hxxps://drive[.]google[.]com/file/d/18YC3N9BLx9Dr7gS2E-nYbWih6B9a8kGc/view?usp=drivesdk

Analysis

max time kernel
263s
max time network
271s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/18YC3N9BLx9Dr7gS2E-nYbWih6B9a8kGc/view?usp=drivesdk

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 19 IoCs

pid	Process
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe
5044	Loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
457	raw.githubusercontent.com
464	raw.githubusercontent.com
491	raw.githubusercontent.com
574	raw.githubusercontent.com
578	raw.githubusercontent.com
641	raw.githubusercontent.com
3	drive.google.com
8	drive.google.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\TOSVDOIAHWOIHSAKLFHWA.txt	Loader.exe
File opened for modification	C:\Windows\system32\TOSVDOIAHWOIHSAKLFHWA.txt	attrib.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{26B8FF07-E8E3-4477-B75C-0DAB4CE0B495}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4804	msedge.exe
4804	msedge.exe
1376	identity_helper.exe
1376	identity_helper.exe
4100	msedge.exe
4100	msedge.exe
1740	msedge.exe
1740	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2404	4804	msedge.exe	85
PID 4804 wrote to memory of 2404	4804	msedge.exe	85
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 5100	4804	msedge.exe	86
PID 4804 wrote to memory of 4820	4804	msedge.exe	87
PID 4804 wrote to memory of 4820	4804	msedge.exe	87
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88
PID 4804 wrote to memory of 3236	4804	msedge.exe	88

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6560	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/18YC3N9BLx9Dr7gS2E-nYbWih6B9a8kGc/view?usp=drivesdk
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe07ae46f8,0x7ffe07ae4708,0x7ffe07ae4718
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2148 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7196 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8272 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8464 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8640 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8792 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9092 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8452 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=9956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10116 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9472 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2313411494300746924,12124132608652454523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9656 /prefetch:1
  2⤵
  PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1740

C:\Users\Admin\AppData\Local\Temp\Temp1_Loader.zip\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Loader.zip\Loader.exe"
1⤵
PID:3924
- C:\Users\Admin\AppData\Local\Temp\Temp1_Loader.zip\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_Loader.zip\Loader.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title MCC Loader 1.0.6
    3⤵
    PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title MCC Loader 1.0.6
    3⤵
    PID:6544
- - C:\Windows\system32\attrib.exe
    attrib +H TOSVDOIAHWOIHSAKLFHWA.txt
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:6560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
20KB

MD5
539809cbc6f6c4e0fd229994e35f95ed

SHA1
da4011130179ec3274843aa17f6742b028123f3f

SHA256
ce15083cc0d3b10bb9940534312e6500c63a62fdc847ca65bad851d58047ba67

SHA512
d907234418ce3796b7525d883bf36fe1cbc901b21b13cae4cae4c9bb70f612018567d100e3cc61eda3814e49ad336a16279c889e29d96b94a11d4733310669a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
408B

MD5
9afc289705684fd2a71652ad0be472b7

SHA1
5377f22359f95453f397ab9796ff23f31d1acce6

SHA256
91f43d76857d502d626065cdda3c1649df26e54a8d81a7cc28aeab854d9f43cd

SHA512
dd254457de4621a8cd429b15716594edfd73f144c143b1818dcb3743e556c935b505267eafb90db7ce81670b379f8640e9e6707a4b02bd837be4e646abf4f028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
048c5898ff85846122c49af9d8d11bdb

SHA1
b783e6e96e57bd7098d055dcb0820ab1b4e04b8c

SHA256
c98bf08f5bb58a52f21e3326e5ba2ee3d6c0b9ab73dcdbacfba7cc64def4d649

SHA512
2fed995234c473b26dc15e3409938c8312cec67ed1a5c8073f670d3c483ca25403b44b967cd55b7f7593b735931268dea56fbe3f8d15aea7d322c549f0d32f7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b76ed6621ee82809174ca93db3fdba38

