meduza | hxxps://www[.]mediafire[.]com/folder/u2is2eo3euyqd/Loader

Analysis

max time kernel
530s
max time network
530s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06-10-2024 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/u2is2eo3euyqd/Loader

Score

10^/10

meduza collection discovery spyware stealer

Malware Config

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/3420-1230-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza
behavioral1/memory/3420-1235-0x0000000140000000-0x000000014013B000-memory.dmp	family_meduza

Executes dropped EXE 2 IoCs

pid	Process
1440	installer.exe
3420	installer.exe

Loads dropped DLL 1 IoCs

pid	Process
1440	installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	installer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	installer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	installer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	installer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
156	api.ipify.org
199	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 3420	1440	installer.exe	108

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3400	cmd.exe
3096	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Loader\installer.exe:a.dll	installer.exe
File opened for modification	C:\Users\Admin\Downloads\Loader.zip:Zone.Identifier	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3096	PING.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1488	msedge.exe
1488	msedge.exe
4868	msedge.exe
4868	msedge.exe
5112	identity_helper.exe
5112	identity_helper.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
2304	msedge.exe
2304	msedge.exe
3420	installer.exe
3420	installer.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	4424	7zG.exe
Token: 35	4424	7zG.exe
Token: SeSecurityPrivilege	4424	7zG.exe
Token: SeSecurityPrivilege	4424	7zG.exe
Token: SeDebugPrivilege	3420	installer.exe
Token: SeImpersonatePrivilege	3420	installer.exe
Token: SeDebugPrivilege	3108	taskmgr.exe
Token: SeSystemProfilePrivilege	3108	taskmgr.exe
Token: SeCreateGlobalPrivilege	3108	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe
3108	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1328	1488	msedge.exe	78
PID 1488 wrote to memory of 1328	1488	msedge.exe	78
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 3908	1488	msedge.exe	79
PID 1488 wrote to memory of 1388	1488	msedge.exe	80
PID 1488 wrote to memory of 1388	1488	msedge.exe	80
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81
PID 1488 wrote to memory of 1920	1488	msedge.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	installer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	installer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/u2is2eo3euyqd/Loader
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb6c0f3cb8,0x7ffb6c0f3cc8,0x7ffb6c0f3cd8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1320 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1924,16886748856210055234,1816270237856381904,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1364 /prefetch:8
  2⤵
  PID:988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1220

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Loader\" -spe -an -ai#7zMap28953:74:7zEvent25471
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Users\Admin\Downloads\Loader\installer.exe
"C:\Users\Admin\Downloads\Loader\installer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
PID:1440
- C:\Users\Admin\Downloads\Loader\installer.exe
  "C:\Users\Admin\Downloads\Loader\installer.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3420
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Downloads\Loader\installer.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3400
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3096

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f3ad2c2-6ab3-4270-91cd-8db11a713ea6.tmp

Filesize
3KB

MD5
9c16e46ff35b348cd2ee97cfc0640bdf

SHA1
0d40cfd8ad06ca7da8dbfa19e057ace89151ac7b

SHA256
8640c3517f36a670a29877b3ac31fa046554830360b790a9447b2d731fd6f1a7

SHA512
112e0377ca9b33b8d3935d0880969d33e36b514cd805706558c861d37ff85d4b7debd16286b93ca8b101b81507cbd7b36b9df07b36e06bc57ee9886e9d27b3b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
ae50813c52ce2400d19db6c7b7363350

SHA1
19ff4320bc6d942c5f6a6e3e404470e9e258d3b1

SHA256
84f1e04748c51cb5a9ed40a1f3418d093f6ab05a7785f35fc7e888bd77cfcb41

SHA512
1bb20c4e8c2175f63b6c48c42c200c303cb321fdd8e17549e7b2c3db7772060206d74a4763b0a5274967b024a6e1f959b2b10e98e1e0b5e8bed164ccfb098cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2ff8f476d10313db3bd9a9f82cde04bb

SHA1
029e42064e6e42f2c7827a012bc125d55b0db0a2

SHA256
4fcd2d81bfb39632baade00812c05a5959631f8d2a35d4661d876675f366f915

SHA512
e3751b140ebf48af4e8df12a33297100b90cc89d13ecb8c529177af9f4518cca996e4bb09221cb7607f684d3a9c5b2aeef01ba14dd9e7c8d5ad85f634860e7bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
a30045de540ef5b9d15bf899c9dc3d35

