njrat | hxxps://forum[.]hackthebox[.]com/t/openbullet-2-v0-2-4/264662

Analysis

max time kernel
437s
max time network
438s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2024 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://forum.hackthebox.com/t/openbullet-2-v0-2-4/264662

Score

10^/10

njrat hacked defense_evasion discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

7cpanel.hackcrack.io:46143

Mutex

Windows Explorer

Attributes

reg_key
Windows Explorer
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
3304	powershell.exe
3852	powershell.exe
5828	powershell.exe
2400	powershell.exe
5628	powershell.exe
6060	powershell.exe
5860	powershell.exe
1112	powershell.exe
6060	powershell.exe
5860	powershell.exe
1112	powershell.exe
3304	powershell.exe
3852	powershell.exe
5828	powershell.exe
2400	powershell.exe
5628	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exe

pid	Process
6948	netsh.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OpenBullet 2.exeSetup.exeSetup.exeOpenBullet 2.exeSetup.exesvchost.exeversion.exeexplorer.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	OpenBullet 2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	OpenBullet 2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	version.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 13 IoCs

Processes:

OpenBullet 2.exeSetup.exeSetup.exeOpenBullet2.exesvchost.exesvchost.exeOpenBullet 2.exeSetup.exeOpenBullet2.exesvchost.exeexplorer.exeversion.exeexplorer.exe

pid	Process
5832	OpenBullet 2.exe
5936	Setup.exe
5656	Setup.exe
3816	OpenBullet2.exe
2004	svchost.exe
5636	svchost.exe
3348	OpenBullet 2.exe
4668	Setup.exe
452	OpenBullet2.exe
3460	svchost.exe
4388	explorer.exe
5428	version.exe
6832	explorer.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Setup.exeSetup.exeSetup.exeexplorer.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ."	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ."	explorer.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

Setup.exe

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	Setup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Setup.exe

Hide Artifacts: Hidden Window 1 TTPs 8 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

Processes:

cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

pid	Process
3076	cmd.exe
5256	cmd.exe
3032	cmd.exe
2188	cmd.exe
5364	cmd.exe
3484	cmd.exe
5840	cmd.exe
5348	cmd.exe

Drops file in System32 directory 1 IoCs

Processes:

OpenBullet 2.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\OpenBullet2.exe	OpenBullet 2.exe

Drops file in Windows directory 3 IoCs

Processes:

Setup.exe

description	ioc	Process
File opened for modification	C:\Windows\assembly	Setup.exe
File created	C:\Windows\assembly\Desktop.ini	Setup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

Processes:

taskkill.exe

pid	Process
228	taskkill.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exetaskmgr.exeexplorer.exe

pid	Process
1872	msedge.exe
1872	msedge.exe
4036	msedge.exe
4036	msedge.exe
1600	identity_helper.exe
1600	identity_helper.exe
2512	msedge.exe
2512	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid	Process
3836	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

Processes:

msedge.exe

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exesvchost.exesvchost.exesvchost.exetaskmgr.exeexplorer.exepowershell.exepowershell.exetaskkill.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeexplorer.exe

description	pid	Process
Token: SeRestorePrivilege	6132	7zG.exe
Token: 35	6132	7zG.exe
Token: SeSecurityPrivilege	6132	7zG.exe
Token: SeSecurityPrivilege	6132	7zG.exe
Token: SeDebugPrivilege	5636	svchost.exe
Token: SeDebugPrivilege	2004	svchost.exe
Token: SeDebugPrivilege	3460	svchost.exe
Token: SeDebugPrivilege	3836	taskmgr.exe
Token: SeSystemProfilePrivilege	3836	taskmgr.exe
Token: SeCreateGlobalPrivilege	3836	taskmgr.exe
Token: SeDebugPrivilege	4388	explorer.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	5628	powershell.exe
Token: SeDebugPrivilege	5860	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	6060	powershell.exe
Token: SeDebugPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe
Token: SeIncBasePriorityPrivilege	6832	explorer.exe
Token: 33	6832	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe
3836	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

explorer.exe

pid	Process
4388	explorer.exe
4388	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4036 wrote to memory of 2816	4036	msedge.exe	83
PID 4036 wrote to memory of 2816	4036	msedge.exe	83
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 516	4036	msedge.exe	84
PID 4036 wrote to memory of 1872	4036	msedge.exe	85
PID 4036 wrote to memory of 1872	4036	msedge.exe	85
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86
PID 4036 wrote to memory of 1376	4036	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://forum.hackthebox.com/t/openbullet-2-v0-2-4/264662
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8e1646f8,0x7ffc8e164708,0x7ffc8e164718
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7924 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7992 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7980 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12566576013918780615,3956821241662754756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8284 /prefetch:1
  2⤵
  PID:6240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2112