SHA1
d2f73f3e1b667202fd337bfce8cd76039137a7fd

SHA256
fa64aee10b85675799bb4eff76285d5745a252d69301f96eaa2f4595ba4f64f9

SHA512
c06dd75d7db39f355f95348ebcf4e2fbc66fc49f53bb1b451674921b176a8512cc07140d582154eb1003110bf81b2cfd2e945be0a936108d07ad7451713f8b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
69c4e3b444f275723858cccbcdc3a623

SHA1
bd9157a1b6041154b28057afa8b7973cc4dfd422

SHA256
f5a4d1a7133526bac3f4c3cb3e9ed602746d5de223d0b91eba9731493f58063a

SHA512
69994b11a3dce92d190fbad587359a4aa22287c96a267c8dff894a68e93192d6845ce71e1d68b1775dfc1f3e74336e9b8c6827a54053f9a688db4900185afe92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2b7bb43f9431e84426b445d7566a4013

SHA1
0c47a6f8b93fa113d19569eedeb9822ddd42846d

SHA256
ffc1abcb2ca2d3d65695346c8f232966cea614c454769ec43860603d9ae581d1

SHA512
ba584f295949fecf8e26574d30a5fa77a023220ca447d329f42a6fe72d347300a9ede7edd3f43fef6681afbc5c029756e32f118a4a1cdfc36ca379cdbd830bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
415f6c7a2f3444518400708dad5fe2d1

SHA1
c76050e8a96904674af7cca4f75aa1d9917ed11a

SHA256
b8673efa240c337b8d57f43571770e862044e2e3261f87a2a56adbfb78928f40

SHA512
695b8d85e5f727619443e706f64b5d50d3d180966921c304d424c64ee7ac6fbb68a54da38df153a9fb1a7679bca54dca99a9ea727a3369e64f0d41a2b5f89886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
91966d9bddf45a3e2ffd7a587e589a98

SHA1
c9939f065b4de713c84a16e779c2f474726682bc

SHA256
0b778feee42c947c13e9bbfd6443847be6401b9732ef66092ea2c2b352c47b9d

SHA512
ccd81e375f55f17925c9ac94f4bf10468d5e062c95417508e6c807f8cd1b8c77f6a2a6d4937172cac0b30435204c5df360aee8f02c606412bcb637383d02e81b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0ce0f1b4800c6afa7e8bcfbf04839b54

SHA1
291237f20cc6185c84693d2fa7502eedbca8ea28

SHA256
b8e1d3ab17dffbfbbca2e1c0f162307115171e821e44ad359c746f957b25b6d1

SHA512
abfd3f50a667277df9350e123b7a968f40f493c491ea1da954a9a7ff34426729bd70df6c67c9ef0af812503c6fd694e97ca7e78548c490c4dd681e80e9cfa0a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a6a50616f76f3fece29b534bfb4f67e

SHA1
f294bab14fd8f938def886d634ec127bbc875832

SHA256
cde33fbff0745cec725a70a37b98d3e58cc89c81c1ade8ba3ae973374626c219

SHA512
910ab09616f1745a82650352438e21e2d9624b64fc4f42243ae02cc217362405907539ed304d1ec1366616a62183cc69fc6b83c6b2795f6f4a71166daef9d51b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f68798b4644b138c09fdb3df48e74b6

SHA1
144e2cbc10fa8bd0717f00515caaba53e7de9065

SHA256
11cb16d070cb4fcc42b694c04f3c61f94cace1cde814b881f40407ded9b346eb

SHA512
1ff1457012759d5b4188be28394416cdb6facd95b746a23a9db911deb590da93ac8c10133cdd539ef771968200d83023156fee2742d23ff11ba8b98fb928533f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7809164f749675ee1f0adcd0fcc65610

SHA1
8bcc4141e0aaccde3d92dd477b9f23abe93ec056

SHA256
b6e68ff02eacd6bb9fef26c1267dc0206fdf125cb1a126d44366a1cc4abe8527

SHA512
ac594ae3cf875aacfd08eaf457908b2a0349376d757d48391abac5de6931f9849ffe05e4a30f51d65eb288d30549f7c4c4d8011700af6e20c39c8bd4372166db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9707aa97f74a54ed33c65dea66bacc69

