exelastealer | hxxps://file[.]io/dgae2gpDZW6R

Analysis

max time kernel
308s
max time network
311s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06-10-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://file.io/dgae2gpDZW6R

Score

10^/10

exelastealer amazon collection defense_evasion discovery evasion persistence phishing privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3292	netsh.exe
3476	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
912	cmd.exe
3652	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2164	lazy.exe
4948	lazy.exe
3800	lazy.exe
2480	lazy.exe

Loads dropped DLL 59 IoCs

pid	Process
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
4948	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe
2480	lazy.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
92	camo.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
351	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5036	cmd.exe
5408	ARP.EXE

Detected potential entity reuse from brand AMAZON.
phishing amazon

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
1196	tasklist.exe
3536	tasklist.exe
2748	tasklist.exe
5584	tasklist.exe
5720	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2384	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4948-1302-0x00007FFB617A0000-0x00007FFB61D88000-memory.dmp	upx
behavioral1/memory/4948-1304-0x00007FFB7E090000-0x00007FFB7E09F000-memory.dmp	upx
behavioral1/memory/4948-1303-0x00007FFB7D470000-0x00007FFB7D494000-memory.dmp	upx
behavioral1/memory/4948-1305-0x00007FFB785E0000-0x00007FFB785F9000-memory.dmp	upx
behavioral1/memory/4948-1308-0x00007FFB75810000-0x00007FFB7583D000-memory.dmp	upx
behavioral1/memory/4948-1307-0x00007FFB759C0000-0x00007FFB759D9000-memory.dmp	upx
behavioral1/memory/4948-1306-0x00007FFB7DDE0000-0x00007FFB7DDED000-memory.dmp	upx
behavioral1/memory/4948-1309-0x00007FFB756D0000-0x00007FFB756F3000-memory.dmp	upx
behavioral1/memory/4948-1310-0x00007FFB61620000-0x00007FFB61793000-memory.dmp	upx
behavioral1/memory/4948-1313-0x00007FFB617A0000-0x00007FFB61D88000-memory.dmp	upx
behavioral1/memory/4948-1311-0x00007FFB74D90000-0x00007FFB74DBE000-memory.dmp	upx
behavioral1/memory/4948-1312-0x00007FFB611E0000-0x00007FFB61298000-memory.dmp	upx
behavioral1/memory/4948-1314-0x00007FFB612A0000-0x00007FFB61615000-memory.dmp	upx
behavioral1/memory/4948-1315-0x00007FFB7D470000-0x00007FFB7D494000-memory.dmp	upx
behavioral1/memory/4948-1316-0x00007FFB754A0000-0x00007FFB754B5000-memory.dmp	upx
behavioral1/memory/4948-1317-0x00007FFB74D70000-0x00007FFB74D82000-memory.dmp	upx
behavioral1/memory/4948-1319-0x00007FFB74970000-0x00007FFB74984000-memory.dmp	upx
behavioral1/memory/4948-1318-0x00007FFB785E0000-0x00007FFB785F9000-memory.dmp	upx
behavioral1/memory/4948-1323-0x00007FFB610C0000-0x00007FFB611DC000-memory.dmp	upx
behavioral1/memory/4948-1322-0x00007FFB74900000-0x00007FFB74914000-memory.dmp	upx
behavioral1/memory/4948-1321-0x00007FFB759C0000-0x00007FFB759D9000-memory.dmp	upx
behavioral1/memory/4948-1320-0x00007FFB7DDE0000-0x00007FFB7DDED000-memory.dmp	upx
behavioral1/memory/4948-1327-0x00007FFB756D0000-0x00007FFB756F3000-memory.dmp	upx
behavioral1/memory/4948-1326-0x00007FFB74800000-0x00007FFB74817000-memory.dmp	upx
behavioral1/memory/4948-1329-0x00007FFB747E0000-0x00007FFB747F9000-memory.dmp	upx
behavioral1/memory/4948-1328-0x00007FFB61620000-0x00007FFB61793000-memory.dmp	upx
behavioral1/memory/4948-1325-0x00007FFB74850000-0x00007FFB74872000-memory.dmp	upx
behavioral1/memory/4948-1324-0x00007FFB75810000-0x00007FFB7583D000-memory.dmp	upx
behavioral1/memory/4948-1331-0x00007FFB611E0000-0x00007FFB61298000-memory.dmp	upx
behavioral1/memory/4948-1334-0x00007FFB74750000-0x00007FFB74761000-memory.dmp	upx
behavioral1/memory/4948-1336-0x00007FFB78620000-0x00007FFB7862A000-memory.dmp	upx
behavioral1/memory/4948-1335-0x00007FFB754A0000-0x00007FFB754B5000-memory.dmp	upx
behavioral1/memory/4948-1337-0x00007FFB74580000-0x00007FFB7459E000-memory.dmp	upx
behavioral1/memory/4948-1333-0x00007FFB707C0000-0x00007FFB7080D000-memory.dmp	upx
behavioral1/memory/4948-1332-0x00007FFB612A0000-0x00007FFB61615000-memory.dmp	upx
behavioral1/memory/4948-1330-0x00007FFB74D90000-0x00007FFB74DBE000-memory.dmp	upx
behavioral1/memory/4948-1338-0x00007FFB60910000-0x00007FFB610B1000-memory.dmp	upx
behavioral1/memory/4948-1339-0x00007FFB6E940000-0x00007FFB6E978000-memory.dmp	upx
behavioral1/memory/4948-1351-0x00007FFB610C0000-0x00007FFB611DC000-memory.dmp	upx
behavioral1/memory/4948-1360-0x00007FFB74850000-0x00007FFB74872000-memory.dmp	upx
behavioral1/memory/4948-1364-0x00007FFB74800000-0x00007FFB74817000-memory.dmp	upx
behavioral1/memory/4948-1403-0x00007FFB7EE10000-0x00007FFB7EE1D000-memory.dmp	upx
behavioral1/memory/4948-1419-0x00007FFB707C0000-0x00007FFB7080D000-memory.dmp	upx
behavioral1/memory/4948-1423-0x00007FFB60910000-0x00007FFB610B1000-memory.dmp	upx
behavioral1/memory/4948-1456-0x00007FFB7EE10000-0x00007FFB7EE1D000-memory.dmp	upx
behavioral1/memory/4948-1443-0x00007FFB74D70000-0x00007FFB74D82000-memory.dmp	upx
behavioral1/memory/4948-1430-0x00007FFB617A0000-0x00007FFB61D88000-memory.dmp	upx
behavioral1/memory/4948-1450-0x00007FFB707C0000-0x00007FFB7080D000-memory.dmp	upx
behavioral1/memory/4948-1449-0x00007FFB747E0000-0x00007FFB747F9000-memory.dmp	upx
behavioral1/memory/4948-1448-0x00007FFB74800000-0x00007FFB74817000-memory.dmp	upx
behavioral1/memory/4948-1447-0x00007FFB74850000-0x00007FFB74872000-memory.dmp	upx
behavioral1/memory/4948-1442-0x00007FFB754A0000-0x00007FFB754B5000-memory.dmp	upx
behavioral1/memory/4948-1441-0x00007FFB611E0000-0x00007FFB61298000-memory.dmp	upx
behavioral1/memory/4948-1440-0x00007FFB612A0000-0x00007FFB61615000-memory.dmp	upx
behavioral1/memory/4948-1439-0x00007FFB74D90000-0x00007FFB74DBE000-memory.dmp	upx
behavioral1/memory/4948-1438-0x00007FFB61620000-0x00007FFB61793000-memory.dmp	upx
behavioral1/memory/4948-1431-0x00007FFB7D470000-0x00007FFB7D494000-memory.dmp	upx
behavioral1/memory/2480-1632-0x00007FFB72AD0000-0x00007FFB730B8000-memory.dmp	upx
behavioral1/memory/2480-1633-0x00007FFB798A0000-0x00007FFB798C4000-memory.dmp	upx
behavioral1/memory/2480-1634-0x00007FFB7EE00000-0x00007FFB7EE0F000-memory.dmp	upx
behavioral1/memory/2480-1635-0x00007FFB7DEE0000-0x00007FFB7DEF9000-memory.dmp	upx
behavioral1/memory/2480-1636-0x00007FFB7B690000-0x00007FFB7B69D000-memory.dmp	upx
behavioral1/memory/2480-1637-0x00007FFB7A9B0000-0x00007FFB7A9C9000-memory.dmp	upx
behavioral1/memory/2480-1638-0x00007FFB75470000-0x00007FFB7549D000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2364	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\lazy.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\python-3.12.7-amd64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000500000000f496-549.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3160	cmd.exe
1676	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
6032	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4876	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3652	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6032	NETSTAT.EXE
6116	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
6040	systeminfo.exe