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap10265:100:7zEvent6911
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Users\Admin\Downloads\OpenBullet2\OpenBullet 2.exe
"C:\Users\Admin\Downloads\OpenBullet2\OpenBullet 2.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:5832
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  PID:5936
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5636
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4388
    - - \??\c:\windows\system32\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\2pm2d0hr.inf
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:6832
      - C:\Windows\system32\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:6948
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5656
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- C:\Windows\system32\OpenBullet2.exe
  "C:\Windows\system32\OpenBullet2.exe"
  2⤵
  - Executes dropped EXE
  PID:3816

C:\Users\Admin\Downloads\OpenBullet2\OpenBullet 2.exe
"C:\Users\Admin\Downloads\OpenBullet2\OpenBullet 2.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3348
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4668
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- C:\Windows\system32\OpenBullet2.exe
  "C:\Windows\system32\OpenBullet2.exe"
  2⤵
  - Executes dropped EXE
  PID:452

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3836

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\msedge.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\msedge.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SystemSettingsBroker.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SystemSettingsBroker.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5860

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
6adf1279b9291d448b6bca0bf328b1cf

SHA1
575fb66eb60b4f45ff41c7e355f4e605d1077857

SHA256
0d820d8576193374c3626c458bfda679d047f82afcf85709e600d52e8343c8cf

SHA512
edd041ac2e8a949c0af5b3de39654fdc48b526c3953c29f441c26e5cf250ae76cdea30ae7554c2e0dfec70da19204a47ae32a7b812c5f859944041cd9b2912ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\OpenBullet 2.exe.log

Filesize
408B

MD5
8e1e19a5abcce21f8a12921d6a2eeeee

SHA1
b5704368dfd8fc7aeafb15c23b69895e809fe20e

SHA256
22cf24d10cc11a9bb23268f18afbc8f3481c27e1feb4cb42ba5c8775e12720e3

SHA512
48365f858592d677ef5d0e2948f672234898e47a153eec32592a2e079353702a64e41e1aa59250f05bd690690b9edfb8455dfac90c6695fb7c0b6907a057fe78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\Setup.exe.log

Filesize
408B

MD5
70f08e6585ed9994d97a4c71472fccd8

SHA1
3f44494d4747c87fb8b94bb153c3a3d717f9fd63

SHA256
87fbf339c47e259826080aa2dcbdf371ea47a50eec88222c6e64a92906cb37fa

SHA512
d381aec2ea869f3b2d06497e934c7fe993df6deac719370bd74310a29e8e48b6497559922d2cb44ace97c4bd7ad00eae8fe92a31081f2119de3ddbb5988af388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\svchost.exe.log

Filesize
588B

MD5
2f142977932b7837fa1cc70278e53361

SHA1
0a3212d221079671bfdeee176ad841e6f15904fc

SHA256
961ca2c0e803a7201adb3b656ed3abafc259d6d376e8ade66f0afff10a564820

SHA512
a25e45e41933902bcc0ea38b4daa64e96cbcd8900b446e1326cffb8c91eb1886b1e90686190bdba30d7014490001a732f91f2869bb9987c0213a8d798c7b3421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a16c1c6-051f-4438-9d51-255d6603afb3.tmp

Filesize
3KB

MD5
32895c73f929bab325da36b06e95d80b

SHA1
b3623c28d4bcab34ab4cbc52eb4f6d129abf58e6

SHA256
12eeca4de970087aa406a3f5778a4361a4fc616409649cbbd941513644d8ae06

SHA512
6e94cd695ba3f162571fd4bb1c8f99a3fed93345c6ee752ebcce4701ef20e0f3f32bcd0d3c5cd461b6f8b31caaad6e890ac816b359d9a011cfc45f9e39aadcc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005f

Filesize
62KB

MD5
f79882e12fe87d482fe216d30ef3c93a

SHA1
e3031f2d694529705d8634b397815cd907fec24d

SHA256
c95d79ddd197080d143fdbaf458ce6d653621088f2d16827b3037f4417a32f61

SHA512
075f20268aa1b46fd322da5220b1705e42076d6ee681417bc95d5e900c6ed9929eca102796757e5db387db56ed2e97937e074b5af75840e55b018623c0a845c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000065

Filesize
20KB

MD5
ea35549990f54b349e6508f4f4cac0e0

SHA1
8efdec385374e1a3b51bfd29c3cc9315e7dc2df7

SHA256
4a1c17a1326271540f84968f43e9f55f936ae9085e99a6d06592a53f98aeff2f

SHA512
67c956058c45810b4d06f4c3f2974c3b264289be435a06ca219df51cd51f9e25bbdf1db42c20d9f435f1689431b5106c21dff8a400ed6263a6b102dfb51ba7ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
3cd4fac9a4217a90d9a62583cad13790