SHA1
12a6d748877192e4e52aecbcbd93ae87824602cb

SHA256
fe4fb1f1772e967bc8d2ea732df4052a7d5139a70e7537daa8b3469193d17d8c

SHA512
92f1c33f6770adc96e60dd122ccbd128b3fc0c53d0c169a446570bea291bd7231b0aa64bec977410dfe7ee5ad748177c32e55e5973f431bc5e1403fab438ff87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c29fb04bfa8f03ce376e4149095cc53

SHA1
367180d5616319411581332a133913d685c9804f

SHA256
83dbe45a534088b8fa4de81dfbaf4fba9a22fac06e3d9224cf6042ea7af06c88

SHA512
5798aeb3a77d7b607b0d6e33c86b490b0f52eec17e456bc625b7d7dc11b4aa3e8cd46f59625b8fd0c38c0160a26069cb15aac9e6b10f841d07403d0541a49230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
348897bb773cbd9c5695f4875293e754

SHA1
c768342f62fa656c21daa2a6dcd86b8eb6d2d684

SHA256
1b1e6db6ca020af86532d0d57c86fc827c184e2699031a4fe9361a186bc12bfa

SHA512
7ecb978d8d531708425d9dce566c312ac508603e080774a1e0756226ca4c0a5bed76fb0d53ea249062288b4035da3bc1bed3eca9793784806f7ee7e3a96bf3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
0abdfd78d985c87e352917c7e09803eb

SHA1
561b5a94ebb8b0d339d74e9817c5561e7f9f9a5d

SHA256
ba7659d693f851c34b558b05acaf16b9c6ade312e1d66079a9c5051794c39c60

SHA512
47818bf30c84a8e34af4e4dc1035ab244cdca93121b74c96969be21591ebebb47e3fa5ac8b3faa979a0127f1867afa2a5a860a6d32c25e27b7d0a66b55ef260a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
bc8ed79bbdb9d0acb628dbbfd16fe773

SHA1
91ee40b0cf1c0c2c7f0d42e1aa06377e97cb9f52

SHA256
a557cb139bddfa298becb38b0c845edc8bae76d1a9c7b0ebcea5079d6c63a689

SHA512
3927fe16ee949de594b7f70f91577c43ccb37dc619dc3ed18f58f8e9471c42e9b7728c022ee39dab135d226ca0289286b080780d6ad1436942aebf0e6d3dc2d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d781483425933d868bc8771a16629bd2

SHA1
21288e2c9cefa1731ac30cc07473bb94e025d38a

SHA256
3c044e74be7df98f075d80f06ba016a244efa42848f6266bdd366ff5f2ab2cc9

SHA512
750e38504eb424cd73904c9fc26212dab2db2d970a3e0560daf3ecf1991d2c428c7fc80939e1f48e6466bdeca80ccd47059516bd799f8b095d2d6bb43b21997f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
247485df9f4ca105bef8f48a3dda8501

SHA1
670cc851ee584c7dd03ea97b73df49d3cea325f8

SHA256
478d11cf9e8951e07d926a87738f90c5dc5ef27ece1a41ad6add07869c211d9b

SHA512
9dd12ad9bf49e29d40e3450a0be3cf86baaa940e77d73cc9586a0f18278dcb3328e0e55fba3ef68b50c79d50940cff9eef9112fba1355cbf11fb77f2de1d4a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9eb965084416cbcd15b303d492ca0b00

SHA1
2794080b04df1d0064f8c6b86d7e078f64398694

SHA256
1709bf3fd990a5192709262ab0ea9f469f399eea9fe00d7330e462c75cb39c0b

SHA512
00179ec189f79cfcdf9f22c7d94d7847ca58817bd9c40adbd05ec9771483f85aae600ab0578d6f46da382b577377c1b6c5b94a3ae040eb1a1e4a43bc422070f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
eb0d66fcacda82d2e52c371a14cd63a6

SHA1
c8f962901c6df8849a206afa9a76f555875f6406

SHA256
02737ed6207c5420b9ab25e6acb662f3fccb3f0f81367a1ed574d625db051930

SHA512
7eb58383ee765b5c4ce1c7dbc9ffca72ef3441e85ca179c5e1d057bed230f97233c0f881c3152a71b61ba6172227973f7803156c3179c1837a4bfab840ac89f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
3ee55a18fcfb5003d0e85e12a14a23c5