Kills process with taskkill 12 IoCs

evasion

pid	Process
4016	taskkill.exe
4676	taskkill.exe
1580	taskkill.exe
1840	taskkill.exe
456	taskkill.exe
2024	taskkill.exe
5780	taskkill.exe
1660	taskkill.exe
1536	taskkill.exe
5508	taskkill.exe
3104	taskkill.exe
1532	taskkill.exe

Modifies registry class 56 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\Registry\User\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\NotificationData	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000097f514f2eee4da011fb71bbff4e4da01f6cc9d48f817db0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 210964.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\lazy.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 476956.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\python-3.12.7-amd64.exe:Zone.Identifier	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
5992	msedge.exe
5992	msedge.exe
2260	msedge.exe
2260	msedge.exe
3164	identity_helper.exe
3164	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3828	msedge.exe
3828	msedge.exe
392	msedge.exe
392	msedge.exe
5636	msedge.exe
5636	msedge.exe
3652	powershell.exe
3652	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 59 IoCs

pid	Process
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3652	WMIC.exe
Token: SeSecurityPrivilege	3652	WMIC.exe
Token: SeTakeOwnershipPrivilege	3652	WMIC.exe
Token: SeLoadDriverPrivilege	3652	WMIC.exe
Token: SeSystemProfilePrivilege	3652	WMIC.exe
Token: SeSystemtimePrivilege	3652	WMIC.exe
Token: SeProfSingleProcessPrivilege	3652	WMIC.exe
Token: SeIncBasePriorityPrivilege	3652	WMIC.exe
Token: SeCreatePagefilePrivilege	3652	WMIC.exe
Token: SeBackupPrivilege	3652	WMIC.exe
Token: SeRestorePrivilege	3652	WMIC.exe
Token: SeShutdownPrivilege	3652	WMIC.exe
Token: SeDebugPrivilege	3652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3652	WMIC.exe
Token: SeRemoteShutdownPrivilege	3652	WMIC.exe
Token: SeUndockPrivilege	3652	WMIC.exe
Token: SeManageVolumePrivilege	3652	WMIC.exe
Token: 33	3652	WMIC.exe
Token: 34	3652	WMIC.exe
Token: 35	3652	WMIC.exe
Token: 36	3652	WMIC.exe
Token: SeDebugPrivilege	1196	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5884	WMIC.exe
Token: SeSecurityPrivilege	5884	WMIC.exe
Token: SeTakeOwnershipPrivilege	5884	WMIC.exe
Token: SeLoadDriverPrivilege	5884	WMIC.exe
Token: SeSystemProfilePrivilege	5884	WMIC.exe
Token: SeSystemtimePrivilege	5884	WMIC.exe
Token: SeProfSingleProcessPrivilege	5884	WMIC.exe
Token: SeIncBasePriorityPrivilege	5884	WMIC.exe
Token: SeCreatePagefilePrivilege	5884	WMIC.exe
Token: SeBackupPrivilege	5884	WMIC.exe
Token: SeRestorePrivilege	5884	WMIC.exe
Token: SeShutdownPrivilege	5884	WMIC.exe
Token: SeDebugPrivilege	5884	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5884	WMIC.exe
Token: SeRemoteShutdownPrivilege	5884	WMIC.exe
Token: SeUndockPrivilege	5884	WMIC.exe
Token: SeManageVolumePrivilege	5884	WMIC.exe
Token: 33	5884	WMIC.exe
Token: 34	5884	WMIC.exe
Token: 35	5884	WMIC.exe
Token: 36	5884	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3652	WMIC.exe
Token: SeSecurityPrivilege	3652	WMIC.exe
Token: SeTakeOwnershipPrivilege	3652	WMIC.exe
Token: SeLoadDriverPrivilege	3652	WMIC.exe
Token: SeSystemProfilePrivilege	3652	WMIC.exe
Token: SeSystemtimePrivilege	3652	WMIC.exe
Token: SeProfSingleProcessPrivilege	3652	WMIC.exe
Token: SeIncBasePriorityPrivilege	3652	WMIC.exe
Token: SeCreatePagefilePrivilege	3652	WMIC.exe
Token: SeBackupPrivilege	3652	WMIC.exe
Token: SeRestorePrivilege	3652	WMIC.exe
Token: SeShutdownPrivilege	3652	WMIC.exe
Token: SeDebugPrivilege	3652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3652	WMIC.exe
Token: SeRemoteShutdownPrivilege	3652	WMIC.exe
Token: SeUndockPrivilege	3652	WMIC.exe
Token: SeManageVolumePrivilege	3652	WMIC.exe
Token: 33	3652	WMIC.exe
Token: 34	3652	WMIC.exe
Token: 35	3652	WMIC.exe
Token: 36	3652	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 2316	5992	msedge.exe	78
PID 5992 wrote to memory of 2316	5992	msedge.exe	78
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 2440	5992	msedge.exe	79
PID 5992 wrote to memory of 4444	5992	msedge.exe	80
PID 5992 wrote to memory of 4444	5992	msedge.exe	80
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81
PID 5992 wrote to memory of 1232	5992	msedge.exe	81

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
892	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://file.io/dgae2gpDZW6R
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb74d13cb8,0x7ffb74d13cc8,0x7ffb74d13cd8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9500 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9384 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9416 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9076 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9516 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9528 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9328 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9672 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7860 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8380 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8508 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8516 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9040 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8120 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8552 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8880 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9660 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7480 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9428 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1948,7448894047859896138,4760522041854298153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8848 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Users\Admin\Downloads\lazy.exe
"C:\Users\Admin\Downloads\lazy.exe"
1⤵
- Executes dropped EXE
PID:2164
- C:\Users\Admin\Downloads\lazy.exe
  "C:\Users\Admin\Downloads\lazy.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:3760
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:1388
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:4352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:4636
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:3260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3684
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2384
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:1588
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5992"
    3⤵
    PID:3780
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5992
      4⤵
      Kills process with taskkill
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2316"
    3⤵
    PID:5004
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2316
      4⤵
      Kills process with taskkill
      PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2440"
    3⤵
    PID:5680
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2440
      4⤵
      Kills process with taskkill
      PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4444"
    3⤵
    PID:3044
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4444
      4⤵
      Kills process with taskkill
      PID:4676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1232"
    3⤵
    PID:4152
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1232
      4⤵
      Kills process with taskkill
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4972"
    3⤵
    PID:3696
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4972
      4⤵
      Kills process with taskkill
      PID:5508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2620"
    3⤵
    PID:5476
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2620
      4⤵
      Kills process with taskkill
      PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5892"
    3⤵
    PID:5164
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5892
      4⤵
      Kills process with taskkill
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5828"
    3⤵
    PID:3196
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5828
      4⤵
      Kills process with taskkill
      PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1688"
    3⤵
    PID:1600
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1688
      4⤵
      Kills process with taskkill
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1940"
    3⤵
    PID:5204
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1940
      4⤵
      Kills process with taskkill
      PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5396"
    3⤵
    PID:1272
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5396
      4⤵
      Kills process with taskkill
      PID:456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:2820
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:852
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:4928
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:5788
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2096
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:5036
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:6040
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:5320
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:4876
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:1416
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:2404
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:4092
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:3248
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:3784
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:3780
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:3756
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1804
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:2476
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:2484
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:4604
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:2224
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:2068
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5720
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:6116
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:4660
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:5408
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:6032
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:2364
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3292
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3160
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4020
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2120
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3112

