quasar | hxxp://67[.]191[.]63[.]138/

Analysis

max time kernel
690s
max time network
690s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-12-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://67.191.63.138/

Score

10^/10

quasar bot discovery execution persistence phishing spyware trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.spaceface.site
Port:
21
Username:
[email protected]
Password:
Billy123#

Extracted

Family

quasar

Version

1.4.0

Botnet

bot

67.191.63.138:4781

Mutex

5e71212f-3f9b-4da2-b7e1-c0a0e90d92f3

Attributes

encryption_key
69F476AEBC36CDCB235187230CF3F99552BD1703
install_name
tasker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
tasker
subdirectory
Tasks

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/5156-1289-0x0000000000BE0000-0x0000000000F02000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2584	powershell.exe
7356	powershell.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 3 IoCs

pid	Process
4200	updater.exe
5156	tasker.exe
5712	tasker.exe

Loads dropped DLL 64 IoCs

pid	Process
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
4596	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe
988	wallet-electrum-portable.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\updater = "\"C:\\Users\\Admin\\AppData\\Roaming\\temp\\updater.exe\""	updater.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	api.ipify.org
79	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wallet-electrum-portable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wallet-electrum-portable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wallet-electrum-portable.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
5496	timeout.exe
7484	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1573038"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31148589"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\7-Zip File Manager (1).download:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\VLC media player.download:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Documents - Shortcut.download:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\bitcoin wallet (password bitcoin).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7-Zip File Manager.download:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7-Zip File Manager (2).download:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\X. It’s what’s happening - X.url:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\passwords.txt:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Wallet.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\The Project Gutenberg eBook of The hermit hunter in the wilds, by Gordon Stables..mhtml:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Crypto Trading Platform - Buy, Sell, & Trade Crypto in the US - Binance.US.url:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5668	NOTEPAD.EXE
3888	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3440	vlc.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
6040	msedge.exe
6040	msedge.exe
5236	msedge.exe
5236	msedge.exe
5472	identity_helper.exe
5472	identity_helper.exe
944	msedge.exe
944	msedge.exe
240	msedge.exe
240	msedge.exe
1844	msedge.exe
1844	msedge.exe
4496	msedge.exe
4496	msedge.exe
4600	msedge.exe
4600	msedge.exe
2836	msedge.exe
2836	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5224	msedge.exe
5224	msedge.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
484	msedge.exe
484	msedge.exe
436	msedge.exe
436	msedge.exe
648	msedge.exe
648	msedge.exe
1336	msedge.exe
1336	msedge.exe
6564	msedge.exe
6564	msedge.exe
7356	powershell.exe
7356	powershell.exe
7356	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2732	7zFM.exe
3440	vlc.exe
5712	tasker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2732	7zFM.exe
Token: 35	2732	7zFM.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	4200	updater.exe
Token: SeDebugPrivilege	5156	tasker.exe
Token: SeDebugPrivilege	5712	tasker.exe
Token: SeDebugPrivilege	7356	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
3440	vlc.exe
3440	vlc.exe
3440	vlc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2536	OpenWith.exe
5712	tasker.exe
5168	OpenWith.exe
3440	vlc.exe
5220	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 5132	5236	msedge.exe	77
PID 5236 wrote to memory of 5132	5236	msedge.exe	77
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 3044	5236	msedge.exe	78
PID 5236 wrote to memory of 6040	5236	msedge.exe	79
PID 5236 wrote to memory of 6040	5236	msedge.exe	79
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80
PID 5236 wrote to memory of 3096	5236	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://67.191.63.138/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ff931813cb8,0x7ff931813cc8,0x7ff931813cd8
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/?lang=en
  2⤵
  PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff931813cb8,0x7ff931813cc8,0x7ff931813cd8
    3⤵
    PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\passwords.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\The Project Gutenberg eBook of The hermit hunter in the wilds, by Gordon Stables..mhtml
  2⤵
  - Modifies Internet Explorer settings
  PID:3368
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\The Project Gutenberg eBook of The hermit hunter in the wilds, by Gordon Stables..mhtml
  2⤵
  - Modifies Internet Explorer settings
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.binance.us/
  2⤵
  PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xe4,0xe8,0xdc,0xe0,0x10c,0x7ff931813cb8,0x7ff931813cc8,0x7ff931813cd8
    3⤵
    PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:6936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,2493978374219769057,12595501080006038985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4900

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Users\Admin\Downloads\Wallet\wallet-electrum-portable.exe
"C:\Users\Admin\Downloads\Wallet\wallet-electrum-portable.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Wallet\resync.cmd" "
1⤵
PID:5248
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:5496
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\_.vbs"
  2⤵
  PID:5228
- C:\Users\Admin\AppData\Roaming\temp\updater.exe
  "C:\Users\Admin\AppData\Roaming\temp\updater.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- - C:\Users\Admin\AppData\Roaming\temp\tasker.exe
    C:\Users\Admin\AppData\Roaming\temp\tasker.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5156
  - - C:\Users\Admin\AppData\Roaming\Tasks\tasker.exe
      "C:\Users\Admin\AppData\Roaming\Tasks\tasker.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5712