SHA1
133cc26bd3d4bb794c4291ceb1a4d4846fcd32ce

SHA256
c07ea1d25aa3db4039277fd0be2039e7e08f3e8a678bfddeaa5eff2f107dab3b

SHA512
e779417ad3a169d1f394fe83e5a558e5aee8144f4da3eb10ce7bea511ba471b91d12c653c27b92b7865f57da66b5b8b1bf9e1044ef6d1d7afeb87c468ee597ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
e3fa7692e3d37cc5043f64d080db3b93

SHA1
cbea891854261082b8c9460972a72573dbba723e

SHA256
ca9954559197e83a14e1d6fca1027c6e06b6b6c46da92064e23cfdc827b84532

SHA512
a5090334b6bbfe1e86c21d94d3b226a687b0579656fd0fe856b2e4e7292ebe46fc765c726d7977e3743f5158205a6b33d6e4b58dd87f66d8073f7c4ee84fac34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
69b6a322b0fa7a39fda8a7c61dcd2e42

SHA1
36f27ef5793d100ea0b5f4c4520e17bd2c07904b

SHA256
909dc9d25cb39fea815e64d21f59f350666dd8fbed219e853e74c52b303a76f3

SHA512
68a87b782b141fd78f5a898cc50ca30a4b02e98460caaee7eec083be70b65525053c8d1e239a2fefde166e03293987b32a7623c8a8be297da453108059dd028d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
d9258b6a0cc72762b302429da25f9054

SHA1
0c0fd2596879914f806b07a8ec9a3a24b61b0463

SHA256
9a65c85a838cdc1ff05a0e12af41153cd636b2aa6bb28dfd8dd00970e275a0fd

SHA512
24e90bc369bcfbcbde7f5efad4bb3e1ea77816d9e07783a7d695eb7da461816a44d7e6bd032389b3ae5e3da3992873957f32cfd5edadd5ae1ffc82a22a2b1c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58655c.TMP

Filesize
1KB

MD5
764ef8cb0d7f26f3d8519fe192a9bc74

SHA1
3affde6a560a884d25a923d7ab6022becedc4f4d

SHA256
861798bd3aba92f822dcfe33ae4ee1a0607791e789a53ac6b204f3c0002c67e4

SHA512
f7ee8182a4e2a8dc0cc55a4f5c8cac104203f286adb8b1112d8bc0d2a951b5b1c882dcba63123b6f10eeac17efb6ce7469519e715a1d35d1bd28731383eaaf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bfa563d9-2f60-431f-a332-952a69ce61c1.tmp

Filesize
15KB

MD5
73a7c005355c9f437abad650c6bcdeb1

SHA1
5c32412b50b6897e7d62325a0f5bfca8108823c3

SHA256
ec34ce4c91ae89d777aa7db1304aa56d1e9bb659a774916d4061da03b1afa0fd

SHA512
0f6ae7d53aea644359f31aeef599b260445d8ed5cf8e759b749ad914216ddba1d275fbe994ba4c9f9661577792a7fcf08a2a194ab20febe1ce849d1bfb50c97f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3a8d1da30005d8890da3cc92f37b67ad

SHA1
9b18af7b8cd94c69fbe081e6ff7ad45115d93a57

SHA256
2b3b639608c7bd32fc8f5565220900c44a8cc439cdd2ec36e75e178bb264afdb

SHA512
f2ad32541a60beef83d5e7dea36d726832d7279427359e9d1ddee535b2ce5f46561f9816ad2ea107159eeefe178b162bf6b28f9bcb574e2387fe3497c1d48e61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
729dcb7c39c6ba881aa09a147af21df5

SHA1
8319ee72e2c19bf5196d4596717a06d40d75a021

SHA256
ffcd45bc34b19c911d532736bab015426768bb8393f4d7c68048209b6a821ce5

SHA512
5a7817d9b25b9e9dc845452e53e64bad6a2d3cc1bd029fe68d0b45346c8283c9ae46830d23c21c60ed5104f971da30fbb386389108e7685df3a27129b5ef5937