C:\Users\Admin\Downloads\lazy.exe
"C:\Users\Admin\Downloads\lazy.exe"
1⤵
- Executes dropped EXE
PID:3800
- C:\Users\Admin\Downloads\lazy.exe
  "C:\Users\Admin\Downloads\lazy.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3f44d2e6-5f76-4fa9-afb8-e40dd1fe06d8.tmp

Filesize
11KB

MD5
10effc046f5dd00aeae315cf80084db0

SHA1
a1a2a4a884fecbb79b785b96a407d06686f0eb78

SHA256
52ca96c9c9aa5a68fb86a99e4b66c34c2094fc99862968e3462f94a7cef62815

SHA512
a3d8978cc037a943a5ea4cb456d9583296f6e36ac2b623ccb028bad5a9e92e3266ba11eaec5e905586dc3cab43ab2ee746a467053b27c0101265099bb14f35fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
32KB

MD5
06c8c5abd664e146fffeb051033e7ec1

SHA1
1995b2ac2e0bd6aee4cbda7d83055815d08194b3

SHA256
ae99c3aae89201faa5bea066e49e719f1bae63a7bdbbbef4deb445982d7e1404

SHA512
295ea0fe58e3c3d5021f562d3f99a6706432f988c92c32092defcd9dbdcef89ecbb5ad092feaef45f39e13fd3649d21a4317aa693be98e6c86b51bf398613f3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
149KB

MD5
5ee744b45a0b750b00065a7b599b4c31

SHA1
5afa5d067c151144b9b1d6a9956f9f5bcebf39b8

SHA256
94b2e7cc9d12c51a05c83858fa59a828462acf00aa715ad47e24eda5bcb629ed

SHA512
f0d00a873003f39fb9b29527843b4c191e2083b5d5a5aab2bf69d1a6c057df846610a29302fb81655f3308a96191ee82ebc201609e1cf193a89929491fb7c678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
48KB

MD5
ed1c6d41249ba8eef53692c49fbc05e5

SHA1
3c54f254638812c967301371456c343b859d290a

SHA256
13c6e38eb9fb14afb29c48ee20e2301950b77f0203faaf4c011e8b08d737ffad

SHA512
f0015e55490651ded6baa353e05ee81c0df1b175ac70d1b0ba9755aa28984bf4b76692a26cc37a16fde6eb28bde16f7c33a72b9b234ef238731e9f25295a9e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0ca4572f3dbd7a1a_0

Filesize
254B

MD5
4e9841760c0004b73b05c504f054dfd6

SHA1
2fb5c57f800d3bca5522edc02e0d0f3b6ef0eb26

SHA256
9dcbbe9f7ed76380f493416b386ae4ad2d3c8a21474c342af67432a1dd6f5c3d

SHA512
4deea971c4af596df667be7b65c72c6d1c2c3aeabe139aa576f3ed1cfe86982d14ccebfc2e61adf5f28438432effaa55439c18a5427f2ee09f8461003112969c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af49c712350e2361_0

Filesize
147KB

MD5
dda71043c8ad6f8c78f42a9fd4c21463

SHA1
df1add237248a9d024e250edf28654e77cb14830

SHA256
a85b13d7e13929af31f1befa5c4c28949c236338b41ebc9c5b62b290f2126fc2

SHA512
c149a9a23c94b403eb7b234b9653bb7e3334f3f977bc12a2f2069f78da22cafb00f403dd61e4186994f9e4fcf4af4b8ca5a2f0d6631f428aed10716f138e9d1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cf419c5b94d91b7b_0

Filesize
291B

MD5
e725dd77021083e6e06489f295c321a4

SHA1
0ca71cc21b439e1a0d39680a160c1959064858bc

SHA256
a161321fe3cd102821ec01f5a57ef4c41be3139819b886fd5b8eefa19844edf9

SHA512
05b492bdc1be16856479c1405529f79f0e7adff777c011ecf795e8e3be2a1a9c4375bf3e638c6aef3e725a6b76577bbf3332096c56fb7eb88e7c9db99df3b337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d325a6029adcf9dd_0

Filesize
500KB

MD5
bfb44d67a62c6852691cc2488e839689

SHA1
291d3db62f7fd0f4e48e0a5f63b32a286109e45b

SHA256
e6aceb42222b9699f59b77726776b375f53c5e8aa3e9a98b13d26506f5d4e196

SHA512
7ad37dd263a46f13d4865c9495cf4bdb7c84dbfc0240adb7bce09ef58d1803cb2bb32c424dc87fde253e5a79b15ab66fdb87c1d15955aaf50d6e1d3bd99b6e57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
8397d8c397a2e5fbd1ece1acdd1f0f86

SHA1
8475c19f1b25543abf2746e960111a0f960a5e18

SHA256
e9b34557a95e50f03e5256d9b33afbcfdb7f6b906fe963967af02bb4a511adbd

SHA512
5c249083398507a324951d7258c7192bc914eddf1b56633ee371c0b7f046960aebfe75e1a8c0f23da779c81eeb41d46d9c804956c41320994d0488ef6e49051c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
83b8f31d41a20a2f5f3f5b5721f7b5a3

SHA1
9b12fd26fe1da697abcf3e1723a9fdce3e07eaf6

SHA256
534420e1964e3ef8060d120bb19b2c82af7f8eb3326ba417ad952e4dc5b70a05

SHA512
04cb1651a2795d0546a7ec08159b747969bae3cd862b3d2d90921f994a63914c981a438f316c0393439cd27bbd61c0736878d0a3929ed8eb60051b3f36589cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
bdb840becb8ccac4fedd1a75bf2523c7

SHA1
6d83675b1f61559db9d50d6f40bda06bbdc32400

SHA256
bc02e9e170430cf71ebe89ae42a4e530e967a3e6722d1276967f8832775643c5

SHA512
20f44c7b9911832bfec366de1f900cc7c8c46f4b65e25b11468b318420dbc62029871f90cb62b6ce9f4feb4543a0e8d53d4f4438b2f4e1bfc7f4f918bfd3a482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
09549a89a36790f1dc0d20a0a02f52d5

SHA1
2557315592015aa0a85fdd6fc87ad4b4aa363de1

SHA256
8122c9aa4f04349588d60e1f5f71b06ff3a8f7f462857dcf00d27fe0c1fe1a3e

SHA512
a1bd14e5691516e71aeb1daa8c6f9a073086a73eb035ce48a5ae4029ee0f7210fa0d18dd05563d40925b515bdfd190af38d43f7f4849adbb3e1fa45b96cb2aa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2373c32f7de7903cd8fe7436c863b191

SHA1
197889d18ccc9b22aca33371bfdb4626a6ef55a0

SHA256
428d8505643bd6494c66cd6657c4723d425d2b827d684287113d8251bccdff1f

SHA512
3c1074037d0d452ef8246a954694596af7f01b8bafc679ed1168743357a287239bc82ee542cf72921796750a117dd0d30467e669e506b2c781d3bfe94d28a1f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f1c5b5483345545553516748a894a188