SHA1
1eb30e649d810635fa9f6106295710d22765a604

SHA256
ee927a6a5c12a1e7c45937045c75b8974d9707d6c9554a6840fe8fcb1895e4f9

SHA512
bf9b6ef90930c65dbb5d0d37d727d35ceffaf9283deee26934db963e739067ded1e64ce13f5c28a3858b16696b44e73b8e093c3bf7f2b712206580463417f6e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
65667eb9a64426786871f0a4e8d93846

SHA1
d97d048b7b63194f039c568544bcd3cb7a9f7ab2

SHA256
e2410eb6d38f80426e7f2304f64809abc450a5f17e1e455471068bc83d5c4f1d

SHA512
429b072e2993ba01943bf2f5c933bd875f93257965056be323e009fe48c8eb4670e230a7a5394acd45108b44c7382760f6570b17b10230566aa936149cabb097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
dd56d6afbabffb111ba6dc7038c591b4

SHA1
1568c7229304989b1e0a107809c867a7088f27df

SHA256
a07e2dd976449cc976e966e75fadb8291f35a425aa97fce9e05b89152ec029d4

SHA512
05abfd63e83569e5fa21bb2c1f94d769c551be84d1ecd580991340513c7e01ec1d4431881d9d24d68f2914e848d02f9fa18ee21d51662b9ea440420185b863b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
69af1ac68b29c976b1d4041d27229015

SHA1
ae7373f2a836281525bcc9da799286b81c77d9e7

SHA256
d19513bd631eac3df362fdbd8bee452b404eab989ad28769a12f5bdf7dfeacf7

SHA512
b05e15f2872fc20047c58460d451a981d4a1bf0f503006527427bb8f62b54cac8cf3fdec5b993e74a2a69a08162676b328d93247e491b0dc5b63a2ef8ec192d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
0834b34904d223497d9d356d4067a3e6

SHA1
6e7ba85d6625416ad974f3a42d96bae4f304a622

SHA256
ad4ddd2d51eb223ba7368b8e5fc7378a4de0b17181839fe3d10f4958b8558fa4

SHA512
f62cfa16843bc3415d603cbb0223f8c4a8168dc39ca70189a51fee942408b162f2ec841e761a5dc9c2f6653e8b306fbcc8df6da182be749cdb36ba042c4d4f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
908a68b83c591b847256beeb400785f0

SHA1
f3bb994272ac7f1565941727d20c8721d25694b5

SHA256
885b18a2ec5d96bc14f831a31a2896d535087e6e1dcb06b89ce33d2962c20fca

SHA512
12d8870ffaa8e774d9c2aa7e1ef1ad15bb2548eee65ff94a215ec45fbd9540d348d4a047a5619b05e7c292aeb2ff85313d15f1dffed6f447f3eb90761104748b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
ed1191fe8f64eb17d519108a045e2745

SHA1
60aeedbf901b47c25cca1376c6a7eb890b73b058

SHA256
e02d3b90923557384bda22cc5d6455c270449f8e8d0e1cebaa2302a6ca3f9b82

SHA512
daeac2a46b2389530c13a9ea86a6ad606f9231173e326d69aaf4aab9f2f8b55ab8e64862299ab1f0fe25059375bfbadafbc133fce7c697e9bf484ed0c4832f73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
d05c2ca4ad83dd80201be50922251a1b

SHA1
983b2d236be00c7d5bed36362ac0e2776a9e934e

SHA256
981b818e287a4b1461074cd7fe41bf92200aee6287d76029f39716b0dc694380

SHA512
f3331f61fa609d798b4bd953781078a3d914800f6e6d0168f72a689dd85164f4858bbc05783baa7501b19951675d77d8baa29ea5d7c30eed133f32aefcb8a716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
f34ac1eef46ed21dbd85b139ea515150

SHA1
94c0c6e5ea42955e4046659221a4251950fd653a

SHA256
f2dfbca9c5f508291bcf71569fc09bb84ec8caea2fdd389cd72343e717e738ed

SHA512
d1001d3ce08d3ded1f7ed7efb714df85b45d88382b395e0766ccf5e98e6ae57ac84df3ca0f2e093e2f50d0b5a211fe6b8d555574c2302d8c275de0e5e4914cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
d77bd7fb4b0623861941f4121a54df35

SHA1
9995fe96ab72a3efa8800a2792ac6477dfa15df6

SHA256
b0efc7fe0866b6638c60b9a738fb6b79ec4498c2ec15eb6bca07707d38beb2b9

SHA512
02f6d809122144ec9d85ead3e7ca63cdcba0cd9f88507e93e64d52819863cfe676bc782660bfcdd64ae0f164ad4701f869504d6a665d7b9ddf1c61544b49518f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
c161470f7ff8bbd6b9c5cc7537d21840

SHA1
af6e6f7628dfb668684d9ce51babe010d800b2d6

SHA256
14c14f491941b0cd683b408d51702aaad02e127909c976f7fd0f005d8a81eb8a

SHA512
27964e9d62402ac79e65cfd7f05edb6dd9a49d12380a2914d42524dfce8e40fda34281948c5a3644b5dee44ca1581aa44ea431fc8a7b3b334b0cd671c775b8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
cf7f899eb93c9a4353e6ba32361624b9