C:\Users\Admin\Downloads\Wallet\wallet-electrum-portable.exe
"C:\Users\Admin\Downloads\Wallet\wallet-electrum-portable.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:988

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Wallet\resync.cmd
1⤵
- Opens file in notepad (likely ransom note)
PID:3888

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\The Project Gutenberg eBook of The hermit hunter in the wilds, by Gordon Stables..mhtml
1⤵
- Modifies Internet Explorer settings
PID:4976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5168

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5220

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "C:\Users\Admin\Downloads\Crypto Trading Platform - Buy, Sell, & Trade Crypto in the US - Binance.US.url"
1⤵
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5680

C:\Users\Admin\Downloads\bitcoin wallet (password bitcoin)\wallet-electrum-portable.exe
"C:\Users\Admin\Downloads\bitcoin wallet (password bitcoin)\wallet-electrum-portable.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bitcoin wallet (password bitcoin)\resync.cmd" "
1⤵
PID:7288
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:7340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7356
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:7484

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\bitcoin wallet (password bitcoin)\resync.cmd
1⤵
PID:7724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
1.4MB

MD5
56b7cadd3631218bde51028beb7960c3

SHA1
7b5a4452644b33cdb28fc4277507696ac6b74106

SHA256
099d5a5c32ebfea36e4a30e1443b38df5d18908141106ca37565b4bfae4af0d8

SHA512
e8121c3be9c5937b6b8fff6e034f61935e0d92cb1250db4b8204a80251cf64cefc4bda3e0fc86bd961dbc9bcc340c57eab2d01b562b369fa796321d242328531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
94848b0f5990da758e2e03b1cbd15760

SHA1
7db96a7a30ed3c79796f473f0d4b93920508076e

SHA256
759fd9701f0b4d1a41796f833b1e73ae851b1937a1a9a5061253d1024311a75c

SHA512
241ed83763c85ae5e29af702d74d1f2cfde9320259c57e7e4cd60e3e5b399b9ffb8926fd8cb129aa44ecc6a3471763949af8de2634a713936f5a9d4a3a1069dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
49af9876f2cbe0cabfb71ca61a0a119a

SHA1
0dc13aa10e681ae3582c6bb041221dea09f73c54

SHA256
68c000bf7530ffb7111be7f15b087db821e9ba9a25dae801a21d0adec451619f

SHA512
5cf47127d9af486867f93288b31627edb4e815fdf4cf1b7f68b535db38b13e48d32ba273c119ef32147479578bf46d09dbb21bffdce1b3631b12768f6e8d50bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9d7b24176e71000a1422f77f194e1198

SHA1
233e543c63d8c648900ac3380b7e329425868bb3

SHA256
4618a756cfa6c7a1e172d6ec5a259fb579c2cb5bb9df3986ea22ebb4f327027e

SHA512
962ab7123c088d10264de689d76708d1b0fb0273516b8f38a028912505ff66c9e74e006a8447056375007c91783186a3e2f7b9c4c380a70a93dc2e0e4103d511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
712dd2191a5202cbe9e013156cc47baf

SHA1
c4736c32112f600a8507da2aa0f951ea779fc32f

SHA256
b9bfdb92e4086f13f83e189f4331b4d9a69c13a62a1d549e4c45225a1b6f3b7f

SHA512
a421fd1ca6ad208be5ec3abe49248aaf28534eb520d2b12c964735c1f3dc37d74643d1ad58d19f7e59d707b122fa68a63e01fea1317fa3603211620f3f3e86a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b9307b6ce7f62c7537ac428c5923da40

SHA1
a82fd7e9faf6d6fe0aff21a27b12dadc64f93df0

SHA256
b161e8330b86982b73d99a2b86410b6840165d78106c4060427dad35c42669eb

SHA512
236b95f5b8bd7646bc76d9ecf50adab26f87bf57885580ab093aafec1c90aef99ca908cd545e78313be594754c70f8f06d7a6c821a2a7c583a5b4468955fc327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d62147dcaccd8fac94a07652b85fb6b

SHA1
307ea1b5130fa183e028c0fd5631dece7cacce2b

SHA256
aa75e71d3b1ca28b9513d1003512b1eab2056728daa43bf3741fd0022c72db76

SHA512
09706c511c3a7ea208f53c5dd65a6ab585492d314633dc3702a1e56cd069320267ffd1aa91f58e0bab839ab1f659dace86d61b9d6ab0703f0e7200bf6bdbec6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7790787297d54a54ec84e1ca7f8cf9a6