SHA1
78d92c60a18990501cffa03845a71b88896da7cc

SHA256
2763f5d9e4454d144724bbf8a927882c128848102e884f6b0e0d22a5fc50e952

SHA512
196e80d85c013fbb4c63451e4d719f4763da4e94c9e29895e7d494b788d4cb8464648cd91ed386f91560cbd5ecfc9f2a17e523f94752668b9093c0e2b63a430c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6ae62eb384ab206d26a5203fce8f691a

SHA1
a8f11163f201633383b08146fee64f6224f34439

SHA256
ffd468052cfca22cc1fae9890513be3d58276ccf5974ece282717e769da08246

SHA512
3a6e8edfddcd673be595fd54b989beb4b33d7fe4370803bfcddae7ad19732ea7e056f01baed865fc310c16f09341be62476bcc7ff103d76876e401fa323b975d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
14KB

MD5
eb700237947558f52828fc110e984cae

SHA1
954e4b3bc12dd0502b6744a7d85a0b6a88b474a5

SHA256
aa223c1e24522ade47d0d5d29dbc4554deb45b5b9c38611086948166694d7202

SHA512
1fb8ff04e9cfd4867e4f9eb5685ab0ebca1383cc1408c0c3544d726e2449af3746ef83aad7665796ca479d512a864a3e9afc71cc49c621afa3ffd616f3135a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
47d83e30dddec022badb12536a28f800

SHA1
5a51015bbbe1f7bd5337d3cedcd59b2840b3fa44

SHA256
c722d70db78085a23e6c99820adb32416d0c13458b68181b058742711aa5d270

SHA512
e78454e73641f41f856d592748f828829ad5dd079aed5e5f3dc783b695e115bb39b05e125ee4affa07f0a88fa90437c5d1d526511d6aa6134e0edde660f417c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4cace1829722d06969421b7ff8732251

SHA1
d5e9dbdde13c9bcdd542058d5ca79958a0b4c062

SHA256
0172d290c976ef73bae2b8471509b0175f9ad1d2963a19071f981315d8bb3f1a

SHA512
028b9f606393184a40372a40ff0f1ce4c9befab5320bfe697ffbc01821cd6897bfead6fc0cd63a49ca15dd1771a92d0b3f734b250f8769f4610305a82a09cb8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
379fae80f86edf19d52c72c78a4fbcd6

SHA1
0d7169d9bfc12e6fc7e21bf1b3b1e24ed026fe03

SHA256
9e462d600d49e3b6029d6d1756da38c8889abb02e18629458cbe588de2043ee8

SHA512
e1f062967c795ac57d58ff2b4eee3bd0b7d9d0bff9fc6833a65917af6ae3468150c62ff8766a954e6aa31bc468c270849b5568409bc00bf81ff66ce847bee7dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
cbc79759726df10ac24b224ae7719287

SHA1
af9bdc6133102f845cc79fb5333ccf258b521e4c

SHA256
33a8fae3da975aa815a169067da007d565141854ca56e81d23094ea23c29fa8e

SHA512
c7402e9ae35c4accd30c01ddb53d33b57fbd76b5ab57b01cdd1eb5e21305f6f3d7aa3a54a04870e6091ebea9a74b9fcbda24396329990384b058a44a75eb0ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
35b68dff8c6b34c7a52e4b5f7a4dfcef

SHA1
72e54bc52fc1d3d5d996e689674a40d615af0f43

SHA256
92cf1abcb4cc173613fee3ce70f82a2b38d0873bcfff71e7d160c0a542c3f025

SHA512
ce4363db4967df7b6fb526b38899c0d58ebbddae7734181b80b1a201d45b91461df575a9a41ccad0ebd4198c92b088c9c2f54d87a9f37e5adb930e3f158ca104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
488a72674744e842ef70a51223bd0b3a

SHA1
12dd4e90ae5e798f0b9ee1e9524bdaf2b931a267

SHA256
8582c31420932e9aa6f83d0f748d3085de8f357420caeeb98426a57a8a8531ca

SHA512
357ffb31e0fa2084dd6d33840d1af46e3e832f487ea9b5bed4cc33c18e2bb574b1730ade4f333033a08b3e2befb20f1466e82c0d9fdca18952d254dfd9988e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
f2b20ef4b8bf1f72f71d5f0daf5513ad

SHA1
25aa5f0fe5c041fca6fdb491cbc2b9f8ea7328bd

SHA256
e005d9f8de93247344f0512022f92b0f621d7e77d315fd31c0ae506b622548f8

SHA512
5d1318ea91276b97082c02ba246519fed6e30bf8f55ed13e554a7449e64ff092378d1978d3a5f296d1e79af8edcc6213d83e70c8d7254e33701902c3f995e3d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
ed35f7fbb0f11b4b9dc777a71d49b44f

SHA1
6e9474496c45447c8cd7640d7ba828a066ffd526

SHA256
384e8cf352a3b356cafe1319936a8beb799707037f4a838d8567e7093e729ab9

SHA512
65f02a7c9a58794079a104a3f74c32ad9bbbd3d38146ab7ceaab3560c83168be99b3825c37b42e7071cd10588670474bbae295d5c1eefc1463208e64919665e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
9f6d5658f1fe96a6c0a844717fad72d5

SHA1
2e3346bb823a10b19c210ca1e46240c127828afe

SHA256
4058a92606d396fe1646e7eb140fb345b4bef427885d09bfeffd093e8027f31e

SHA512
e05cfd1c3496a4ab6e5c64cbc36f1f142b87fb3373b6df6499877ec1a6c85438e3b09476da4d67d8feb0816f28d0db3b9edc6922e5e736dbec2fe06841be244a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
da5fbcaa2e3f682c0e082d9eb6654ec3

SHA1
408457c1b1150b04215f7f97a0a129ba632ea805

SHA256
d2efdf516b84f7bc9d8b22417403487afa695dd9ece425daabdb0237a817df7b

SHA512
515d1a0a1f78db322b419fed6c220deb9a1976edbdcc4764b846892935cdab63daee457f4f30a67ae7377f612dc3cd4f31f0bdf88c2764bc90cd411fafde2013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
b1bd749234790cedbe736b2440d2bc7b

SHA1
fd461d19b81e7d35c1677e03d70d24969d868838

SHA256
1978fdd94094bcbf9819128ccdec6308a050f7b7e64471a06a94b9f5f652f52f

SHA512
edc5a46efeb8501e2bd81419fd62e31693aa4f3fc53062f821f4dd656c18b4bc36a990a4e3866410970c09753d15b6d984c4319e04628305ae6ccfb81ba2ce2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
fcd53e70b209eb4cc0e965361e79a4c5

SHA1
66ea01c2c7d53060a333f32855e44a8d3b116751

SHA256
72575dd6dfa0adc3248e18e1513f3832e22cac62004362081bdb94028d591ef1

SHA512
a3284e6a1d384facd8999446b40c50ef16efb900391e9e83ea4a98233eeeb104ae205dcd1d7a666cf910513d7dff38903202c427624c38b94b8f499fac4b09b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
30041305e6985c7d0d287ec00c86c3e8

SHA1
c55529f40127b222ee8e8a1fb003b78e11aadf46

SHA256
0e83bb76958966a51d86e00d213efe382e257dcbaf0e811e9d23fcf4c8f4dd72

SHA512
f69ef3fe28e0ba9fd03f39183d9fce4b35d4aedfa5491940e268693a515342d17712d9c25065a2c3e0283ad2bb24ed6459b9ef516eaf7b133320863e69c51594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
7459d583cfa35da047dc1d5fa05dbf85

SHA1
d92df2af1bb43e6cefb51516523f41e88dea8afc

SHA256
88965601f9c39e3282ec163e260d56d2a94691b1f1c1ac286e33ca6ce11f4dc5

SHA512
fc8ec226dfd602a167739232d5205ac5023a1772f863560fab1ad1604e4c99c334aaf6794a27ce8ecafd2238ed5b79fdd71571c42fdb033327c10266eda8cbaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1a99c87e375c97d9f4c82658ce456a20