SHA1
32c940348677594c2cfb09de65af7e666590d9d6

SHA256
fd6546c2fcdbe8266acbd0afed5042ca4a0d1afa77bbb9102c15dfae8b942fda

SHA512
9f5bbe38a80747a8cc3d2100788a0ec8227b22d21eb03686609ea0a46af79b206f23726ad502f94a6207db26e07fb39742173e1f43227fd6973b0716f069bd9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
80b995493f297f964bfe6282b20fb28c

SHA1
2a1abf42d2f5d3c06b367aef74e077589f4da12f

SHA256
6379287f6a662ac352fe3a8ea7d4ceb23576fefd90ed68965945c51792e2d0a4

SHA512
ae4e792169ab23cb55890b7888bdaedd294b93fd336082ae8572d20bedf91e4a5679c02a0a1d9e2dbfcd7d2a97b96a8b391f230b27040e98eed383b91bc456b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7d9603832649520e727f13f959727556

SHA1
53d582f1ad6e62905c9e59230374ab7604f3963e

SHA256
0b519c9b8e2aac183f5bc918726cd793fb80bf6a768f49f53e950cdfcde7510a

SHA512
f79828b317decb74e0811c6eb0f29c20d35351fe23b713ed387dd6029b3f9b0f0dcd386857bf84bd7d97b8c4bba3e19485d4fcf8654f661ca0d005630773ae53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
775a55aba57ecb2e79531fdde27986e8

SHA1
acf7b1f1c092d0017ed086e96f3b45a4f31599ac

SHA256
1dfcec9981ceb9623b6f518e6445c805d9a45647554d0158d669badd70f9bab1

SHA512
86e0eb01dc41a4f8449fdff7564592de1260e924d4d543ecc1efbe0e46453a154e5a6c16ba255d4d0779ec9c0a5305df57d4cea691b6e594d224364780187c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
e2a0cd138f21907fc12303db008b92d0

SHA1
f84a0db9167923630c4087f4477761ea62fac45e

SHA256
449911694a951d8b33cf2bd3ab4157e423bd484ae1cadac9bbef2c65517b0a3f

SHA512
37bb4f1648f8156582e5301cd2b019ada577ab8c175ca1b3f50a7f0170529f8d33248220f57cd46e24a33594a1a2ef422fbbfbdfeb82997dd244dfc3e7783b10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1a6dbc878236fb318bd7d9c8c40fa43d

SHA1
5fe1e50f7589114dfdea26dfed730dc731cca737

SHA256
e834390df8fe37946d1372f2fdb679da5e15370111053543e1cd4c700abfd92b

SHA512
ed0939259de6b8340da49034e575e3cdea1a2a39c8522f48065cf6940a80e3b963899428e6b38f64f1bf9e0147fca23185e2a1416b4e8a365dfd02a6aa701b00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
96B

MD5
51a10260a8dac25f456eb86718df35a1

SHA1
70e4f463f86ab39fc28422c6385fe069830f28ae

SHA256
b88ac09fdab4f6be7457e4a25fead13a0758d2c2b33a6679bc8841a3296a82f0

SHA512
3a2b9369a2e4e9a5e5e8fb1b8b7f0fecece94948f19f4b7fd8d3931f4c37eda95c82dbb80bd7dd369d79d696c3fb31796c034c21b6c0e2b39d256dbb787a7469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5820c2.TMP

Filesize
48B

MD5
78ef2cd864af407f2d794f7308d72ec5

SHA1
4eb93a296852fd33f62e01475c0b3ce224c0c2f9

SHA256
a2aeb6e228ac7c65d5d70422534a1944097536860c6185b9994d59225452c5b0

SHA512
bb4357578b0a422c60518b9ff35699de71fdcbfbd552b0cc9455f5a973c6e5400f2b6eb0c542211fd492aa64d30824ca7fcde2eee8cf7eec4b2630b962322b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
88016286f1f21bd2e412a7bbde3f47ca

SHA1
7b5f1740970f8080a77c07fe8dd3f85307b3502c

SHA256
2e9116f15f881851266e10ccd94477ea1683e3f32310c2e19a24a6f6d8ead41a

SHA512
d55f309fc462124202e7feed19fa0810f24c647635fb5a9214aafe5e5d8fdc6c44661640e915271ee20f18240a39e7889c2f202a4546f9a38b4bba23d5d2a06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9124f95363f327048b0228514e3eb8bd

SHA1
57cca64596dcf92f0b893760f66b2a92885e0b8c

SHA256
f74b01337aa1f4537fdee63107d142810090e69f405f0e367bef1d86f2ce1f1f

SHA512
565f7dd11450cf873824f0dde549ef5f4a6cf683122e9140e52304a9e436ef628e83047ea4fb15434f6a6cc1ff1795688a2abb42d5002c0001f5430155c780db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8caa99b3fc118df2d5d59f2b0f996f60