SHA1
1febeaec0aca700408b9c5b73b3fb96d07e24a56

SHA256
50907a1ca5cd2c04a46d72ce100002890d976d76e2d2e1161d45d16038a1592c

SHA512
df4dd97391b6f2adb5f7507914769446f5f38985e5d03853d22d982676466e6ff6d861c3de28aa2f939ae9a3e170ef46a0d1adcb7dc01ac7032995fd35c4e141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7b7abb5c918988d4b21cde4027cb7f93

SHA1
0a96ed958dafd38f6f9d086e14411facc5b04f24

SHA256
ec9b37d35c4881244473912dceffbc4485001121ca3c2cb99df65ff4fabc4efc

SHA512
b7b6cad996c680deb73820f871644fff040d49f4272f0f7aa0b018139776e663244ba1b958dd9fd68b2f3454716d360e7279a32d02136b3379c84dfd0473d0d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c596f300d3d5441c0b2a2991b6716cff

SHA1
4b4c44b400f38abd69115c9cb6a927d598317626

SHA256
1a16c74d1554e198f2c67eb630efed7ce093bd64d00d2f056b079d6359f59277

SHA512
fd6160bc3f0d22aae279f2b2bbf3fd2173c2f21e7b0e0193169ba912b8704ea73adf129f8930fb41744ccfae9bdb8a8c25741b1e4eaa7f41cdc2c89c8e405051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
defeea2b067cadd32f26f71525e0e911

SHA1
a705bc69f0ec53c5ccc8bca9aba5b059d397f221

SHA256
4517fd687b85fd7337fa2b4430f46a76c9c174b834e0d9088401aaeee4d5fd7e

SHA512
9b0f44a77cf7837f73b45d53d11a07e1d85c5060f7f1c0d60243d48733c1eb5a66c85edea7f947ebddf2411b5a46059f15f48a5a0a19f2ab7dd42d2b3fd0fa7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49038f114d5bae610fa76abd504d14c6

SHA1
d97013d039a0121d5e9e5a991b4ce8ed79a77a3c

SHA256
874fe4402a8727d111ac8945a5dd881e6d35a1697a9600b352f437618422b926

SHA512
7d96beff4e5e75c34bb566a658a6878295664a238c6b8a3f7570d6ce96648f5de01ca902a7ed91ee35a116a3f88348f64ccba74f5d75a690bf8ed28876ec669b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d96109f3b2342d02fe4ee657b6d1340

SHA1
8435f3b1ff6b570af4ff2b5be887c584a460eb4e

SHA256
5b778f507d6c2773ba5f0df92de7069862e2f4c7188750f6996e41f88f681b0d

SHA512
a95786197c8a5480b9d9d1bb6d1da297147d02f19f07315c7bbfd793b58cbecb7304e287b2491990e06b84b3124a9cead92a71392af6dff52d276a7e2760395b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ce91f2081adb69adb66b3367d0635245

SHA1
57b744fcbcb54da0d34f8f72e9a7f388095185bd

SHA256
74dfe47fe795050cf53b7786d5ef6b2319c2afced80dd2aa226e4b473b5d9b1b

SHA512
830c6f31f688891d6da3f1703b803aeb0e8acb7c6fa28cf63664a3a007b2d9403416f972324549399077b326a3fc451ce5f6ab8f8f6ceb60748fa394b3966cf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9d01fb87eb81746725188262be4ca30c

SHA1
c7ee99cfd99de6da22960f7ef6aff83022fed31f

SHA256
8cb882ff1ae67324f2c28bf5da61144a64ff177821d18cf821928cd54d936fb1

SHA512
a8ab4961c18817a158d26b94491e84e2c036d7f7ad5b2f239d1d22a4cc9796fb78b68258b3a14a45639a438b27bb33e556e60f04347ad606b96e737c9ad6725b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
421a2642546d8730b58480e5c7fbfed3

SHA1
6cb960d05401906c88241c8bcce35d0dafda3f35

SHA256
2d34462e21f85eda0ac7e303a6016654650b5570e8f56cc523ecc378f2e0fdd4

SHA512
f71389a2af6d6123482c9d4642ca853d45b08bc84466798b7a2e2ec24927a7236c78e9a9edf77c20618d8f671a7c79e8c43dec87daa118f38026753fbaa78c81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e6f30aadb866bd07cb5e84d6445f7471

SHA1
77fcbce547004f8db706cb6b87c91a066e9f4b7f

SHA256
e2fc8ce893f1f34c8f11877ff8635d736ede4dc14d34c23a21364a9900b5031e

SHA512
970d9f86b122d8e8d793ed4de458df1ccd3486a56d873cbb3e68d00cd1b3b0f6e6a894a5f89c94235d766152aa3fd6adf34c3dc726c4e62785bac7875a540386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
31a46bc46b35528070d9cf6a79379075