SHA1
255214ec796fef5e08b20be6ab8c182bf716808a

SHA256
b07be17395ff9939b6aeb8e0d96c1444d9faec4fc998c275ec96f5839f00d67d

SHA512
d534b2361a45793a81c5a2389d4d05101dd32790fa638685bd397c2e18afbb6a0e4ac239816467190915e287f053033b9407f246bace96c001d9b2a33d8089f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5e724d2a66fa392197337c140bafedbc

SHA1
5bbe7d7c0a7948eb5d3f376d45d181d4e343f666

SHA256
d5b99eb2c3e43cea121dfeaaa3ce7fa447ffb71e555dd8091e3027c81dbeec5d

SHA512
d8f63ee557b8358f8ba2c55c85c893ba41aa81bbd3d21fb0126dc24527c08e5c3773f9deec2aee6ca0ed1a79ec83392eaf4d416c638c2155183f708b4b0e48ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c05286b3d478a27737e179895144624b

SHA1
d34cea9c0b37750ad5ba88bfa5097c16aec18a4c

SHA256
46c38a5615235b0f323388400e52b1552970aa98d9abfeace4a1125d8bca69f9

SHA512
d265db7194c5c5f412d3e6adb7e685ba1ec797b3562a790d741ce56474904a2b9399f85078064de12b0941374f69e1507604c6ee4c497b8628cf62bfd806b1c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58048f.TMP

Filesize
1KB

MD5
4bb6d503e8fd9deb28f93cd5fb4a347d

SHA1
f6dc1de8078d83daf72a0fa5cd6769c6832a5c46

SHA256
1e3a8536d5915054390706f58f3fe8e42bba690415631b10e3e63818c945980e

SHA512
83a230cb9800a572959ccf0ba4296931a279dd3e191461629d6bf46fb0e199f1ecaf3f5a2a87a9f0ee7bc95eae93af1997a979213e9be76dcad279f9aff50b9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2307c661755738783404deb900274188

SHA1
48e53ffddf5aa9302015909b74fde2d16b8f94f8

SHA256
3b86136f57f6e511b515b254bc20b72424402c4c0c44ae695a587a91b33c0eff

SHA512
46be17c50074f658087f39c9bc96412960df945d202fa417145f9e4069e359fe4bade48c7a0334b0056ee061f13d52082b8f98291a39048d6b67f4275e0f1754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
84868200954339c26d5727a6dfe1aad1

SHA1
3ee330eafa8f291c5bc2f8a741938b89c2ea30d3

SHA256
2566d6e4a8795c871b3fc05714c0a10ac008cd36c9148f833ba4312f58260f4b

SHA512
c9377bad03845bb141a7c320bae4d62df17cc6930cc2f4a18c557946b5cacf27a96975d5e3fadf9c754c8056a3b312a25f5718e83dac82ceb0cccc97ddcb06fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8bdf6e920b7b1cc3286d285d737abe32

SHA1
bba86dfd97e22ec2f1a31b4c42bf53e14a052de5

SHA256
f78e6dc619f3a9b275d27219b8b8109858cfb2ea5162c8afc2688c5e88c35e76

SHA512
670d22fe3e52a44d572c354d1773351ce884cbcebd6573335bed8162c99bec484f33815957c9fde56370f214b328449ff7e05f583921841d1acba8eca0408d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\CheckpointPush.jpg

Filesize
484KB

MD5
996333b171371046a1e9c47e9cff093f

SHA1
f77a1bcb2c6b6aa824db7ea9ba559bcf2304286f

SHA256
482da528805a309deb7ee0e277ea3744fbeb2e675afc0a54ee0aedce5697d244

SHA512
30a9a526e2970716e745fab8111582c0fc9c4c469ff6fc4ed227dc10ef4acf05a19693b500340e998c432849503092f8e7aaccdb90a847779af1b3ff0899d742

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\EditRegister.pdf

Filesize
212KB

MD5
63f0eb1174ea4ff8621f31c98274a2c6

SHA1
e7da5ef0f4771d4528f9e77664cddef21584bd53

SHA256
fa03fcdbdd71bcb1d55a958a9f5019da520395a8c97a2d9e258250982351f738

SHA512
ae1ef4f8489c24f6dae3546ffb52df9ad95806e39723c86d3ca5b1a6ae13a85713e0a4d61268e2550d43542afb74d60b279936f2828ef5540fc5dfb37130e9c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ExportUnpublish.jpeg

Filesize
545KB

MD5
ef7de434c5eb47617d0285ba04b33eae

SHA1
d1476e1548879cfda25812382b1900f59a9f4227

SHA256
8aa0fcc56c4cfcdbddb256259c4adee40b1cebb70b55cd3b2ca300c487667d68

SHA512
87c4f83ccf02f86e21ee65bce5529174d0b0648725d0892a3a174a4caa2ba579c8c38c30d20d3a14adf7c58aefb8c551491cf6ca4a622891c97fa0e354907143

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\GetBackup.rle

Filesize
499KB

MD5
6b6d27d1b28f0d3a31b62fc426018d6a

SHA1
bff8bbfd4a1c303a521e8dee4ec50727285d3ac1

SHA256
ba9366f9466a6c29b19e1d8a0e0e494fb8d91e4cea0371126c87fb2e88c4dc75

SHA512
f1d4629f3bc6a1dbf21702d477a17434d1c73a3ce52868ae06eca3a6ba9fb0b73a90ed625dcd0bfe1f9dfc243faa666589598cb21e783d7519dee81ae29fafef

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\MeasureGroup.docx

Filesize
15KB

MD5
d9726970b95cc06e9b4541561b711073

SHA1
819dec392985f3f4efe05548fc37fad0d8d4db36

SHA256
0aeca991667158156cd5322d9fb1a417ae75b19cc7227201f99220154ae29131

SHA512
aba415f753c649038e01627a4dcccf1d4cda6113885f37ba494bca9436e7050f40a7339bb29b6ab42f6a08ed5585962c0dd3c722de66eb10db955e8ff70038a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\StopOut.docx

Filesize
15KB

MD5
adeb7887c42992189e8666e26bd55971

SHA1
e34dc07fdef4ffdc486f9040791813b1540c2adb

SHA256
8ea0b40e71e1bed61b0b58b0d13a3917375c1f6d77e12a3a2b8290767ead5d86

SHA512
37476bb4b4b95d78b8ec864c2845e7684b6ddee48c3b2f5b0f21be6878ca350ff1a74dd8b48ce7185b8c3710e3d3fc1c430d2a0e088bf6cfde965d39207a8a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\CheckpointUninstall.xlsx

Filesize
13KB

MD5
549f72628ebe940ccc9f57dc76e36be4

SHA1
1250eccfe0cba584283244698476acd60fdaf55e

SHA256
4afb8ca6470d5e57c5d6ea9f53481dd3601ba0292f0b76e0ce7ae781c606d632

SHA512
7588e986238678711c5d614e66a02e26af34376a72a69b832704675c2eb044be7a8f98fd84173edec6c6b4c055454ef210e90c277b267f9c64ef00d9d1920d2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\EditRevoke.csv

Filesize
873KB

MD5
d04f8f79b47ee0c0b424babd637a455a

SHA1
4dbc492b7fcd50e28b4db25b97e2a8d3456c348d

SHA256
2a821eb8a69693a09c5c9b1ce796ffa2b1e6475ab19a10af0e8846ded3729d2f

SHA512
5f8463493f0e1349ea5459ed24c202a8d3e0626dcc04a924dc925c4a30344678009e3391a2048b5d2701bbceb97ef7c4dbd04ce26ec65ce57a4216c0c815c45d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ImportUnprotect.xlsx