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\_ctypes.pyd

Filesize
120KB

MD5
bd36f7d64660d120c6fb98c8f536d369

SHA1
6829c9ce6091cb2b085eb3d5469337ac4782f927

SHA256
ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902

SHA512
bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-console-l1-1-0.dll

Filesize
22KB

MD5
09b2a90adc73421c3b7a70bfeff0baac

SHA1
4c9874195e917efb5077887be2f1677e58410861

SHA256
b2093752af55d7708dd9e0540c66a621c128870dee43efdb2a36d5128db463c0

SHA512
fc4b852127a34678d7dc735bef85494847a16a4a6505b8a12722672faf0169f234652ee24278c51ad681187760e41a27fe46348252cf29fbfd2c9a9e561aaecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-datetime-l1-1-0.dll

Filesize
22KB

MD5
8dc8a35c4e043348eceda2657c263e5e

SHA1
d7572375b2ade6a4cdd0910f601340a39da6aba4

SHA256
f1ded4bbe9ac8fe71a3e0b1e72aa15d6fa699f986a6183681b36b38990df9037

SHA512
6275043f611001debad6efbe8b402f9d4a7ee405e6e1306b253ab26616a399400d845cf89355756e3d81dac245c367a5df42dc2880a728560f97ae43d1df4926

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-debug-l1-1-0.dll

Filesize
22KB

MD5
d646d8ea7d6c3271337a827551618e14

SHA1
63deaa4158f99509d88e39406cce3b9c57947de7

SHA256
41ff412526664f93fc6997dace8ccf56c709b34bf745e97091eb5e1a7c7e491f

SHA512
af9151905265a89164ed20301961c250271f8804ee087b05a575a15d2cc27084a258bb41eab1bc6376d858fe3f1871ddd32f9f79155624fdd89080037f6ac865

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
22KB

MD5
2b408cfb2c072c30f6c9007623932d25

SHA1
2835982048a9bf3528a532ee766651653f36de8f

SHA256
48435a9a3b4206b595741c34be6198a759569917cecd3c526f0d63ec0a55b0de

SHA512
3a9d593652a5e9a92881120448772d847901b4eeba1a2ce0161a66cf82e94c1dc2ce3acc17a95e595942b3e0854ffc466efb15023b37aad0925ebd0e0bd44771

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-fibers-l1-1-0.dll

Filesize
22KB

MD5
f5fca0b8661f1d2a8e72d3dbc95abe77

SHA1
9c45d68e7c64c39bd6296157fc812d765999be36

SHA256
55fb31da2909865d9b3b980afa37bff007fdb624524dcc337594118641953784

SHA512
6599eceaecda56ed2dada54aa01a8dae8a1c4dce09ab3c54d0b77885b9b5cc24f67bda6f5285a52a08b69d9e759a52781a829cf130d9224955397c41acaae468

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-file-l1-1-0.dll

Filesize
26KB

MD5
a5335665d8992582f89958087b60d3a9

SHA1
97fb0a21234fd243d46d21992e6016bf0af2f3d8

SHA256
9f8d03558282ec8afa80282d0736625db4c28ba2e1d358734fd9c4a29fe4ed1e

SHA512
b286004cc38d2873b1579b097785cbce24fc9d69989a0dedf05ca338981c6a13678bd71903a6a99f38013e1cf43729e48a3e50827f2dddce3695b9192264c477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-file-l1-2-0.dll

Filesize
22KB

MD5
8d1531275b769c1bd485440214bfaf82

SHA1
c8bb901b148522595cd78f1e12f61730bfa3d9df

SHA256
0b7a730b6b10c9d2e2fe1b9b4419b1fc60db9074a0c6f830e1b2da4d0f65fe88

SHA512
55914f424c400208b0d2c4d6cafa355aecf4697d3a6bf4032fe298214ed3565013c969b1e23d91cdf995dad46760c80e3a0a3abc062b3084b2bb4bc83a90995f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-file-l2-1-0.dll