SHA1
a3398b8eca7180f9bcd5a586541b168bcf7ba30a

SHA256
eea32fe65f9994ebcec9b92ab75214feac5e711487f4059ba745cd1b96f5ac31

SHA512
1c964d1be9332882873cec9fc9d8bc85fbfc3936d69724a687f149a7aa9e8be1f4c46698675d78373ae59bdd566f2e5f718c0126341e7278e4c26df6eaf74e6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8330e98a44a7574d0e9e724a7585be36672f3af3\index.txt

Filesize
95B

MD5
1fb8b3354e1d90bed6a8dc12b651009f

SHA1
4372b5d9c0ed37c3ae680849716dde175b451bd3

SHA256
fb23e3c11d7a4e997ff4a3f6f44f9ccabd546f811a8bd003cb164a4995061fa3

SHA512
d6cd163416ee9790502b06dccc8109d1a4c9f2c9c3cd71614cc67a3f11af5b2223d664ac8bcc43d7b0b4bf21a752d4a485d8738b0765343c1329e8291335733c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8330e98a44a7574d0e9e724a7585be36672f3af3\index.txt~RFe5df148.TMP

Filesize
102B

MD5
baf034077905b3a7e097ddadf02970ca

SHA1
e43446b6f2f22edcd66b1b2c4bc348aa4eec6732

SHA256
8fada6ec23a86c21c54086c7805f7c0d509f9bcf61bec81d1cb1c9c5cbc5dfd4

SHA512
3fbd0fb1363dcafc1f8240ce52c7302288bc9e13dfe7260d6f99a81a7b064a2969dc13ee4b8b2cedbe5e7f8745bf796b416a1ea9dbcc63ce68d0a5ded7bb7093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
65bd912710c8bd523c802d62611f86c5

SHA1
ff3094509cc2b50132115091532b0b2fede27ecb

SHA256
c5cacadd89dbc492cc25a7194123641073867a0495086c845a3b70ef074f80f4

SHA512
aa9da7dde92c74d7ce64200ab4ac670ed367ca266fa6d8770d82bf4a498686798122b8245dbdfc1f2156a52b2299064995d140c3cfa0c51574b290241db615ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5df119.TMP

Filesize
48B

MD5
951d9da417f367797028c54c732c49b3

SHA1
89428be3fd0a2134eb969ffa5ceb91b4c9fe8ffd

SHA256
680dcea968f2085052454d806c5d87c570b2f9a4d044c6576e7d7b075a56b26d

SHA512
68fabc5c25079b589b499f9c2d538142d6e2286532c2a8e89a0a66f0f60f393e4e7ae4f877216095eaf91ba03a4c852b7bf4300b6f6c5a144c942875d9dfe465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
fbfad0bf3d60bcc287130088e7ec09d0

SHA1
69c4e540f6a77c5c3f05e61a608f5d98724a8722

SHA256
a7cc659c998a1855aecb9dd26544f19850b8c0961dd9cf55ecf08aa607dff4bc

SHA512
9e497775729215b5694d163143a144687713af522b657f7117e2ad7869360ef55cb634a9ba432fa8eeeaabfc692ec426839480ef1bcf8031f6c6567b96eb7833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
39d661d8fcc93ea3104c435a52e721b8

SHA1
b252279ee005db1f1ad1efb788632d25b96b603e

SHA256
d021015d9468452d0d7886a868391c5dff24bc6954d73bc4809271251e1f1863

SHA512
fcbda6059748f89588790f8e5f91207b160f19e7598c476fa324ff878234a63b6b7b9b010faad2cb33deba20ba7169c89a11b24e828a00663fc5ad4e04fb23a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7c7e78cd681579f26d6b0276ea2eb09b

SHA1
94b253c8369ab64dec8382589a629262b0dce9d5

SHA256
b2eed1be6139ac95450d084ab856da09b21affe4d32e9cd2d5963ca3e878c014

SHA512
7fb8baedbb88d5c1c60d8f771fa65ffc1253d98ee747a9fb812eb9b58eeed5448358ed5f28110a17d6259313bf969b1f416cc708fc084edb8f4b5ca23a3153dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4fc57716b549c4414ba822769335de21

SHA1
dcae2a674fcbf342eeb82da4e2e3b34d3010ba3d

SHA256
0542c149dbabe80d5a7d55e42404a099d560657b75de7adeed7e33eb4b06c28c

SHA512
f2f11538e3c19bbf4b0feed3007998a6f1a4522d2e2354f079235dd044c954dfbf3caee2252e01e0dedd3c33c1d1304d11c1f61fb6579a3fe5258771600e9ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59529b.TMP