Filesize
12KB

MD5
aff5e74c99b52029eb546f60c3978dec

SHA1
b86155626ecc87bcf3dd08992d13e758a45f560c

SHA256
3e495f2fc0c57bb842584b2c324b71b5d86d74192aa63c80a8338fa6515835ec

SHA512
be34c20673aeea6c6489d8c6db9658aed7943e6fc28a73b985b5574f729d49f48c4af5284831d0ef8a3f5c8d0fa3336c53b5a38b9644d45c4bdf8ccd25a003be

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\InvokeConnect.docx

Filesize
18KB

MD5
0f29401f11347527a93fadf930b0911f

SHA1
0e18023ae5bd952cc1168183ff38632eca266951

SHA256
15b8cc9d9ed64f54c4e2ff2f074287cbeba8831798f7aea2086d4a0197d75535

SHA512
94eb0cba3ecf8a1d9448b51dde14f55d65c44f88c1662af8a2ab73981c24a3fe92e7d3b4ec6e62286744100995f5aaa501d9d028a546815b91a39939faa66882

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\NewResolve.xlsx

Filesize
14KB

MD5
9d45933b9c9e2eb562ac03006b42fb3a

SHA1
85cff47a8bca3d115459daa5c1ba191156e81273

SHA256
f48517cb93bfb9369979fa8e67ee059c14cfeda89e721744eded4134af8cf312

SHA512
e5ac0f89a578a5e42031709954d64e9e7d990aee584b1f92569c12d52e00b11e74619d276607873d2cf2be2c503601983f237df544cb16095d2cb21573e8d1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\PingShow.docx

Filesize
17KB

MD5
359c748875706e876c42bd3a802465cb

SHA1
837391023d7837357ba40f9a97bfe502b331147a

SHA256
c1d738aaafaad81a707b870703ba1ea84efaf121a12aad2124bb4238f3ce39c5

SHA512
68f2fbcedb69b876e29acdec8490a4d446f2499ffe771ef1fa84f27bbd371b2ef5469bb149b3c868db26e414c27f313b35bed189c4f558db8db902398a48db33

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\StepCopy.docx

Filesize
19KB

MD5
9ccb45bfd036f6cf9b406cd87128d562

SHA1
e51659b653a711640c1f2227ea468b6fbe40cb7f

SHA256
796a121168ad749d8d854ab848896aebb1cad62306f9afb45a38bb42a63d9897

SHA512
0c434b7e81d48bc09a27d91b21b8313f744d4f983b230338ded691436ec481fad078121309861588f81f68361ec02e3dca348971d563a85e23c62bcb6fa44036

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UnprotectPop.docx

Filesize
15KB

MD5
8ed190f8f0957b4df44a39d7fedfc038

SHA1
1c6fa2f84abffcc1b78931c90b6187adb81badd4

SHA256
79e7caf6133850c8cf94a921a71878b0d923a954f841bb5fe5b4ec9cffa171e0

SHA512
a65598c45163e0830fd60c32c1ed0224e3833c267a49a9e3a70918c2c8cfa9c2131594b0ceba4cdea2195a6edf0ba0862546a18c8f34c5a2f97be3a00d77951d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\AssertDisconnect.mp4

Filesize
412KB

MD5
eac3cdead3818fb667cc02fc7438feb8

SHA1
16f715aa880e36674d7d4e350525f1a3a056d74d

SHA256
fc8a5b25574628cf021bad121faf343eedb21b4f11b31856a4e5667a8d12a6d4

SHA512
fd3bcc0a535272eac1ca24e188a45ee0f9ee2ded63c1bcca9061512a26781dec930b2f493637b0c9b30fb9d6a969c014e68d1d768a35eb82b6c17f81dc9d8443

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\CloseReset.png

Filesize
652KB

MD5
fced67f1044f7d04f6a27000e04d2aec

SHA1
aff256f1f7517edf94b1b43a260f50d2561d895a

SHA256
461432567f82a5c87113ed4b164dd2da1bdf47a351a12b2a8f40a08a5560d345

SHA512
a903962853a01e7b28d414836fbd9e08e2cd251e9e4a8a78095e3766feccdc5c6de29bc12d24db0877f3eb2295079cbd3277ee56559493a53de344e7fc15a84a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\NewClose.zip

Filesize
1.1MB

MD5
f124abe2f8a8bfa60db1f332427464ba

SHA1
472b392a3b152c1c1ed6dc7a73d9a246632dd1ea

SHA256
c3f929ea37ccd9043c799cc492e96739bc145693ff34697381808dd87b42fbf1

SHA512
40b1686a0a92109fadcfa3cbb5cadb6315764ab83ac623dc41ace87de98664addd30f0b33639e60fa82250c8b603f238a5021bcf624637030a8b2e15cc1be73e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\SplitOut.csv

Filesize
732KB

MD5
20e4c754a0f91c94d806adea59ec0a9a

SHA1
ca1973cdb4cd8b002cc71ea8207807b8c67f5384

SHA256
40f61c5b7a04b26a289fe51076981de4548da56ff00ea8e555d71433e5da03ed

SHA512
edb6e82714a34f452038128e5b5cefa19211b213c42982f30c0036bc4aa1fe3f644627058cc9ee831645b92c0689f45cd89668b7e9296ad07229b6e79346eaa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ConvertResolve.jpg

Filesize
279KB

MD5
9b308756d565e205d8ee36265710abcf

SHA1
8078b854ccfe62d21d32a6619c585ce9793c488d

SHA256
f89ea5a384bd9d38d26f65e6ada40649e19d6684bbdad4dcd0cd3b9f20cd7874

SHA512
8b49322bbd819bbffdd9066d64df3592afc6187ad07708babb9a4661cd93f316f36dd960ea41b5920fae58e1c009955a431a39da55c7d074d10b5c71ecfb2610

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\RestoreEdit.png

Filesize
507KB

MD5
d99cdf5b02b03e0394f77abe35f0e619

SHA1
dd00ea890b22cf87b499cca8459c9e46e97ef9a1

SHA256
39cafc030c946096c1dc232514fbda3a3a0990900f91368c078a62753ff10dd8

SHA512
94b247ec2817aab00ca11dc84fb31af8fcd41fbddbb493675f4eeba21157ccc03e5712055ee7ca5d60387c7c110860fb2864a6b72edd9cfcdbd7a488e0f4f605

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_35euya3u.c0v.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 210964.crdownload

Filesize
10.9MB

MD5
dc4042b46991cb73c1553b09092e17f1

SHA1
ee7ab82432a0f570d2589af29c228413c4afcbe4

SHA256
d20fc374d874a6ee0191abee824a69bffd472d4419875ddac5346d16cc82e725

SHA512
3a0546b48476a1d196f81e150d72d22381bcb35981d41013878fbda526b4cfc6350fd75603fc1f0bbc979bb8c50a4a3ea984054e251278faf96c8274f081b4ea

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 476956.crdownload

Filesize
25.3MB

MD5
b51e0889be50c55fbdd809f4ad587120

SHA1
83fe285f86628108a5a5b12347713f24aaffa7a8

SHA256
1206721601a62c925d4e4a0dcfc371e88f2ddbe8c0c07962ebb2be9b5bde4570

SHA512
912b710007c7b29f29c0097aff8f825412166eed7777a7cef135b14316e8fff31b5df56d26d835d8ca090468cc0e914730f201a56caa3dd6dbef2f91088942b1

Download Submit
C:\Users\Admin\Downloads\lazy.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/2480-1647-0x00007FFB78600000-0x00007FFB78612000-memory.dmp