SHA1
1cd5bc4d144b000423909aa09e8ecb6a5c487d6e

SHA256
c248562e176cd9efdd9a018ed61620bccba4ba8c574b2d4f5dbdad182a6b60a8

SHA512
557b5d8debcf30f67d3f868805af584080619daf69e1c3acf7ba0b9fdf260b67a7ab35a702536c24fe19ecd394657621338ebebbbd43aac88a5f2b65a1f99aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
32KB

MD5
117b10b43e60d9b553c8fe48d904a0c4

SHA1
017814a7e969aa35b2ea12543daa4fb8364ce7dc

SHA256
6571a735bf39b385c1f7e21f713db380ecafef22a0bfc63c1a6fae84b1eac84b

SHA512
29e0e5e64f8881932f214ec2ba52b2f8fbf04a2b755ac615774d04bc6d4d212493728104be43a96d3d9cf4c6812c2efdcfc350db027f5deb5f728bcd5147e925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
132KB

MD5
6aae4767e4adf8d1bc0f13029bc3cf6f

SHA1
e8400ac24e0f453a3d05ecca00d8580e65bba65e

SHA256
00180c58cc906dd4836ea74c8565d06b761ae803d1e2d9b5f2c4072794b11a70

SHA512
2123a8f3ae67881504e43499fba29084f20edbf69387e6c669f11be7a3c22d2d4a4b412d992ab944b8dfde28cbc158118743a5433f42be44182c543c440795c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
3KB

MD5
7d0c532e407ea25015c119eb09cf2bf3

SHA1
232f58a84b12b3feab4761e443dd4423de1e4aeb

SHA256
30ded3ecd33906ea2de85cf1a75b93239b21c3c60e8774d115c03c4b06f8f65c

SHA512
c51123ababff0547b222d75b925b7e71f8412e456c11894d3b32e6be8dca1c50ac8bb48ced3cf81c0ab034647ba78056e921e927c43a6cf5593d137ed6173809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
57a4294ead35c6eaff48ccfcbbf7160c

SHA1
7e2772fc6484341688929800d721989ee6947a37

SHA256
42d406ffafcbc5a81ce18a6478de72a4652e850ad41d10f4891b160a5c58f2df

SHA512
ce871154411f8a9dec9aa9f274d76dc1864a69c3acca2cfac89ec50d4a44a37e4e412de4b3138feb60342af9a29a1a72f0343e02d01b844d3adc8ec42cd1da1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
8f15f51fcaa52ca29dfd7672f3657436

SHA1
e1700f37af80a2b9fbd62f1c43c02b80c50669dc

SHA256
c1c94c1a70e20b08b0227b23d544b8e5ac2e6c8f37808ffb57650aed2583d207

SHA512
034bcde6c5ea3b7c7e53410fcff36a09b5ce67eef405f0a8f910dd4ccad0ae36301d3eb5df59e3d59f6180a63f4e281395070fdfa0f5fcb3c327b7b71e38b330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39366c589ad0dd979ae80adf7f594110

SHA1
5e16013d0c88421602c3d6fd17ec880c3e1c7e3a

SHA256
4ddfba5f9da7fb48c498084a6a2415fa0a31add866a961a8c8c1e86ef6ad0352

SHA512
412f6f5499707bf4ef15f336fd23e712bdbf5960f689843f6b85ff8d934631461a7aaf174808a91e3fb8c850f2e94bff0516bbc98cf0ac5fbddbc23775e362bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
185f3231644d9cb2ef67e6dc55edd081

SHA1
e079d42963c3dd2ea6d634e6f27eb1eee121ebb8

SHA256
4109eb4422691b968900377ca943b1735d484ef6efb23e676cb4120ad80f8d33

SHA512
fa3fdb272be6e7debb9f5fffec8f71f56b46850662a89bbce4a77a2429b66ccaaeda6f51674a7a7247435a1ed51c682703bbd961877b62a5e2b23cf1fc48e6e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
4d6d953b499a176d935988df9bc3f921

SHA1
68f6083198448e87976a1d3724b0a7770f5a5236

SHA256
c5b275d3e738146333142ec2d3e51d1072725941f42ef529e0292b5d62a441c9

SHA512
34051dab17084641464714a41a7b991483a50e376669febbe38718fe63a6b9c3221f1d021494f6cac5d1f722574dcafaaa81ebd4fb7bf00dffe7694ba3fc3a05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9604a3e8702d8b5b2b4592eaf828dbe0