Filesize
1KB

MD5
eed9d5351a53fbb52580ce108cc5a4b3

SHA1
cc6b1881e7d6065178373aa1db2f9fb79c8b3372

SHA256
fa4fa389be3a9d131ec8ec69e315297baaf7cc9ae6cf4eb2123ef085124e03ef

SHA512
d9e4ef182e34242b907cd47765b36067fedcacffe461d93cf5ace1167c3f4b92c4e530371eda7783865e73fb76046faff27120de9016943d18b697a43340da3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b6db02fa67e26aeb9ac3cc30ad381b6a

SHA1
fb53f55d481b640b9461245e8450fd23b88a846f

SHA256
b05543331e18469bc8bd8bac5888bb070c782b2c926b7965cc64a4669337808a

SHA512
2cd79a0cc42b3ad94f16e0f6ef3462f714c4f48f7e1f79c92bc48b53924eb7bc57e09d5998a84891ace3d2f785acff4e065c0366d86a181ba470a69afbfd3202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4d0ce324f20a72620a1dedda863cdbdd

SHA1
5aa52d6837ecc39a2e5d14125a497187c43bb639

SHA256
1751150fca1f760d7cf79495c7489ad9632cb5734d3b76e72e0af55fd24fb861

SHA512
3adaf2d6cde7251045977962c9e5cff55aa8c25d032f95db5c65568cb1d0dd10395684fb48dbdcd5dba0067e905649497653ebf58b035af6df92e2ca4ebbc36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8f3dcfb0dfc8dd0c1b52df4f8782b911

SHA1
95a231dd2742b645327a10c2e400ec9e179439e3

SHA256
db277ef75552d8d14f8aa9c20554ed16cba6d6779f4291515bd6c50a095669a9

SHA512
4aa65a04713b6ff4a4e3d5f55daa864df56b470465f3598480400e27a9316def59d0ce6489a32449f6d35dee0ed22959efa7a5c8f8b9d3e171217571114f855f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
584bcd276362b53229c4f46efc97dde3

SHA1
4067852bec1ea019b8621c06682008a14d969cb6

SHA256
9cb94b0259404906bf4a58dbde440930a132889649a0e3487b60a58bd4386e5a

SHA512
72e736c755e011d3349be1b59b860fec3f7dc266658bf7da921e6035a445576f59bef81a33cbc728dae4232f513a9eb3a82957bd82fc2f94323dac952434b6be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d2eb018d82bfd0526a64ed4d99eb7754

SHA1
3414f9e0e4d3f7bcbd0250a4b0109c9e551e2259

SHA256
2999f2531ae3979ab639f19fd20d64b25ff669ccc4dfad181b67480ca4aad311

SHA512
f72f88e180389f699f8d356427891bd75c97361474622db6a2d1a929e2e00f75dc623d926bd642543cf10d8146255a545fceb24fc8467bba500e2fe0319aad5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d64ad897514ea9912b71b6f5d93183e

SHA1
2f9c98c2ffb4e6c1b6cb63eef142b991582ffe7c

SHA256
a9ab62ccd4edd643bcf6d427241ddd9241fe6d7155598e5251bd584c381dc144

SHA512
b77c3992613296147e68b51ffa998484de417e93fb66915e8cb2501d3a1d59cb3033ca67c4a1a1629666c52c97cb911ca627e0027d2402889a2470781362c4c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f253ed52f591fd55ba8e17b1172218de

SHA1
0f53130ce357608f3a808b37f50fc882b8238b6e

SHA256
7b9e2e9c236b282d9643bc2035fadbaa3acdf0cea67843a2f912dab6b28702eb

SHA512
87b0e441c19997cf251d7a6e32b243d6c63a57841a51566cf195a162d8d0657c6b5defd3a54990151756d213fdf7d80590ed580994a7a3a42457421d71034982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff304d3f8a4c5635748115cb0baf25c4

SHA1
ee1eb1c53372657d3a066f763f36b0d05990c7e0

SHA256
6f7f9672a82519180fff5e6051942bbd4583688014485c202328de9be343161c

SHA512
91b653498733645cb3f625ae282d9267060e25711e5b3f244429c5b5ddf20945f0358de8e1b48742d6a0600d57e8b214cd3690bc40061cd1093441ea6a25f26a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3f9f7eeac9b9b510cf6ebb66bb2cb29d

SHA1
f81a1bc15cf70d62ab2f66728ce9a229e9102e40

SHA256
7d13b7dfa7105261dbe53a9eb14d257bec11a245a1be6489924b289f3fdacc70

SHA512
435c1533aafd1e0d519d84439dedb9051ef4eabb434a96a07ae24eb2399c37808da14397ebb65a7f30c707a745ae808e64778b21fb084cdef6bf54d3187049d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
58e1f43861caed550894df46149ee661

SHA1
e3620576a103a404e51c1877fa12e9e90c27c313

SHA256
822a3c8a0806ddcd651040db8b62093e652c6b776f0f5152386283653145c380

SHA512
cfbe2801f828f9380b4efa4879f3ac50870dafa29af9dc928343f999d4b4c0f8d8caa4cd419785a4d17593e2718634fcd9a866f0ca0a76bd9186823fd440e765