Filesize
72KB

Download
memory/2480-1663-0x00007FFB7B680000-0x00007FFB7B68A000-memory.dmp

Filesize
40KB

Download
memory/2480-1669-0x00007FFB798A0000-0x00007FFB798C4000-memory.dmp

Filesize
144KB

Download
memory/2480-1670-0x00007FFB7EE00000-0x00007FFB7EE0F000-memory.dmp

Filesize
60KB

Download
memory/2480-1671-0x00007FFB7DEE0000-0x00007FFB7DEF9000-memory.dmp

Filesize
100KB

Download
memory/2480-1672-0x00007FFB7B690000-0x00007FFB7B69D000-memory.dmp

Filesize
52KB

Download
memory/2480-1673-0x00007FFB7A9B0000-0x00007FFB7A9C9000-memory.dmp

Filesize
100KB

Download
memory/2480-1674-0x00007FFB75470000-0x00007FFB7549D000-memory.dmp

Filesize
180KB

Download
memory/2480-1675-0x00007FFB74D40000-0x00007FFB74D63000-memory.dmp

Filesize
140KB

Download
memory/2480-1676-0x00007FFB74BC0000-0x00007FFB74D33000-memory.dmp

Filesize
1.4MB

Download
memory/2480-1679-0x00007FFB74AD0000-0x00007FFB74B88000-memory.dmp

Filesize
736KB

Download
memory/2480-1680-0x00007FFB786E0000-0x00007FFB786F5000-memory.dmp

Filesize
84KB

Download
memory/2480-1681-0x00007FFB78600000-0x00007FFB78612000-memory.dmp

Filesize
72KB

Download
memory/2480-1682-0x00007FFB74AB0000-0x00007FFB74AC4000-memory.dmp

Filesize
80KB

Download
memory/2480-1683-0x00007FFB74A50000-0x00007FFB74A64000-memory.dmp

Filesize
80KB

Download
memory/2480-1684-0x00007FFB6DF70000-0x00007FFB6E08C000-memory.dmp

Filesize
1.1MB

Download
memory/2480-1685-0x00007FFB74A20000-0x00007FFB74A42000-memory.dmp

Filesize
136KB

Download
memory/2480-1686-0x00007FFB74A00000-0x00007FFB74A17000-memory.dmp

Filesize
92KB

Download
memory/2480-1687-0x00007FFB72AB0000-0x00007FFB72AC9000-memory.dmp

Filesize
100KB

Download
memory/2480-1688-0x00007FFB6DF20000-0x00007FFB6DF6D000-memory.dmp

Filesize
308KB

Download
memory/2480-1689-0x00007FFB72A90000-0x00007FFB72AA1000-memory.dmp

Filesize
68KB

Download
memory/2480-1690-0x00007FFB7B680000-0x00007FFB7B68A000-memory.dmp

Filesize
40KB

Download
memory/2480-1691-0x00007FFB71470000-0x00007FFB7148E000-memory.dmp

Filesize
120KB

Download
memory/2480-1694-0x00007FFB72AD0000-0x00007FFB730B8000-memory.dmp

Filesize
5.9MB

Download
memory/2480-1692-0x00007FFB63350000-0x00007FFB63AF1000-memory.dmp

Filesize
7.6MB

Download
memory/2480-1677-0x00007FFB74B90000-0x00007FFB74BBE000-memory.dmp

Filesize
184KB

Download
memory/2480-1678-0x00007FFB63B00000-0x00007FFB63E75000-memory.dmp

Filesize
3.5MB

Download
memory/2480-1693-0x00007FFB69AE0000-0x00007FFB69B18000-memory.dmp

Filesize
224KB

Download
memory/2480-1667-0x00007FFB69AE0000-0x00007FFB69B18000-memory.dmp

Filesize
224KB

Download
memory/2480-1665-0x00007FFB786E0000-0x00007FFB786F5000-memory.dmp

Filesize
84KB

Download
memory/2480-1666-0x00007FFB63350000-0x00007FFB63AF1000-memory.dmp

Filesize
7.6MB

Download
memory/2480-1661-0x00007FFB63B00000-0x00007FFB63E75000-memory.dmp

Filesize
3.5MB

Download
memory/2480-1662-0x00007FFB72A90000-0x00007FFB72AA1000-memory.dmp

Filesize
68KB

Download
memory/2480-1664-0x00007FFB71470000-0x00007FFB7148E000-memory.dmp

Filesize
120KB

Download
memory/2480-1660-0x00007FFB74AD0000-0x00007FFB74B88000-memory.dmp

Filesize
736KB

Download
memory/2480-1659-0x00007FFB74B90000-0x00007FFB74BBE000-memory.dmp

Filesize
184KB

Download
memory/2480-1655-0x00007FFB74BC0000-0x00007FFB74D33000-memory.dmp

Filesize
1.4MB

Download
memory/2480-1656-0x00007FFB74A00000-0x00007FFB74A17000-memory.dmp

Filesize
92KB

Download
memory/2480-1657-0x00007FFB72AB0000-0x00007FFB72AC9000-memory.dmp

Filesize
100KB

Download
memory/2480-1658-0x00007FFB6DF20000-0x00007FFB6DF6D000-memory.dmp

Filesize
308KB

Download
memory/2480-1654-0x00007FFB74D40000-0x00007FFB74D63000-memory.dmp

Filesize
140KB

Download
memory/2480-1653-0x00007FFB74A20000-0x00007FFB74A42000-memory.dmp

Filesize
136KB

Download
memory/2480-1652-0x00007FFB75470000-0x00007FFB7549D000-memory.dmp

Filesize
180KB

Download
memory/2480-1651-0x00007FFB6DF70000-0x00007FFB6E08C000-memory.dmp

Filesize
1.1MB

Download
memory/2480-1650-0x00007FFB74A50000-0x00007FFB74A64000-memory.dmp

Filesize
80KB

Download
memory/2480-1649-0x00007FFB74AB0000-0x00007FFB74AC4000-memory.dmp

Filesize
80KB

Download
memory/2480-1648-0x00007FFB7DEE0000-0x00007FFB7DEF9000-memory.dmp

Filesize
100KB

Download
memory/2480-1645-0x00007FFB798A0000-0x00007FFB798C4000-memory.dmp

Filesize
144KB

Download
memory/2480-1646-0x00007FFB786E0000-0x00007FFB786F5000-memory.dmp

Filesize
84KB

Download
memory/2480-1644-0x00007FFB63B00000-0x00007FFB63E75000-memory.dmp

Filesize
3.5MB

Download
memory/2480-1642-0x00007FFB74AD0000-0x00007FFB74B88000-memory.dmp

Filesize
736KB

Download
memory/2480-1641-0x00007FFB74B90000-0x00007FFB74BBE000-memory.dmp

Filesize
184KB

Download
memory/2480-1643-0x00007FFB72AD0000-0x00007FFB730B8000-memory.dmp

Filesize
5.9MB

Download
memory/2480-1640-0x00007FFB74BC0000-0x00007FFB74D33000-memory.dmp

Filesize
1.4MB

Download
memory/2480-1639-0x00007FFB74D40000-0x00007FFB74D63000-memory.dmp

Filesize
140KB

Download
memory/2480-1638-0x00007FFB75470000-0x00007FFB7549D000-memory.dmp

Filesize
180KB

Download
memory/2480-1637-0x00007FFB7A9B0000-0x00007FFB7A9C9000-memory.dmp

Filesize
100KB

Download
memory/2480-1636-0x00007FFB7B690000-0x00007FFB7B69D000-memory.dmp

Filesize
52KB

Download
memory/2480-1632-0x00007FFB72AD0000-0x00007FFB730B8000-memory.dmp

Filesize
5.9MB

Download
memory/2480-1633-0x00007FFB798A0000-0x00007FFB798C4000-memory.dmp

Filesize
144KB

Download