SHA1
dccbfc745f6cffbebafea3c8b26a09cb28425906

SHA256
25fa0a3ea909e1107774f8e29d548ce463371db57d485ecadec2c153b69fa509

SHA512
855b711f706306ba7f121b758824c39a947c0a339d57c12429409b8895ead239f589bd2e85b07336989d4e9bd0945a672bbe5698fd1f04a82a85ad5635b9cde7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7f845190adeb44acf5381276f1e8a6f9

SHA1
70e96bdd28fb4d4e6e7642e2b0802e5d4debe860

SHA256
2c5cbb6416ff6ea62312aed7bfb604bcfb803be89608a4995e2feb5aeb44a150

SHA512
4ed4a609faf408a6df8be08228c3b504e7549effe67a7de202ecc079e69f669552b171b490d6b6c07a24c06ee2d4ef7b7f7029e7241bbc3049fdb6ec88fbc7d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
764fa55c3ed2164b25c55eef5f0fba13

SHA1
29d0c52b48c33ea6b4d722628bf6a1bab87adb74

SHA256
ead91d05907d3cb07fe4038cc98293fe7dc8e6c33588582d5a40b381f7385082

SHA512
973deb70c3853dec49ab509a34dca4ab4f8fc544c7e0cde90c19b4972f1391bee15a978c3126dceb9fcfa551e028437f8a94bb5a463fe0916388985670f38ed2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ba230e2745899478560360002daabdbf

SHA1
32941b097cfa9c65f7c95f929a9d99aa64bff82c

SHA256
22ad20d31cd4af510a28fb48b8fcd4a4d38afc7ef89ca50b701980d08a40f028

SHA512
8341b736126386b96eec71fbe8aab679be05897aa0b7e150dfd22f980f67f8389a8a18abbbd3fd2924d76e5d1d54f8be664b395fd74e853ce4cc66d44ca5f79f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f817.TMP

Filesize
1KB

MD5
249c3be94d97561b1d569e36c4924651

SHA1
4646b01bbb3b31acb2de95445d2b92c581cbefd9

SHA256
3b5524bfb65c4312684bb03513396efed0704e528ef1d6cac3f9ede9b2070b4f

SHA512
18c7a08c0550597426cf35e1d098fda0661938021144ea54f00196afbd4956cdf0ebb133f8229f6031476f8c9f774d64b591bb24280de10a5dcaff722c941b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4451083-f86c-43a3-8702-72fdcf56353e.tmp

Filesize
10KB

MD5
7539806f1ffc76f5bb19f27bc3da72ab

SHA1
8c6e262f0d5b2181e98d95f5cd050d3ff6d71db4

SHA256
62aec193a2d07c325e44d08917ac92b2dc41d0f5fc69b4c2b4f477a56cfaf482

SHA512
58cfebeba80f8151f6efbcff69a2c037a4aebeac3a1586ccde4a476d6091f8b97923f51526bf587c87743e5e00ffdbf26e4831ef3e58368ffba66c0f614da1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
47ac57aace82a7e15558128ab402bb02

SHA1
6c5c1d7e71f0060524394ee27365755def169fa2

SHA256
053fa2e453b08d7ff60ed1fe431731b4994957c58c4c091c64dddf74d8426c5e

SHA512
6aa139e541b1dd13dfe4a7a410ecc874824d47250a77f59f3149ad95b4c120c67c99ec54b2129eb14452ae9340979c6cf50a17519d7134d17cdb8a93bbda23ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
77f89e163c0102698b31fc75696e9a9d

SHA1
d14261d36cce239cbde897effc9da0ed2fe64a3f

SHA256
b1f7e1cb6cf16f75f47fcbd8f4d3c5b9f760e1781602064f6c11dcd154026978

SHA512
7fdaf6b56aa065b2568bd6a7e2089aea520a451fbc457d684750e98958273ef5dcabb6c7ad977ce86107870111e01144a126fefbab6bf825abfa99bf9ab3be15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0567933c590dc3d28d61d0edcef09719

SHA1
89aeedfeaa44b4c230f43e6fb2499b59a4e5c7e1

SHA256
ea54c1bf21edcb1cef8bf89baba0f04377d57e012eba79280718011240065ae6

SHA512
f10b30188bcf3babe060b4cdedc5da4f31af964426c5b1ce49be7ee2ad5fcdcdc3916bdcb0b19cc7720100cd203b353860eb4d6402a9d5d735f6aedf83a2811f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9f68634e53fd935212724bc51941fd87

