hxxps://www[.]majorgeeks[.]com/files/details/bat_to_exe_converter[.]html

Analysis

max time kernel
86s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.majorgeeks.com/files/details/bat_to_exe_converter.html

Score

8^/10

discovery upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
748	Bat_To_Exe_Converter_(Installer).exe
6108	Bat_To_Exe_Converter_(Installer).tmp
5684	Bat_To_Exe_Converter.exe

Loads dropped DLL 1 IoCs

pid	Process
5684	Bat_To_Exe_Converter.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023cd7-420.dat	upx
behavioral1/memory/5684-422-0x0000000140000000-0x00000001403EB000-memory.dmp	upx
behavioral1/memory/5684-576-0x0000000140000000-0x00000001403EB000-memory.dmp	upx
behavioral1/memory/5684-578-0x0000000140000000-0x00000001403EB000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Bat_To_Exe_Converter_(Installer).tmp
File created	C:\Program Files\Bat To Exe Converter\unins000.dat	Bat_To_Exe_Converter_(Installer).tmp
File created	C:\Program Files\Bat To Exe Converter\is-4U47J.tmp	Bat_To_Exe_Converter_(Installer).tmp
File created	C:\Program Files\Bat To Exe Converter\is-2PCV5.tmp	Bat_To_Exe_Converter_(Installer).tmp
File opened for modification	C:\Program Files\Bat To Exe Converter\unins000.dat	Bat_To_Exe_Converter_(Installer).tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bat_To_Exe_Converter_(Installer).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bat_To_Exe_Converter_(Installer).exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Bat_To_Exe_Converter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Bat_To_Exe_Converter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Bat_To_Exe_Converter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Bat_To_Exe_Converter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Bat_To_Exe_Converter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Bat_To_Exe_Converter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000f9e9b8759918db01440b9515a118db01440b9515a118db0114000000	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Bat_To_Exe_Converter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Bat_To_Exe_Converter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Bat_To_Exe_Converter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Bat_To_Exe_Converter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Bat_To_Exe_Converter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	Bat_To_Exe_Converter.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Bat_To_Exe_Converter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Bat_To_Exe_Converter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Bat_To_Exe_Converter.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 736780.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
2844	msedge.exe
2844	msedge.exe
3168	identity_helper.exe
3168	identity_helper.exe
4676	msedge.exe
4676	msedge.exe
6108	Bat_To_Exe_Converter_(Installer).tmp
6108	Bat_To_Exe_Converter_(Installer).tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5684	Bat_To_Exe_Converter.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
6108	Bat_To_Exe_Converter_(Installer).tmp
2844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5684	Bat_To_Exe_Converter.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 4868	2844	msedge.exe	83
PID 2844 wrote to memory of 4868	2844	msedge.exe	83
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 2060	2844	msedge.exe	85
PID 2844 wrote to memory of 1416	2844	msedge.exe	86
PID 2844 wrote to memory of 1416	2844	msedge.exe	86
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87
PID 2844 wrote to memory of 456	2844	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.majorgeeks.com/files/details/bat_to_exe_converter.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa978846f8,0x7ffa97884708,0x7ffa97884718
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,16639959901206014114,3850671716632435279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Users\Admin\Downloads\Bat_To_Exe_Converter_(Installer).exe
  "C:\Users\Admin\Downloads\Bat_To_Exe_Converter_(Installer).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:748
- - C:\Users\Admin\AppData\Local\Temp\is-2MFSS.tmp\Bat_To_Exe_Converter_(Installer).tmp
    "C:\Users\Admin\AppData\Local\Temp\is-2MFSS.tmp\Bat_To_Exe_Converter_(Installer).tmp" /SL5="$E01F8,4092287,121344,C:\Users\Admin\Downloads\Bat_To_Exe_Converter_(Installer).exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:6108
  - - C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
      "C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:5684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Filesize
2.0MB

MD5
e3d6b93e861feefa47cceeae03e99094

SHA1
94ac369ea396c6a4c23ddcfb41cfdfe81ce0b3da

SHA256
55df60e09826469e543c090198ac6a12e1269047a88ed698e25e6e62d83ff4c7

SHA512
2c00287925dcb22b4babd7c49e9035ccb92b895f123791ef361ff495b08d74fe1e9add54c1fcabd4de3cd396faafeccbae0c750913d911dba6531f51ab126402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
45KB