memory/2480-1634-0x00007FFB7EE00000-0x00007FFB7EE0F000-memory.dmp

Filesize
60KB

Download
memory/2480-1635-0x00007FFB7DEE0000-0x00007FFB7DEF9000-memory.dmp

Filesize
100KB

Download
memory/3652-1404-0x000001551C150000-0x000001551C172000-memory.dmp

Filesize
136KB

Download
memory/4948-1442-0x00007FFB754A0000-0x00007FFB754B5000-memory.dmp

Filesize
84KB

Download
memory/4948-1310-0x00007FFB61620000-0x00007FFB61793000-memory.dmp

Filesize
1.4MB

Download
memory/4948-1308-0x00007FFB75810000-0x00007FFB7583D000-memory.dmp

Filesize
180KB

Download
memory/4948-1307-0x00007FFB759C0000-0x00007FFB759D9000-memory.dmp

Filesize
100KB

Download
memory/4948-1306-0x00007FFB7DDE0000-0x00007FFB7DDED000-memory.dmp

Filesize
52KB

Download
memory/4948-1309-0x00007FFB756D0000-0x00007FFB756F3000-memory.dmp

Filesize
140KB

Download
memory/4948-1448-0x00007FFB74800000-0x00007FFB74817000-memory.dmp

Filesize
92KB

Download
memory/4948-1313-0x00007FFB617A0000-0x00007FFB61D88000-memory.dmp

Filesize
5.9MB

Download
memory/4948-1311-0x00007FFB74D90000-0x00007FFB74DBE000-memory.dmp

Filesize
184KB

Download
memory/4948-1302-0x00007FFB617A0000-0x00007FFB61D88000-memory.dmp

Filesize
5.9MB

Download
memory/4948-1312-0x00007FFB611E0000-0x00007FFB61298000-memory.dmp

Filesize
736KB

Download
memory/4948-1314-0x00007FFB612A0000-0x00007FFB61615000-memory.dmp

Filesize
3.5MB

Download
memory/4948-1315-0x00007FFB7D470000-0x00007FFB7D494000-memory.dmp

Filesize
144KB

Download
memory/4948-1316-0x00007FFB754A0000-0x00007FFB754B5000-memory.dmp

Filesize
84KB

Download
memory/4948-1317-0x00007FFB74D70000-0x00007FFB74D82000-memory.dmp

Filesize
72KB

Download
memory/4948-1319-0x00007FFB74970000-0x00007FFB74984000-memory.dmp

Filesize
80KB

Download
memory/4948-1318-0x00007FFB785E0000-0x00007FFB785F9000-memory.dmp

Filesize
100KB

Download
memory/4948-1323-0x00007FFB610C0000-0x00007FFB611DC000-memory.dmp

Filesize
1.1MB

Download
memory/4948-1322-0x00007FFB74900000-0x00007FFB74914000-memory.dmp

Filesize
80KB

Download
memory/4948-1449-0x00007FFB747E0000-0x00007FFB747F9000-memory.dmp

Filesize
100KB

Download
memory/4948-1320-0x00007FFB7DDE0000-0x00007FFB7DDED000-memory.dmp

Filesize
52KB

Download
memory/4948-1431-0x00007FFB7D470000-0x00007FFB7D494000-memory.dmp

Filesize
144KB

Download
memory/4948-1438-0x00007FFB61620000-0x00007FFB61793000-memory.dmp

Filesize
1.4MB

Download
memory/4948-1439-0x00007FFB74D90000-0x00007FFB74DBE000-memory.dmp

Filesize
184KB

Download
memory/4948-1440-0x00007FFB612A0000-0x00007FFB61615000-memory.dmp

Filesize
3.5MB

Download
memory/4948-1326-0x00007FFB74800000-0x00007FFB74817000-memory.dmp

Filesize
92KB

Download
memory/4948-1441-0x00007FFB611E0000-0x00007FFB61298000-memory.dmp

Filesize
736KB

Download
memory/4948-1304-0x00007FFB7E090000-0x00007FFB7E09F000-memory.dmp

Filesize
60KB

Download
memory/4948-1447-0x00007FFB74850000-0x00007FFB74872000-memory.dmp

Filesize
136KB

Download
memory/4948-1305-0x00007FFB785E0000-0x00007FFB785F9000-memory.dmp

Filesize
100KB

Download
memory/4948-1321-0x00007FFB759C0000-0x00007FFB759D9000-memory.dmp

Filesize
100KB

Download
memory/4948-1450-0x00007FFB707C0000-0x00007FFB7080D000-memory.dmp

Filesize
308KB

Download
memory/4948-1430-0x00007FFB617A0000-0x00007FFB61D88000-memory.dmp

Filesize
5.9MB

Download
memory/4948-1443-0x00007FFB74D70000-0x00007FFB74D82000-memory.dmp

Filesize
72KB

Download
memory/4948-1456-0x00007FFB7EE10000-0x00007FFB7EE1D000-memory.dmp

Filesize
52KB

Download
memory/4948-1423-0x00007FFB60910000-0x00007FFB610B1000-memory.dmp

Filesize
7.6MB

Download
memory/4948-1419-0x00007FFB707C0000-0x00007FFB7080D000-memory.dmp

Filesize
308KB

Download
memory/4948-1327-0x00007FFB756D0000-0x00007FFB756F3000-memory.dmp

Filesize
140KB

Download
memory/4948-1303-0x00007FFB7D470000-0x00007FFB7D494000-memory.dmp

Filesize
144KB

Download
memory/4948-1403-0x00007FFB7EE10000-0x00007FFB7EE1D000-memory.dmp

Filesize
52KB

Download
memory/4948-1364-0x00007FFB74800000-0x00007FFB74817000-memory.dmp

Filesize
92KB

Download
memory/4948-1360-0x00007FFB74850000-0x00007FFB74872000-memory.dmp

Filesize
136KB

Download
memory/4948-1351-0x00007FFB610C0000-0x00007FFB611DC000-memory.dmp

Filesize
1.1MB

Download
memory/4948-1339-0x00007FFB6E940000-0x00007FFB6E978000-memory.dmp

Filesize
224KB

Download
memory/4948-1338-0x00007FFB60910000-0x00007FFB610B1000-memory.dmp

Filesize
7.6MB

Download
memory/4948-1330-0x00007FFB74D90000-0x00007FFB74DBE000-memory.dmp

Filesize
184KB

Download
memory/4948-1332-0x00007FFB612A0000-0x00007FFB61615000-memory.dmp

Filesize
3.5MB

Download
memory/4948-1333-0x00007FFB707C0000-0x00007FFB7080D000-memory.dmp

Filesize
308KB

Download
memory/4948-1337-0x00007FFB74580000-0x00007FFB7459E000-memory.dmp

Filesize
120KB

Download
memory/4948-1335-0x00007FFB754A0000-0x00007FFB754B5000-memory.dmp

Filesize
84KB

Download
memory/4948-1336-0x00007FFB78620000-0x00007FFB7862A000-memory.dmp

Filesize
40KB

Download
memory/4948-1334-0x00007FFB74750000-0x00007FFB74761000-memory.dmp

Filesize
68KB

Download
memory/4948-1331-0x00007FFB611E0000-0x00007FFB61298000-memory.dmp

Filesize
736KB

Download
memory/4948-1324-0x00007FFB75810000-0x00007FFB7583D000-memory.dmp

Filesize
180KB

Download
memory/4948-1325-0x00007FFB74850000-0x00007FFB74872000-memory.dmp

Filesize
136KB

Download
memory/4948-1328-0x00007FFB61620000-0x00007FFB61793000-memory.dmp

Filesize
1.4MB

Download
memory/4948-1329-0x00007FFB747E0000-0x00007FFB747F9000-memory.dmp

Filesize
100KB

Download