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\System.Collections.Specialized.dll

Filesize
79KB

MD5
2de2fe6fd25fb4f08a29518c10810066

SHA1
84930431cec1a193feab51ef2dc957f1e7008c05

SHA256
725063e6b57bc7baff8ca612ac1bd852c74df8ac43fe70f8d66fdc7d7eb939aa

SHA512
c51e12885c252c3cb18fd36316da465cadfa0082671384480870550b737d574cdafb460f4899537fa3c39b00d6c153eb13bb06a7ca110dcfbf52b2b9e038103a

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\System.ComponentModel.Primitives.dll

Filesize
48KB

MD5
f70bcb4a777e63817ca35963dc964923

SHA1
f60f88e8d388fe5954d9e1b2a1dbcd9f4de4b91c

SHA256
b93edd180187cbc753f429a792c4d08173e9183a206ca9ee358b0a0e9ddfa740

SHA512
95e64404be21ab765f38832e46f47c17d472620131da3259ae5a4df144d8a2e95292a48d17515889b2cfa11ad2078c5d255a2fac088e61898bbbd80b1b6ee5b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\System.Drawing.Common.dll

Filesize
844KB

MD5
5876999b47dc16b1addcb3989626b7a4

SHA1
e72f2c1b5cba36950c06730afed651e2db6d4b3f

SHA256
90077a060a25fcd21ed5a6debffe62c23ffc708bb1490774de2a1270deee36db

SHA512
0d2941c3daf4af7d309472698d2437f374203b25eb535f1c17a745f96188729ead287e30af0cc1f72b118fbc2a46872cca75e09966e1cace8ecdf58cfdafef05

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\System.Drawing.Primitives.dll

Filesize
113KB

MD5
855a259c9be811a2cb30f021fdd2edfa

SHA1
8e66792313a447f49ec8c32f54400647f4c6d305

SHA256
ac4c5bed3f63921147a050c1b7aadc198fd5e148653b15cf9e7de31c28fe7b87

SHA512
ac4ee1b7fdc7468d3bdc5de94d584d6104f1b4773f1dc81e04ab47d2b42a37a62b22a18f1e513b7f746cc64df10429e9e5d48f5a05193086ea0630d2b3ada4c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\System.Private.CoreLib.dll

Filesize
8.3MB

MD5
d7cf959f116b764db8a0d8d556b50925

SHA1
dff30b342248adae4801d17e0310648dba4ea63d

SHA256
9ce4d015b9350831a05fc43ca0230148efac40ad0f3f2e7483c5bf131cc458ce

SHA512
d145561ea7d7312c81d59a56ee4f884fa8fe6ac82b6a2eff76c8ed09021fb16ab73722d800bab9318467798693c926b9a8c05c68e1441fa5c3bae2e1ae60a86c

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\System.Runtime.Extensions.dll

Filesize
188KB

MD5
4ebe62c159d77fe4f61e33f9770d5934

SHA1
74ceb072d4db9160e8e02bbee0a9540a47dd791f

SHA256
f52450c3184f1657de8110428f92930f0ee4acba19c030573bf72fe2f30b8499

SHA512
13404234a035523ca3867681a5cb926b8df3db3030e49d170db816a4fc4919e13d7f42d288d7b6c791c850bea0f562edcf5aebd6be0f8e779fc3f9e966e43e93

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\System.Runtime.InteropServices.dll

Filesize
49KB

MD5
b57f607811243f83f754a6bf8908ea69

SHA1
f1d7286352ae7c3d69aa30ff190a5fde8ffd8b96

SHA256
458fd4466f84acbfa5a84cf9a403ec8ed2dda111fe985523a3d51081a3e63b24

SHA512
cd3b375174940b4e8a13aa7184911789d4d6c67f01f02f7f085c0a27c94309bf7231515784e06bfea21e84c903cf318f42c542c9eb8cbccf3f67f451d47081be

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\System.Runtime.dll

Filesize
51KB

MD5
64b6db4e5edc35b1f0f4f8661b1bb5e8

SHA1
816f75651ce029b26284796f1436e229e06da9f3

SHA256
9e1b4b18ea91fee6a83957212e2c33ca1b332d56726e45482e00dc28d82e4444

SHA512
219d8163df984415d580737dc23720f1b2d64b4ebb03ee40a5aef94b50e5b6b2ce206cf307d58dd9690ef021ca9df1cdb35380256bfce637212f4695b57032e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\System.Windows.Forms.dll