SHA1
a3c04487f6272cf7ed0a2e2ccc857fb893a26492

SHA256
8bfba6dfb184b609ada457fc72a1709f88d27405dd3c8bfd5e80501cab05139e

SHA512
36d014c874255ac1b7720a145bb6ed1810497c2e387bb2315458a42b9cc820f857ff9e2872d2818638da5ca330a6601ed9dd197628344365aeebdd3227331673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
38a986cf3c940e1e39d2842033d678bc

SHA1
e433e368261d60c9416a3378e3ae81a31a463eaa

SHA256
7831669025e8c121eb51103fccfbb9bdc51f64a31ccbcd35e72d86d940e16098

SHA512
47bcd6f1bc241378b74cc48f29076802f35624ad409bed468c57491d569d68d3848a59f886c4de1bf110672c2d08ad3635714d8b985bcd04d1f536c601cbd5d2

Download Submit
C:\Users\Admin\Downloads\Loader.zip

Filesize
14.0MB

MD5
43c19b86fc4b28214c8677d059972651

SHA1
51ee28d7b2022c1a90e0715cf271822b6da46b7f

SHA256
4675b1a4dea8614b39c8d8c2bdef62ee6bcedbb0c7f3bfcb71ed3b318d912e70

SHA512
9f7a001fd08834069ff247383b1d23a22d7c533346340142366f5ddba99cac3bfc06310dbb573368378b2b012b34d80417ad3b68aa00557a799d94c053d07d95

Download Submit
C:\Users\Admin\Downloads\Loader.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Loader\installer.exe

Filesize
1.7MB

MD5
5ec3beff6f047e78d3b8c387c1e2fd54

SHA1
57a060f9d9e6e031afeb9cd3f0e7f3d8f9d9e4f6

SHA256
0c42a6a3560787046f899d3810849abb897df7db3addcfc58a1fda7cf4af2e71

SHA512
973e543e0499a1aedac2d073d5b432735e01b957406f621b778b9f1cefa14eab592f21cd753888e493c50c16ccf60459bb279c8a013541d21c51ba501329a1dd

Download Submit
C:\Users\Admin\Downloads\Loader\installer.exe:a.dll

Filesize
1.4MB

MD5
df78ee7df53b4f87d21be2cbb882e54c

SHA1
3335f1a7c50a6510672d9df7173d436a0b688161

SHA256
83780fe76d28b5a97626920677e48c47262285d8957c09ce45c128b6bd3a5ba2

SHA512
d5f5299279fcfbb4c4df06e304f2129bf7d374090270cf7ed1fbb15e9a140fdc00449669c2bad2a464ab013dec052d55de475c88922d8cc6dcc83cd41d5a1618

Download Submit
memory/1440-1233-0x00007FFB58FB0000-0x00007FFB59114000-memory.dmp

Filesize
1.4MB

Download
memory/1440-1232-0x00007FF607800000-0x00007FF6079B5000-memory.dmp

Filesize
1.7MB

Download
memory/3108-1268-0x000001A9F7DE0000-0x000001A9F7DE1000-memory.dmp

Filesize
4KB

Download
memory/3108-1267-0x000001A9F7DE0000-0x000001A9F7DE1000-memory.dmp

Filesize
4KB

Download
memory/3108-1269-0x000001A9F7DE0000-0x000001A9F7DE1000-memory.dmp

Filesize
4KB

Download
memory/3108-1279-0x000001A9F7DE0000-0x000001A9F7DE1000-memory.dmp

Filesize
4KB

Download
memory/3108-1278-0x000001A9F7DE0000-0x000001A9F7DE1000-memory.dmp

Filesize
4KB

Download
memory/3108-1277-0x000001A9F7DE0000-0x000001A9F7DE1000-memory.dmp

Filesize
4KB

Download
memory/3108-1276-0x000001A9F7DE0000-0x000001A9F7DE1000-memory.dmp

Filesize
4KB

Download
memory/3108-1275-0x000001A9F7DE0000-0x000001A9F7DE1000-memory.dmp

Filesize
4KB

Download
memory/3108-1274-0x000001A9F7DE0000-0x000001A9F7DE1000-memory.dmp

Filesize
4KB

Download
memory/3108-1273-0x000001A9F7DE0000-0x000001A9F7DE1000-memory.dmp

Filesize
4KB

Download
memory/3420-1230-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download
memory/3420-1235-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download