hxxps://files[.]multimc[.]org/downloads/mmc-develop-win32[.]zip

Resubmissions

17-12-2024 13:27

241217-qqcy4s1mhk 10

17-12-2024 13:19

241217-qkp2gsznft 7

17-12-2024 13:14

241217-qgv4bsznat 7

17-12-2024 13:06

241217-qb3k8azlh1 4

Analysis

max time kernel
407s
max time network
409s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-12-2024 13:19

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://files.multimc.org/downloads/mmc-develop-win32.zip

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
652	x2s443bc.cs1.tmp
2356	Downloadly.exe
4300	MassiveInstaller.exe
3764	MassiveInstaller.tmp
3668	Massive.exe
4896	crashpad_handler.exe
252	downloadly_installer.exe
868	downloadly_installer.tmp
1288	ska2pwej.aeh.tmp
4444	walliant.exe

Loads dropped DLL 28 IoCs

pid	Process
2356	Downloadly.exe
2356	Downloadly.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe
4444	walliant.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Downloadly = "\"C:\\Users\\Admin\\Programs\\Downloadly\\Downloadly.exe\""	x2s443bc.cs1.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Walliant = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Walliant\\walliant.exe"	ska2pwej.aeh.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\2503326475_del = "cmd /c del \"C:\\Users\\Admin\\Downloads\\HMBlocker\\[email protected]\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\2503326475 = "C:\\Users\\Admin\\2503326475\\2503326475.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
42	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2508-1121-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ska2pwej.aeh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2s443bc.cs1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	downloadly_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	downloadly_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ska2pwej.aeh.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MassiveInstaller.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	walliant.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2s443bc.cs1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MassiveInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
3256	taskkill.exe
1776	taskkill.exe
2724	taskkill.exe
3208	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "200"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	walliant.exe

NTFS ADS 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\HMBlocker.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\mmc-develop-win32.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Downloadly.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Walliant.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Deskbottom.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ProgramOverflow.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
5104	msedge.exe
5104	msedge.exe
5056	msedge.exe
5056	msedge.exe
3016	identity_helper.exe
3016	identity_helper.exe
1200	msedge.exe
1200	msedge.exe
4264	msedge.exe
4264	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
652	x2s443bc.cs1.tmp
652	x2s443bc.cs1.tmp
3764	MassiveInstaller.tmp
3764	MassiveInstaller.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
868	downloadly_installer.tmp
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
3668	Massive.exe
4256	msedge.exe
4256	msedge.exe
1288	ska2pwej.aeh.tmp
1288	ska2pwej.aeh.tmp
3964	msedge.exe
3964	msedge.exe
4784	msedge.exe
4784	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3668	Massive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	4444	walliant.exe
Token: SeShutdownPrivilege	2116	shutdown.exe
Token: SeRemoteShutdownPrivilege	2116	shutdown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
652	x2s443bc.cs1.tmp
2356	Downloadly.exe
3764	MassiveInstaller.tmp
868	downloadly_installer.tmp
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
1288	ska2pwej.aeh.tmp
4444	walliant.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
2356	Downloadly.exe
4444	walliant.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	Downloadly.exe
2356	Downloadly.exe
4444	walliant.exe
4444	walliant.exe
2596	PickerHost.exe
1700	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1972	5104	msedge.exe	77
PID 5104 wrote to memory of 1972	5104	msedge.exe	77
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 1128	5104	msedge.exe	78
PID 5104 wrote to memory of 2528	5104	msedge.exe	79
PID 5104 wrote to memory of 2528	5104	msedge.exe	79
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80
PID 5104 wrote to memory of 2300	5104	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://files.multimc.org/downloads/mmc-develop-win32.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffacf983cb8,0x7ffacf983cc8,0x7ffacf983cd8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4684 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1404 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,15576354097140891930,3212996889035296308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2248

C:\Users\Admin\AppData\Local\Temp\Temp1_Downloadly.zip\x2s443bc.cs1.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Downloadly.zip\x2s443bc.cs1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:868
- C:\Users\Admin\AppData\Local\Temp\is-7A714.tmp\x2s443bc.cs1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7A714.tmp\x2s443bc.cs1.tmp" /SL5="$70204,15784509,779776,C:\Users\Admin\AppData\Local\Temp\Temp1_Downloadly.zip\x2s443bc.cs1.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:652
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im Downloadly.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- - C:\Users\Admin\Programs\Downloadly\Downloadly.exe
    "C:\Users\Admin\Programs\Downloadly\Downloadly.exe" EnablePro
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2356
  - - C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe
      C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\is-UEQ93.tmp\MassiveInstaller.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UEQ93.tmp\MassiveInstaller.tmp" /SL5="$30258,10474064,1082880,C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /AllowStatusPage=false /ShowUI=false /DIR="C:\Users\Admin\Programs\Massive"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3764
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Massive.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im MassiveUI.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
      - C:\Users\Admin\Programs\Massive\Massive.exe
        