MD5
f95a0faf6629fe55dba24478808491ac

SHA1
c91fbfa760c6642f522038a7e90b9445cf8c762f

SHA256
3401a6c618e31c817b75f603ff2ecfd83b8b75e4309aa09007cad5e98878f1f9

SHA512
06f2e5329db17deb104bd106cfc84ea2b321a4ddf64d6d4acf37462cc0d898530b3d913f2c48c7cc29063bb22430e9d12ebd6c9f8e32a2e980cd985a40923673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
134KB

MD5
58c6c80d013a258061c4e416535207ff

SHA1
6679eec7e8f88439531a75c56345a4ea1ce7cad6

SHA256
7f04b94fa8e8d64e50f72061e6d0729166bb53873e76caa284d2ee67e9488407

SHA512
90acf26f478167b937119b3655065b9ca0cdf669ca5682c18ee3fb17f0681534b38e1f72da17d4b8a35e2d7d3ee935753ed75ca0169a12886537eb7aa656c324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
32KB

MD5
90af67e8fd4d5ab0d104b28b82a5f9e3

SHA1
0172e38010ebd25ebcb3f0a4094be0e20f72ac48

SHA256
971b268c15450ab1dded5c1e8e7875660b086b2ca6c45a31ddfa82486b1d06d3

SHA512
ab10e3bd86abf1ae574133f34e7d5a8bff59f3bd003ba42da7e6b3b8744abc59df74b7b71b5c83537a2342adff2aa175caa0db5e5ba7f3a3e480820ef52b4672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
18d053547ca12761ab17e44ed4eb1253

SHA1
d3d092cef667e9e25d0aa379e3b61daceb3f1b06

SHA256
c1802eaf5e858a7129aab69d80eb7496083cd075b1737ee0ad43e5294ac3478a

SHA512
34e2c219ee87d3bf0de1b11b7e977879d61efa38bc36ce6f8722faf0cb3bef7d1e41594d8d935e3f36e538157f1729844e3f865dd855bfd591646847f9cbb1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
4eb057808c15b76981a178d13053863a

SHA1
dd0a642edefcf2fb250013067bb688405e8b967a

SHA256
da371cf2da2527c5420dad2d91d0960793c337c0b27e2f94eeb213cbf8fec6bf

SHA512
16b58d2a09db09974ece10828cec56888bf924e768deb0f37bb10f3b7f397ef86594a82423058dea299ceed767056ce665fa742259732621ec3b5674fa8e8f4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ccf3b6348d52d88ed3859cce216b0cb7

SHA1
bac03a0b8593f8e1f4ae0d6ffc4cd93b72bd4d59

SHA256
0a45475209c0defbb7d3221c979efcc59215123e0a0b7aad1543e8be58c78a0d

SHA512
8dee9b751d6a5a26f1e79d84173a5b9c7ef09fa70d6e03ecf6419e03b16e83bf6d2cd9d0748cd4c32715285636e3aab2cb0f3df7936dee1a675d3ef3a41f73a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
63da4b10854d358ec2513d7921c023ff

SHA1
67fe1a15512fb675c8840601044d9a10d5a590eb

SHA256
c08afeebb0dcefa91e125e10bb09b57cc04d4b06774b70a69eda12a2482aa650

SHA512
98f01ad4dab824f98dbc892d093882d50361805e570a33c3a84a7df4d35d440b74a0565a30fc4f9631be40109b6cadb968a4c12f6baf5e89ab990110e133e634

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
16302c431c81b03e807f1070e7127786

SHA1
87a6cb968ea4dd1b1f7e8a5b4b8811bd8d088fc7

SHA256
b871c68fba662915c1c1f87269029fff31be9ebbeb993004a74e3b5300a1ffc8

SHA512
1fb5f1c0860e54204f80efca51a66ba814d798cd00d348f11e18a9e4aa6f3783005330e98d60f15ff2de7c6d7ac5a2b26723f6584118d9c71a5e6d49257ed805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb0e516c14da4ed5cf93a4dfdeb145fc

SHA1
93f30917df86fa2efcd72cb2f42a34ac73bf19f0

SHA256
c7b97a986a9254ee61039461193951bd62e2ba42968db083b1b69cdeb8616574

SHA512
61c57e10be7cd5005ab4284fbc6430ae2d5ed1d2a7fcd78b8dd16aa38c8a1dec2abc164396f19a5f44152d69aadd07dcc1b31917cbb41f516bb7d54bcd90cac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c7416a41db656a44c28a0c943a6c1fa5

