KB

MD5
0df2287791c20a764e6641029a882f09

SHA1
8a0aeb4b4d8410d837469339244997c745c9640c

SHA256
09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869

SHA512
60c24e38ba5d87f9456157e3f4501f4ffabce263105ff07aa611b2f35c3269ade458dbf857633c73c65660e0c37aee884b1c844b51a05ced6aed0c5d500006de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\_ssl.pyd

Filesize
150KB

MD5
66172f2e3a46d2a0f04204d8f83c2b1e

SHA1
e74fee81b719effc003564edb6b50973f7df9364

SHA256
2b16154826a417c41cda72190b0cbcf0c05c6e6fe44bf06e680a407138402c01

SHA512
123b5858659b8a0ac1c0d43c24fbb9114721d86a2e06be3521ad0ed44b2e116546b7b6332fd2291d692d031ec598e865f476291d3f8f44131aacc8e7cf19f283

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\_uuid.pyd

Filesize
22KB

MD5
1c76a51dd15102e04b95ce6f53c28ec3

SHA1
57897767fcdad111171ccaf9e6cf581fd968fab5

SHA256
cb195b5aae6a7969174e8c7c6f9e2b40683190f6b4e410233022df1b6dade731

SHA512
f39668a7683f22c8baede141c3e0624c90a2fd8ade92ac4aa2950090dfdf02e611af998caad3de783f215877b8951f8b22afaef3b2b0bcce7e294eb70d176e55

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\base_library.zip

Filesize
767KB

MD5
7d7e5ebf9b74dfafa6016b4b9890a741

SHA1
97dd024551eff833f088df7dc49664617a6874f9

SHA256
c276a335c37f2099f6af4c2ca00fbc597e305d2da044d3b9122ddc6ffe20503d

SHA512
61ef720803fe8473ac46256c37aaeb463de8c3eaa884564fc31a9a64728428fbfad1a7b9a359a83b0c3dfb469d280e0a9cf1b5b2fc6f34f7d0c862255bffe5bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\libcrypto-1_1.dll

Filesize
3.2MB

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\pyexpat.pyd

Filesize
185KB

MD5
ed82c3f14a839092d2d9d27092a19640

SHA1
41ffcd82998b003c1e83961c329379d3512c863f

SHA256
2d59ddb10d0fa2516da1e879d2b3f180272160a4325f705d4e71ed21b90438b8

SHA512
1b25165bda699c8e1a37e022d3412a4a6e780c1f93b2880aa67902811b0971fee0b100ad561271d23c4b7dc36eae6ee5af40b19481df75285db35d15c0904bf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\python39.dll

Filesize
4.2MB

MD5
c4b75218b11808db4a04255574b2eb33

SHA1
f4a3497fb6972037fb271cfdc5b404a4b28ccf07

SHA256
53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

SHA512
0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28122\select.pyd

Filesize
27KB

MD5
a2a4cf664570944ccc691acf47076eeb

SHA1
918a953817fff228dbd0bdf784ed6510314f4dd9

SHA256
b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434

SHA512
d022da9e2606c5c3875c21ba8e1132ad8b830411d6ec9c4ddf8ebd33798c44a7e9fe64793b8efb72f3e220bb5ce1512769a0398ecc109f53f394ea47da7a8767

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 518844.crdownload

Filesize
7.1MB

MD5
3d666da9f05e86e4f004d01e5d914ba2

SHA1
91665ba09482d1ab836a9f3af1e891eb1b947d0d

SHA256
62dd8666a259d319f118448fd078bfc9e1638eec59d0355efc6599fc5c2a2d4e

SHA512
ab24e5c3f96cbc5590c5c163ab67f88ca0e525031fec0aa4b01d2ce8cd833276e54faef2155c19a0deb3aa602401842d55bc03e850aed4870474c552d15c2620

Download Submit
memory/5252-151-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-161-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-159-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-157-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-147-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-145-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-143-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-141-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-139-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-137-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-135-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-133-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-131-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-130-0x000002A110F70000-0x000002A110F71000-memory.dmp

Filesize
4KB

Download
memory/5252-163-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-165-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-167-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-169-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-171-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-173-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-175-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-177-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-179-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-181-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-183-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-185-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-187-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-189-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-191-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-193-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-149-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-153-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download
memory/5252-155-0x000002A110F80000-0x000002A110F81000-memory.dmp

Filesize
4KB

Download