SHA1
01bd43ba415c88e4e2115c334b3d5dadbdf210a1

SHA256
b51286c077b6e49ece54f3574f1cfaba705f23cd2095a5e62c71f52e1d11c564

SHA512
3755c55b5ee90aebfeadc633d4347229b6041bee6c6eae9f79da7b19cfd4eb6908e53c57f98c8d7d44d06d9df4daedcafa2406f187d31cb792990f97038240f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
45325be58a768102d868e5b61eef15f5

SHA1
87eaf7c85eee91d6c06e5823b82f7466becc31fb

SHA256
ab92b298e3ddec3b7420bc8959c1baeb929ebf77c2969f1b2e9df04c1793c39e

SHA512
592375bc6acdb75e22e0a18a3d357b10e353c95038aeed03a945cc30dcefa7a0aaf24b8b389c46b97afbf3ae64787ad8f0e996a79c0229149e76d34c1c42ee9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1c03f34e6b2052c5461cf77ab7af6ee9

SHA1
68b04520d0358839e0d2563b9be9724c808b23dc

SHA256
aa6aadcee5ea90013693ad05222c00d4cb223175a37c906de8ecdac4fda1be96

SHA512
243aa6aa6c977f63bb0f60be56266f92f4fa227452b4d76236df9f4eba6c9d438c7248cb7caa889b0dbbd2c5ad94ecbdb19e11af00c474a68d8bd72dd084eb26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0d1e5ae2bccf960ad82ca2967479b9b6

SHA1
605fa39759fbbec533c7fe8219383a6cb783ae74

SHA256
1b258c9bf722a4df91bc6ba8f14f110727c69501520ad3d75c176b88dbc19144

SHA512
879b0513eed2fcc4e1cffd343ea85aed3e5e9076db1e34706e0b5fe84f32e865461b382f520eaa779596efa98db18057727c7ba61b779da9a923f632eba85204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f41e450a9ceb19fcf656687f70a86005

SHA1
c298b006d36928b95fce013b0e390c8da0473641

SHA256
88ca6c7ec426420a331ce5272232a2c3c60d329dff46b19e349011c5dcca0b40

SHA512
3f3c5a75730a0ea6e374b257327d654f3322de84aecc9ac4a5c0c5407c340d95bebe2dee86ec9f0bc5b67171a7ada4b46471006f472e0e332640886a2b998e7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1e14f67253bed2f6d4c1a37a5759bcef

SHA1
98fcf873de0e9a161bf75da2be621ed42aa0b68f

SHA256
07ecb8d0c7c1d7684b245f0c06fcb5c4c4bfd7bf13b1837a66f4aa27c265f240

SHA512
628d7e09b8f22c846171c2db111a1726742d272a3e5cd558407cc27a106e793acd8ee315bde28a36891b9329179aec17107976f9386041fb4976e92a7b860f6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7157dc1af412cc38692d88e9bd2d99ba

SHA1
09cb2666acc95ddc248ef0bbe05f9ccbb4f0a7e7

SHA256
c9133033e60059b8329f4448d7ae67c7e4e76b3ffb8ada83ecabec6db4dcb782

SHA512
ac7f86a9b24bc10374708f9822686457413eade115c54e0311c1374bf4a6ea984a28d85c1447729fee8e9396e327919e077dbd4dc60f05abe7d2e863ae913f9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e19e19bbe77b96f13c4c8f3489d1af09

SHA1
0bc5a7d332ebd5f245fff586a700b78733c62109

SHA256
961c195f0714ffe72212ee46640d0524b812027c8a788f9e4286d935e5da5cde

SHA512
903d6980adc8db69fe32a3f1b7f563a85d5bea0fa356c87c422a772e6a4eb46815ba7d68fd5dcde9d72d46b6e4e6d967c5ad48d66a0d4906a7d6d1e2fec79ed2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
689dcf35873b24b5a615ef324c3344c6

SHA1
9c55528b64496736ccb08e65cc9976f8993b556d

SHA256
0aed3cd323a05d92e0764ce163ccfe528a773e25fa7b091b05ade560b78664fe

SHA512
daf167137308701d7834e5622e9d1ac695527e70aad678bc9cb7e8c31251fbe2e33e57c588fedf56f29304659a52d7de77017ea93aee6ad759408dff67728b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e259f543e1188e63e1f8d0855ffe7bda

SHA1
fe627fbec78c23289f5e40891561d32bcc8c6f32

SHA256
d63c360b7a8bacd90c516749111261e5a052619461bfecce8702d7847cdf8cea

SHA512
392e37bdd73c1dc51ceb285ee88fc85338ada2c48c64b00dbb5134daf311640db4f9644092ee4a00c02ee61c667b0ed6efdcd2468005893ca5b47fd1c8b5928e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
766664e3b67c5aa15bd71abdf6e522b0