SHA1
34781b41bb80192997c1cea69ad5f9eaf0b2119f

SHA256
8294306f8ee71af1ff9348e31913bb77122fc569c7422dcd208f980c98403ea1

SHA512
6de1c43374bd4745297fff0a510e86815be758863cf491789d57e4cab7c88100df5bf68954add491413ae4f9bb24c6f8988d5c26d4a8efe6e4d99318a83d468f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
718bdcfdc955790cc213f53255c6eef3

SHA1
18fe1b265a6f5352a888e8b2b464559dc7971d88

SHA256
0a9c100f5bece9878ecdfb58fea0a9a4bf96971ae757138fe8e3df7bf3d740af

SHA512
8233e93ee50ff9779a99457b7b9bf2205949388fc37329f71ea60068cb4705ff70d84335302ee5f2b83a78360599f1ea802e620370d3ab0298715fa9985621be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c0c0.TMP

Filesize
2KB

MD5
78db0dee5fa5f32094925ba097838983

SHA1
360a184ef9756e4ba6cc7a02c65340cbdf7531f0

SHA256
b3cbfe03afce273613b4a12e4973ff43d01ded45ab10a6ab46cff236936432e4

SHA512
e71c303e2d92e5dd41dfb81123a74ca051a21617b26e0f9d51440ae3aafd7a2ab4495e841a3dcccc81a107a5173b58aa4b9c41080cf27d38ccdcb2f092e70690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
09d9bb1892788777b123827ad4c63549

SHA1
85dafaebb61ddb6bddebf7c619df069d1dd9ab48

SHA256
6aa5816e02e1b509f5047b4bcbf60dcc1f082ae06e93e9acb2576251cf8e24e8

SHA512
831e0b2701af9e7a94902b29dda620d927ea064e3aedcd8242168cdd044385a002fe7778040b13a95a432ae22fbfa54f179b0057a76d5a45dab7a1bd31e722ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f8bdc546d70384344e6510b3dd8597b3

SHA1
006f3b74f45d9b4cddea1ee8754c65ab6ea50f96

SHA256
cbadb80b330c83e04673f741179391c7aee6e2df6c777981069a963f7fc16a5c

SHA512
c0c166fcf32e2666ef519a0173d3be5af696799c39558e0fd59ca105b01497eaec67624710c64579fec1fdb900ab70d7a9ed06e20086bd66270e024c05a4d88d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f211f4cbc357b4e07513546d2bf05171

SHA1
477e2604933808912bd815683f736000181cf423

SHA256
2d7f43b915e9855ee9481bb319a65f7b8723873296417dcfd5a781b22aa89196

SHA512
c3a11c16d524036af2d70d96b4569334e1cd0eec9aebc2109724579cfc2b513f561962c834d53fc9f7e5ce51d44e96ceecfe06f053aad4eccc401f63c8fb47d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2MFSS.tmp\Bat_To_Exe_Converter_(Installer).tmp

Filesize
1.1MB

MD5
90fc739c83cd19766acb562c66a7d0e2

SHA1
451f385a53d5fed15e7649e7891e05f231ef549a

SHA256
821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431

SHA512
4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c

Download Submit
C:\Users\Admin\AppData\Roaming\Bat To Exe Converter\Scilexer.dll

Filesize
555KB

MD5
0239b5b3a757ce3367335e873b9d9dda

SHA1
11a2ea37f1aaa80c547b07dee5b7d1b727809376

SHA256
2b04db2caa0064a89dcb8137077f12de5d2b72389ceeed1227ce7c80c5c7023a

SHA512
859013a987e49991e55ee826ef1ce3593163ab37ed19f0db1587d729cbad1897ea09401556ae0df2b840972dc4909bf479047a42b1db387136cd68659bd515bb

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 736780.crdownload

Filesize
4.3MB

MD5
0d8bedda7d9b963de975685cf2b2a5eb

SHA1
cbbffe900a09e8a3bbb1a1bf16e7aeb8ebde72a1

SHA256
519f0b16537fa4a2bc228cdfce2b85c12225e2071d7789c8cc9bb8f7b85796ca

SHA512
9d8eb3433e88fb47b15d624b493af69a9697eeeee7ccfef71daf04181bcc5ba45b2f9cc801679c0234399fdf80f4a85f20858038c41c11132b515fb76cf22612

Download Submit
memory/748-406-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/748-454-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/748-386-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5684-422-0x0000000140000000-0x00000001403EB000-memory.dmp

Filesize
3.9MB

Download
memory/5684-576-0x0000000140000000-0x00000001403EB000-memory.dmp

Filesize
3.9MB

Download
memory/5684-578-0x0000000140000000-0x00000001403EB000-memory.dmp

Filesize
3.9MB

Download
memory/6108-418-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/6108-453-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download