Filesize
22KB

MD5
50d07886dd9136e8da57bfde8fa1f69c

SHA1
17526cd01e870d4087c5aa423e4971c72882e173

SHA256
67fd0522cacfc3f5fb90373dd5fb388b6f63035d9a380cac4a3dd3d7801724ed

SHA512
7d1b12529f35e1bcd7a858fef4001a4a5e0ff15506789fb3ce56b58427d16c32a9c1768b87b2f66a1b37456a05f8e05ae0b0eddfb4335ae0cb8eda00550175c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-handle-l1-1-0.dll

Filesize
22KB

MD5
32dda59c16c53eda2027347b5e741e9d

SHA1
e9ad7505f468b62144a8a8551c2d6dc9f2f82a5e

SHA256
595ebe2feac7f57035b0ce803412bb4470d0366637a191cf4e48d5f5fd8bbffb

SHA512
d7c06ce6ebf509b90592d6262ad9950cd8916f715add79a384f688869de596c8e0546d1597380eadc954a9e5dd2a9dbb818899372ab51104e865644269cdec95

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\api-ms-win-core-heap-l1-1-0.dll

Filesize
22KB

MD5
5ce4e2adef8fc502db7155483584338f

SHA1
9d7aabb46f1cb7cffbc04b324bb4a10c17c45e97

SHA256
23e4d57c2a94c8412308218a091cde0f4aaf3af360449e31fe524b153a08082f

SHA512
0b160aa88aad8e06d157cb4468cc1479ed31e01064cb8cd0900d34e3a708dd0d77dd239e357fa7618eb75325502f5f8fcb90fd9fc6ed2a9c1d7557cdf1876353

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\base_library.zip

Filesize
1.4MB

MD5
2f6d57bccf7f7735acb884a980410f6a

SHA1
93a6926887a08dc09cd92864cd82b2bec7b24ec5

SHA256
1b7d326bad406e96a4c83b5a49714819467e3174ed0a74f81c9ebd96d1dd40b3

SHA512
95bcfc66dbe7b6ad324bd2dc2258a3366a3594bfc50118ab37a2a204906109e42192fb10a91172b340cc28c12640513db268c854947fb9ed8426f214ff8889b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\faker\providers\job\es_MX\__init__.py

Filesize
83B

MD5
eeaa6ca5cb7f4bb1d7e75797f9b5af37

SHA1
0ac3743facacbc2090930b41cf38bcfe2951eb37

SHA256
ce99db30f577944104a7365372ea8363cd9d0087a6e9d88f7b835a1926da336c

SHA512
b492e6fa3eb607683a6c6f5696835aeae5e4c12fd2d44346bfd954d25c0bcf5bda808c175b0b17e26a0d5daf4f91d8588de119f5b747a80b3cfe53f68bbecd7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\python311.dll

Filesize
5.5MB

MD5
5a5dd7cad8028097842b0afef45bfbcf

SHA1
e247a2e460687c607253949c52ae2801ff35dc4a

SHA256
a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

SHA512
e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39242\ucrtbase.dll

Filesize
1.1MB

MD5
28146c66076a266e93956111981cad4e

SHA1
44797bab4d3d3a8ccdb9df3a519cd3dbef838c31

SHA256
ed570898508c9d9186052157106b6dd9722bed47a27ecfeb424386c8970d81da

SHA512
078c8d6595b0afcee215a44ef9caa82f990ef2bf5dadb8fd84d83ac89839abeee1f9ce250e80b77cbbdde5d13688ed345da1f4bf22958490e645c074d2453f85

Download Submit
C:\Users\Admin\Downloads\Loader.zip

Filesize
11.8MB

MD5
5c12c277f20d7052d238170c0379de04

SHA1
fed7a3721abbcc987506a2b8b0057ab263e69877

SHA256
a267f536dccc5a1c4bceccdf6e25d9c363539e37de1f4d4f897df85cb83b6366

SHA512
bb606621a2ace658b6e7d2dfea4dc08a1ab80ff942f26312ccc04829fb5c72c6d46a2be732ee3688a826e93d6a0a908538026023aa6ce121b606d1a06f9ac0c4

Download Submit