SHA1
b628f1be0a18bafc93884ad81e057a07209c224f

SHA256
1c5db15c85249df0c7a4df5de1ee91f065ff3c3a8f9e90a08025a5acce33710e

SHA512
3692bf05203dc7d086f9178cc730bb539ac10c92aea29fea4231a9799fbb171c158a0ef6819af5241d1d727e763b18c1c54449035fb23c1393db52288ff776c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1a561d228609cbaad91474c9c0d3f210

SHA1
23f7d200c1e27a3820336d248c7c0d064888a6c0

SHA256
c9e7cdb89ceb42340e13c75dbcdc09d27e04134135c67aadccb17af0e33325fb

SHA512
795c7cb627e0b8708a4b870461f2a41f98b5fa049a5f8809b3412e4d01a4a07baad4c2037645278ac04468f1fd1d5922c8995112d0cb2aecbb32bd1bbc558823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e6e65b82c805da51508d42481f14541a

SHA1
df704581059dd1efefbea484659e474818eef04d

SHA256
46966102448b5500fa253f96d0821d3f87cc71797953a0c809c030372c4aa82b

SHA512
a03c8aee91cffde989affb8a94958ef2695f640220b2a30dac24ec8281f48e951369474338c46e547a97cac7653404d1cba4ff2fcc35d71ab3eb867b284ed3b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d1628478cade85d265d55fcc7518c1d1

SHA1
9cd4fef01bc22120c14c28a891231cb4d79d2810

SHA256
78146d127f7d02e7295f3badcdfeb9bc3ddf4eda53768ced145420797de5dacc

SHA512
465988a09ecc6bd55f3eca76c8d0009d09f8c403577f92074e00da74a9823a316a792d228f44ed4f43d3fe018520a8ab6c055054314b4c0500e7d895d3ee35ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ff01f8608ee2b9951f40878c82f495df

SHA1
55c367f8a889be1edcbb4220ce1fb91b3171d116

SHA256
3d9f875862642ec857963104be122d5428835167dab3b8fc1149dd8c086c0a53

SHA512
561dd3bba69d62d4e4ca8248e145ea5b24298963912cd89a342587dd6a2fbac3b4f3afa42b718ca762e2b1d4777db174c6f28ba8675a66f03f1b18c77407c8bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
528881473e4e00250e6d609cdd2cf04f

SHA1
dac1c195a9269d8e489e9cc53ae3afe37e63a719

SHA256
808dd1d626310a913b6c21d5c3c15ac5cda3d4f91db6f3dd37cbe20a35d5f373

SHA512
3f3ef0bcb06ca70c65a06744bc5a97f9d3b64f85ced8fab995d92a89a749cefecf500585e6fe44fe711dbcffbb59cebe59e83d3c192e84478e231f90d4677b0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
dd28ee02f536e2cfae2dea5bec9cf391

SHA1
240656fbadb665f6d12c7e3cf1a00489491eaf61

SHA256
9e8630a3c46b49be8a865c3be3f33cca434c7fb36e21c925e97a02d224a9d9bc

SHA512
a19f0b46ef6cc0013998fe5ed7c867d37c0f7cbe93f9184ad0877d3ad20bea1a59af3a7a744016aa57e41f07fbe9cb90a0e24c34639bc9ce90e6eefc010455b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1e4e4a1e14c5e3db16fc0e6ac6090247

SHA1
4b78b5d9192408f2b7f0cc4d21a0fc26a6f06b0c

SHA256
7e4682e454b1c3ff309a17bd217cc651cea5feb4d6f605540c6aefc5b07e3cbf

SHA512
007bfa13288ba6d9a47d86de96e3496981093fbe3f018533b5c0d84de6ffd4ec8479d57140b67c650b6370f2d078f59bebba1c53bf49d37bbeffe76d6b7b5768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5a113fe21dadb1d88d81c9f984afa544

SHA1
86b8e62942eaa310317188715c8ff553a06af937

SHA256
557748bf6a2293f6725401689ea6dd7a7272a88d3a5843719aaf37bf767d5fb8

SHA512
ab82ab1a5e6288faefde75749f9698d7717f3d71b2232acc9012f98b3c0757959144004a0f32b879a67cfbb24fafcd0d1dabc9c721ae2c4d9fb66f6dda26b4cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d0e32289401e9d7f9a98e67edd67337a

SHA1
886c1764596437c54e0c34261d206c762f778d78

SHA256
15cd29409ef72bd7533593299c1f62bbb11fba6d53175fec3f675b5530e138f2

SHA512
d9c5964a8bbc65130dcae621ee6fdd0876c0af0b7085ef686add81eb5c5bcaafa248467bad9e1c57fe653e2e7c11f5bb7018cf0a179b10d880ad4eddd5671734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ad71ddd80b529b0891cfd32c00eb7fd2