        "C:\Users\Admin\Programs\Massive\Massive.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:3668
        
        C:\Users\Admin\Programs\Massive\crashpad_handler.exe
        
        C:\Users\Admin\Programs\Massive\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\Massive\crashdumps --metrics-dir=C:\Users\Admin\AppData\Local\Massive\crashdumps --url=https://o428832.ingest.sentry.io:443/api/5375291/minidump/?sentry_client=sentry.native/0.4.9&sentry_key=5647f16acff64576af0bbfb18033c983 --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\0506bf1d-300f-4ad3-2e35-4025d1a01d31.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\0506bf1d-300f-4ad3-2e35-4025d1a01d31.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Massive\crashdumps\0506bf1d-300f-4ad3-2e35-4025d1a01d31.run\__sentry-breadcrumb2 --initial-client-data=0x434,0x438,0x43c,0x410,0x440,0x7ff7dad42fe0,0x7ff7dad42fa0,0x7ff7dad42fb0
        7⤵
        Executes dropped EXE
        
        PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Update-a8bab0f1-c735-480d-8509-10f472d4694c\downloadly_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Update-a8bab0f1-c735-480d-8509-10f472d4694c\downloadly_installer.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /LOG
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:252
    - - C:\Users\Admin\AppData\Local\Temp\is-V5JFM.tmp\downloadly_installer.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-V5JFM.tmp\downloadly_installer.tmp" /SL5="$502FE,15992205,779776,C:\Users\Admin\AppData\Local\Temp\Update-a8bab0f1-c735-480d-8509-10f472d4694c\downloadly_installer.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /LOG
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:868
      - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /im Downloadly.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3208

C:\Users\Admin\AppData\Local\Temp\Temp1_Walliant.zip\ska2pwej.aeh.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Walliant.zip\ska2pwej.aeh.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4680
- C:\Users\Admin\AppData\Local\Temp\is-2E1BB.tmp\ska2pwej.aeh.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2E1BB.tmp\ska2pwej.aeh.tmp" /SL5="$40354,4511977,830464,C:\Users\Admin\AppData\Local\Temp\Temp1_Walliant.zip\ska2pwej.aeh.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1288
- - C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe
    "C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4444

C:\Users\Admin\AppData\Local\Temp\Temp1_Deskbottom.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Deskbottom.zip\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
PID:1644

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\f0b12fefef70440abb0ca6a65a2440a7 /t 2392 /p 1644
1⤵
PID:3176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:4676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {515980c3-57fe-4c1e-a561-730dd256ab98} -Embedding
1⤵
PID:4816

C:\Users\Admin\Downloads\HMBlocker\[email protected]
"C:\Users\Admin\Downloads\HMBlocker\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
PID:2508
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /t 6 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3180
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\HMBlocker\[email protected]\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2176
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\HMBlocker\[email protected]\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3268

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2596

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a31055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
PID:3060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Massive\crashdumps\settings.dat

Filesize
40B

MD5
1ed475ab5e93125464a292b997482b97

SHA1
bd386446c8dbc38519c3fb1d576fbe09191997be

SHA256
af95006480c26e70585017786f7092bcf04e970df8973feb4c83b487f19a41ff

SHA512
a4e378da255c09385e556a17a697ea1ff6784d01a9b274fa12eaf060d045effb282cf55f92480c72fa4998966cd5b716b02610c14a373c4c4df8e8e51316ffa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
cef7d30b14ba8e07f4010a805c769ad6

SHA1
7e1fd83acaaca8345b47c11b17050f91121f5618

SHA256
e8436d21ae635e58ac9a79bd92aec4d4043890d9c58f0bf3d5eb0e1c0de3b733

SHA512
7586632b437aaa91196cc0fb7b8db9412b0f87e541369325038ab217327be80c22c8c5115308758a15fbc92970fa961d8c1cb2406e7faf98dbda730bee249345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
863B