Filesize
11.8MB

MD5
29e7bca05ad06acef81ed4c25c489020

SHA1
6a34bd3c75eb19ff25f35f1d89a6a1fd9335ea28

SHA256
878ee3c26121608f5b0ddb13448fdc4c9b78c5ceb54c56f9d0814bd010b702f0

SHA512
e6316ac148115b1774c0935003e211fac55e202f4a39e524f60315dcd23bd57c3b5dce0b0213008706acaa66f936ac0925804da621a4265296c0bc011d99e69d

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\clrjit.dll

Filesize
1.1MB

MD5
a873ebf8b135192456bb47edffa641c9

SHA1
533375c44d5f0ed5a194975817972ca5e2e646ab

SHA256
520ef22ad5cdc40025f8964d0cefb39b0c88cec4e0f7d49863f004887adecc95

SHA512
c8a46a050530287451101ebe89b2ee4149d3d3402127c78be5b201d8a66c1b2c3adbdf33f7fc866008e8d4920a24635719baa1c172c84089afeb8019c76c8f17

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\coreclr.dll

Filesize
4.1MB

MD5
fdb0d51a8c7ad31a75001ec87efc2039

SHA1
264a5dd57656841987f6f73d2b15290340049ad5

SHA256
d8877ba978e5ffb733026d15fc6e7b60862c8c43ad04ca3e5b663b6dcc7dd6bc

SHA512
590d8d45c59cd42ba0d0be068baf5d339228f6ff38f7282909679f3a2ea3f25f5110c072276888c986f020bbddeef48b69917900e7c94bcaa22bc3d0d6c978c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\hostfxr.dll

Filesize
335KB

MD5
36e668a570def150bc37c64bcc824af5

SHA1
c475d9bbfbf8e71197c06d86515cb84d06be0ff8

SHA256
26ed6778f4d368df211d035b548fa9b3d22976def5055d33c0f2a2d7086ed54a

SHA512
cf728f060688cc2a19186f029ecbe2f11c68dc56ed12e2759af0b21a74ef69d1a6f40d777efed4eb32b581acdee5bd5c668339c928556987dbf1cdb2533143db

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\hostpolicy.dll

Filesize
328KB

MD5
862514252dc75f2275445ca4798eea1f

SHA1
6241c1ef41b521a7766a87732382e0c940c96dee

SHA256
1f81009336fed33b50bf187d70a16929f4d1b4f78b4d1e16bbbf7f6a87ec5bb1

SHA512
b070c5a4d4d649da59df88ef0030f74a7e1096da21f27fccb72d3027e7b9cc87193fde695b32419982249b8e7fce7d5fea679a6c085a4605a09bfdd976a26a7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\wallet-electrum-portable\hDjuA4+Knt233vcSVJIbaqtjW5BmeDs=\wallet-electrum-portable.dll

Filesize
530KB

MD5
63ac1836393f80beec3b402c89fa44be

SHA1
813c424acee3f72a0e05ad505f0e27057bb3a3cd

SHA256
101a075ca84b3327058f75b3624dad30d2d25ba26ebf728706517fb356211ee0

SHA512
7d6e19eed7fd40086941cd1a4bfb5b3897d6239460335caa2411cd0f8b89755a47233568eaf34b07b6a615bdcc77e5c80661321039feacb56fa250656163fddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5qfaer0n.44e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\temp\filelist.txt

Filesize
6KB

MD5
db372e5911feff8966ce5784f50a429f

SHA1
634e1e5f5e9cc2aa859b88fe507d62a75e928537

SHA256
70635f5ad929ff3baed11f96d10140c7c4dca55614372dafb2b79545b8d4e930

SHA512
922c5faf96f5b6d1873388aa275f65f24007dd6ef48795d214399d5ffca1da9ae8ad23e2fcec2ef941f50cbfe909ca83a7eaa703a77a4c7a925b27d6fd1635cc

Download Submit
C:\Users\Admin\AppData\Roaming\temp\request_finished.txt

Filesize
1KB

MD5
cb653b2f7d6c80b09a1ba2ca9e3029b0

SHA1
abbce82b178f19c507520823f5b919efbae635a8

SHA256
012e2797d425d4f57a0566feeac8ee558bb07d7ed6173460f6d5485a226fec47

SHA512
df24a580463a442068cb72b40c062e6a29898508036f9b25333cb5d4d4fc1dd113986e30cf4cc2dacd74a63b67c201a415f6785148bad3ebc030e941d4fcf9d6

Download Submit
C:\Users\Admin\Downloads\7-Zip File Manager.download:Zone.Identifier

Filesize
118B

MD5
8c6021eea5096ac677df1202b052c569

SHA1
0a42738594e8d81a08fd99312408f7a74b132012

SHA256
86a1154282de16cd0c51a75a697eebc441a25975870b4af50468befb4ff1cf31

SHA512
eb8f8485f31d8d1927a862ad36b2c4628181c4e3d2bbe443ce8bd4f4f8d92d96bdb6a8cfde64c520d075749426ce0ce51b85c594d9699a77de3c37d0016b3138