SHA1
81dd6aff6b828c0a9c5f2ae068f535b429fe2593

SHA256
ee5e5560b96baf454c50589897808897db930a5ea9e17c8ccf6d4bd04937beff

SHA512
ad6272532cee3fd0f005fbf69901449df88f6dcd9df1769d7ce4d97137ea14182365005881d41373bf54a541cd72071ad8a4208d43fcd59e0d7bf0abd2a0991c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bad902ac6c2bab3616d505b02836734d

SHA1
ca69d86a5ff3d83dd4e9399bb8dc68e0c0d52047

SHA256
25c420313af3af53d62022fbb400ce125d5a75f2708d103b65598db422be7e69

SHA512
9586f52edadec31d2c72994b0538d45c630bb264733b22000e16aadbb8ad076121c1da626bbb8ae9f06a4898d387375cddd9f2fcba6d2eb0affd27b18fe5b0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f05b.TMP

Filesize
1KB

MD5
a4d8c18ac410e6f36ce2fcac5f539c83

SHA1
b533156214683d245c32010f0f4e325e56e2122b

SHA256
2619d14e8e6465391d4daeb692dc65f46140e61499aa82f43d11976f9babd801

SHA512
ce53711b93871cd4d6619ca1ed3f2b24048836200c8ba7b5c2e47b2ddc8d1e58d2b8bb5d258c6221d719c00178c481960a0bb3db4b65f7fffe7075038e509456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
baa0ebb607fecd0865c594dd8f8d16ab

SHA1
da656394890cbdc53f5feb63108453bb593f21b7

SHA256
3b839c8ecae6f96ae01374c3abcebf5b0d7060d9a392d4883f19571183a88f22

SHA512
f8418f008f829d60f4ecccab0a549b6d836e18e03584f11d726f65bfe099a06af36f89cd39502c5798d2342112868a652b8d516a4d80eca6ee7b719f73ccd526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a4c316a258a7d312419cfbbe988aa438

SHA1
c86ca7d78ac84c0eec33b817783abed6747dfda3

SHA256
8a2cc0d504733839d8216d49bc015e6dba121f1f107d0eaa961c5489416ce2aa

SHA512
5fb30ca3ee84f0708d2d293226b2dd7ab0a2f0ba7e6ecd477f6e6448c0a6c4be86c780808c781776259354ae10722bb4ff7a15b9d5469d6b883356fd5ebefb5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Temp\2pm2d0hr.inf

Filesize
619B

MD5
6f1420f2133f3e08fd8cdea0e1f5fe27

SHA1
3aa41ec75adc0cf50e001ca91bbfa7f763adf70b

SHA256
aed1ac2424a255f231168bcb02f16b6ea89603e0045465c2149abcde33a06242

SHA512
d5629e9835f881cd271e88d9ec2d2c27b9d5d1b25329ade5cfb9824a6358c9e98e66f1b89ac9459b4c540c02af2728129dd8523bdf007cadf28b5fa2d199a2aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
453KB

MD5
32d785752249c44e16fbcfb314714ba7

SHA1
2d7fe4bad7d7e293db1dc5f3a03115c21c817c22

SHA256
fbb38dc329ee921d8f22619dba7ba1e7a63b6fb0ff172aae8a46a608048a883f

SHA512
a6d66ddfbbaa1f1039d8a989fcc619a21442dececa1f768e5c2b1066e5092718abc5d47b0f18f42819cb646b3e6ed741b77d07989a48e1556565e74568ef83f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4iefrsth.3lb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
355KB

MD5
c8d3f1f2d0fb683a5a378f734bd2ef85

SHA1
10b9e8b4a3f9ce416b360751e031b85345e6d461

SHA256
a3f037fb54904ef8b1d53e587036c18c6d32bb10a3044d57f9b9eb3aa8dab1c5

SHA512
43badeacbf59ff4e7f1d0e19a622b935567c196cb63ac50df687167c67cd881fc372230111137ce9adb1b794c6b0828adceb156c5d6a45e49d658f793aa19ee1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

Filesize
320KB

MD5
ef59e792e42a91556d66354bbb706161

SHA1
a09673e4a591c6588cd0322003aea74da9719469

SHA256
4d160114b554d1df65b045d5daee127fe780789f20e79d9330a55055ba00fef0

SHA512
bc25dbcb9874e71ab4cd4f9b8445833600b01d29323e6f7e3c57794e828a3f925360a8d700d9648d751d5f6ba7dd23a345c20fbaf10ce161458c27fed3e1eebd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.zip

Filesize
134KB

MD5
21192df45ce49f124a2830a637a2e508

SHA1
fb2b59ed98c4c070aa373f48ee7f91b28f63f0c3

SHA256
065286d0d33dae11a9bdaa7b826468deac1b29b1970e8d76ea0824f0dbd838f2

SHA512
8f6ba365dceeefb1b1e87fd1c4dfc0808aa57bb2ddc946ce72d7fab554bbcc0fbfea0f7c2eb87b2699794f303bea8712eb8bbb1304ecda91c5bdd76d818ed812

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe

Filesize
84KB

MD5
15ee95bc8e2e65416f2a30cf05ef9c2e

SHA1
107ca99d3414642450dec196febcd787ac8d7596

SHA256
c55b3aaf558c1cd8768f3d22b3fcc908a0e8c33e3f4e1f051d2b1b9315223d4d

SHA512
ed1cceb8894fb02cd585ec799e7c8564536976e50c04bf0c3e246a24a6eef719079455f1d6664fa09181979260db16903c60a0ef938472ca71ccaabe16ea1a98

Download Submit
C:\Users\Admin\Downloads\OpenBullet2\OpenBullet 2.exe

Filesize
629KB

MD5
7d1ca9afd4555707135335062cdab440

SHA1
8273dd49ecfeaaa2bc0c372013f18302d524a9b5

SHA256
57f6f1bc81bc5c5d85c7176c1b6720b0dc570899061c20beb6eb3109c505b504

SHA512
7b992ed4da98f9d844751cd1d578be0d84b2d847ecc29cbccab27fff156cf83ce1b1c2ffec66a175b38a44dcd1cafbc5f497daa31c385fcc1548479b937a51df

Download Submit
C:\Users\Admin\Downloads\OpenBullet2\wwwroot\_content\Radzen.Blazor\css\humanistic-base.css

Filesize
126KB

MD5
261ce53d876c215be1f44fee0899edce

SHA1
425851afe9704c08bd9787cc9626628fcb6962dc

SHA256
213b9726acd813c56ffc22f87e34d5f96f05b62d3b76848e567edd4e40b706a2

SHA512
1dbd27a4956932b09d4ada8855ae24132f60b533dc11ffa44194372b6ccc031c5d42332827613c21dcaab05a9dfcd5ea0d3d62e8cb33a58dbd7900680b947988

Download Submit
C:\Windows\System32\OpenBullet2.exe

Filesize
158KB

MD5
9a6ce92e6fd77b02d7b338e2303ce742

SHA1
93e4ea93a2d32b2fdbbfa9e4b82183fd31cdc996

SHA256
e323d90f08c638baba3b8ffd06be2be209ecd3ea9072bb8179a56be4651d4850

SHA512
686e9c8aa997a3ade2efc468094d82dd5a546684ccba1b87b1e3e0e9f91aa68db4f3bcbae1de0b8c3da3c7fc01f58ad74c34797742e3f716cf5a18dadce5a709

Download Submit
\??\pipe\LOCAL\crashpad_4036_UZWAYURTHABKQQZD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1112-3347-0x00000216ECE40000-0x00000216ECE62000-memory.dmp

Filesize
136KB

Download
memory/2004-3252-0x00000000029D0000-0x00000000029D8000-memory.dmp

Filesize
32KB

Download
memory/3836-3301-0x00000267E0960000-0x00000267E0961000-memory.dmp

Filesize
4KB

Download
memory/3836-3302-0x00000267E0960000-0x00000267E0961000-memory.dmp

Filesize
4KB

Download
memory/3836-3295-0x00000267E0960000-0x00000267E0961000-memory.dmp

Filesize
4KB

Download
memory/3836-3294-0x00000267E0960000-0x00000267E0961000-memory.dmp

Filesize
4KB

Download
memory/3836-3293-0x00000267E0960000-0x00000267E0961000-memory.dmp

Filesize
4KB

Download
memory/3836-3304-0x00000267E0960000-0x00000267E0961000-memory.dmp

Filesize
4KB

Download
memory/3836-3303-0x00000267E0960000-0x00000267E0961000-memory.dmp

Filesize
4KB

Download
memory/3836-3305-0x00000267E0960000-0x00000267E0961000-memory.dmp

Filesize
4KB

Download
memory/3836-3300-0x00000267E0960000-0x00000267E0961000-memory.dmp

Filesize
4KB

Download
memory/3836-3299-0x00000267E0960000-0x00000267E0961000-memory.dmp

Filesize
4KB

Download
memory/4388-3331-0x00000000011C0000-0x00000000011C8000-memory.dmp

Filesize
32KB

Download
memory/4388-3334-0x00000000011E0000-0x00000000011EC000-memory.dmp

Filesize
48KB

Download
memory/5832-3212-0x000000001C520000-0x000000001C5BC000-memory.dmp

Filesize
624KB

Download
memory/5832-3211-0x000000001BFB0000-0x000000001C47E000-memory.dmp

Filesize
4.8MB

Download
memory/5832-3210-0x000000001BA30000-0x000000001BAD6000-memory.dmp

Filesize
664KB

Download
memory/5936-3225-0x000000001B270000-0x000000001B29A000-memory.dmp

Filesize
168KB

Download