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 351220.crdownload

Filesize
776B

MD5
996d03755ccec3d1f7d49a503916353c

SHA1
b3f72f5f1fab74fce01094dfd4ab0775b7a97e34

SHA256
9d2e6a89b885985669591046dab4d772e505277b5d718bb6793f263127704ff5

SHA512
c227db6ae7c4b871231ff4305e99a3933366eebad1226fe6c4998cb42dc5227334374f2366e4adbcd83b2deaf6865b22476cef5021c39f11772831e5bccd9a39

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 956187.crdownload

Filesize
1.8MB

MD5
3b2997c74f32cd069f85da5da2a22abf

SHA1
0ecc24d6694288af5927fdc427d5284407f7bd18

SHA256
f51b708c541621e96e4eaa92513e8f25e1524f302c454a9c0efab30ba1cada37

SHA512
b76d05cd13ef70dbc1b4a852711f6600393ee252b17f95dbdc4542eb0aaf94e18a711ad6eb45e12fe7cbfe2dde26b0c3cf05573f357b25f30f52d44faf781990

Download Submit
C:\Users\Admin\Downloads\X. It’s what’s happening - X.url

Filesize
54B

MD5
1f3f2eec57359b1d24c41299cc711cb3

SHA1
65fa2f96e6eb26b854bf21218d9089b98a37f7dc

SHA256
202988e4416af9aeef18095612064f81d2c98c719624a7264d9d61679b22d275

SHA512
520b2a9142a1d622488780942d94dc48f0380c2f9952f8f579fa2882fbb334103e2d5258661b9cd8383d700cbc959bf4fb675ef734e06c20818fc2bdb607f559

Download Submit
C:\Users\Admin\Downloads\X. It’s what’s happening - X.url:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\passwords.txt

Filesize
178B

MD5
f0f572d18f8fab2998f9eb1cffc6d980

SHA1
005f5876ccf90d1684eb8b7e72114c44131ee062

SHA256
f9c611d51086b4222bc9115a5eb6ebf5c73b9bffeb90f1eac9436cab62643b1d

SHA512
c797175e69b371748c7440287b30224b727d4ab0ae944256b118f34b4a4ffe2f8264578a24afa5c8da4a145ad09c07a6b96c515f0c6f82eb393de575aa713235

Download Submit
C:\Users\Admin\Downloads\passwords.txt:Zone.Identifier

Filesize
105B

MD5
95c8cfaecb60641b1504d338c67e3a6f

SHA1
138cac520229d08b2f4ae78c08c9617522ddb963

SHA256
33a2543b53bfdade5e580001717da8819c92e5b327d7b1a81bdf521a1425f5a4

SHA512
a5176e838b71dcfa6df30afffd79a92391ff1c559778fe7fed0ee88573a6e7505c5d6eccc9c512a404ac426cdb62ceb7a6cb9155195d46e6695a20024b3d4fe8

Download Submit
memory/2584-1236-0x000002593C8C0000-0x000002593C8E2000-memory.dmp

Filesize
136KB

Download
memory/3440-1410-0x00007FF918890000-0x00007FF918B46000-memory.dmp

Filesize
2.7MB

Download
memory/3440-1408-0x00007FF72DF10000-0x00007FF72E008000-memory.dmp

Filesize
992KB

Download
memory/3440-1409-0x00007FF931110000-0x00007FF931144000-memory.dmp

Filesize
208KB

Download
memory/3440-1411-0x00007FF913840000-0x00007FF9148F0000-memory.dmp

Filesize
16.7MB

Download
memory/4200-1258-0x0000000005CF0000-0x0000000005D82000-memory.dmp

Filesize
584KB

Download
memory/4200-1253-0x0000000000ED0000-0x0000000000EDC000-memory.dmp

Filesize
48KB

Download
memory/4200-1254-0x00000000057D0000-0x000000000586C000-memory.dmp

Filesize
624KB

Download
memory/4200-1257-0x00000000061E0000-0x0000000006786000-memory.dmp

Filesize
5.6MB

Download
memory/4200-1275-0x0000000005B30000-0x0000000005B42000-memory.dmp

Filesize
72KB

Download
memory/4200-1274-0x00000000057A0000-0x00000000057AA000-memory.dmp

Filesize
40KB

Download
memory/5156-1289-0x0000000000BE0000-0x0000000000F02000-memory.dmp

Filesize
3.1MB

Download
memory/5712-1293-0x000000001BA70000-0x000000001BAC0000-memory.dmp

Filesize
320KB

Download
memory/5712-1294-0x000000001BED0000-0x000000001BF82000-memory.dmp

Filesize
712KB

Download
memory/5712-1298-0x000000001D010000-0x000000001D538000-memory.dmp

Filesize
5.2MB

Download