MD5
5e89a50b739c7988097d7d7dec995ccb

SHA1
c97c87c747965baa4d8d63a9776d82c7ccbc11b9

SHA256
c27070bae2c12bbdf510fc7e1825e07c14717d104cf80f7a78124c8946925faa

SHA512
345841173cb880b3d62ba84cda23727d3cd55a6fe7d1eefdd5546826523e007667e18158bab43eb3efd39ba63ee1f26d79281f6537c7fb97b733d5d1e6f1e10a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
946B

MD5
c9690a2e006e64e90beaae739fc073e6

SHA1
01b94d46d85ee1c7cf2eed3e704cb6e29ac9723b

SHA256
defe15712c51618fe32630b34fb1f131de9c1afa7ef1388c86831a259875d390

SHA512
fa9fcb59f609bf60642908ea9e9f9814ddf103453d4283ec17ba0bb08636d913d683e75c6016f9aa12f6cf96e92c4bf00f52f4cdd1c8040f99c166f713447855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
533e3d8e65c18bae6bfc99231a202ec3

SHA1
2b9d894da691ad251a223dfa175bcfbfe43fe992

SHA256
a07890668e9a17a22397b681b81d5c3640ec7796e5bc57b3fefe5c846f05eaa5

SHA512
ddbd635d5a79a14ef8aec943158bb04c8a014ae1cc8a9109b761770c4f6e3df56e7fcf8e6d4858448be964735b6b940f3ac4bd86fbe98e61221c8e2aea32d5ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bea7decf4b2650d4b4ec6b3176171bc4

SHA1
006b0b7b2178337affe36e1199f5cdba9b59c671

SHA256
41ad5c251a5df9e353ce639bed35e12bd87ac56771bb03c4bff0e630333e0685

SHA512
b581d956f31f14d7333b8bf3a62596e491ee782682959acf8a637776e98cbc924fc5a2e58abd1b602dfae5029842fcc6ce6a89027819a7a7c912c8e7acd540b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15ea7418018a24d769cc899eb4cb23be

SHA1
59c360f4b1fc40f3146e1de3891726a1a0f6c158

SHA256
f82c3e573a8db293cc8de21dd37b0cd29b297817cba982788ce5abe8abde23c6

SHA512
ded8e9616a591906f12db088373dd88cb365c8abd11177bbb3a80cbf24dc0cea7155b7ab4559d345eb1d815f84a3085337fda5ae43e721fbc6c54e32251a4373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
67486939dbf32633a82535fb9874c1e0

SHA1
79b4f86e6243748ec48c163c7107898f3e840b69

SHA256
7de2c519c90484ee6e682c96c1525f1da012c25a1c8d646b57d51554fdd56d46

SHA512
b73b2366c137db88d81f85f44d99ec015c81f2ad0e5316fbd327ed5005241ee215641ea46ecafccc3b1f0c5b6c1c3790307cd278684d66211c1e1e9769bb79d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
446dadad906143dfb789cd60beb620bb

SHA1
fbd71f2519691bf636eb26169c6593a134a3925e

SHA256
dd58446e5d65f1a312a24f3679f2c11ab817ab91e72214c80e804c9779f8d37e

SHA512
3cb12ca6f0a1de6358936aaab95ad25e4dbe157160d88c3581f4c7bdd14fbf0e8137f4072186654f2a88dd79675354207be5ce5a2e0b6f0e7adb78f5d1154744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e0674703dba1a82b34ce564f60e5cddd

SHA1
606480362d338e51d7e25a010f0344021a2ea929

SHA256
2d6e00526e5c8c4f2b6017e4a46b605fb3bb0a671a727ffb136c386c9cdc03a6

SHA512
a885eae607809b5255871f965056dcd0b8a88a530b40afab2447a318cb4e2cd8c687f58ee248b6de0fa674c8dc225bf886b6018bc7596eaf408d589487b75e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
daa0ebe1c8fab45c62f818d904389be3

SHA1
bba243647a29e2c5def0f5551fb1c7d7a0a1783f

SHA256
b50f5bf80f43e7c577d464d0e9748ee7de9507292bd6349ff259e664f7e990ea

SHA512
4d4cd4fd6e61d505c30e0ca7649dfc19a603511d2d618ea1fe0f78dc8a4a0a616e71e2f045cda12823a780e543608c9f369ad9ad66af693746e95fcfddbc06da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d6a9f7ebc4d65a22d41151f701af7d3e

SHA1
c147c99e0e6e71fe15cc515b486c33e42e782a49

SHA256
16dab031d5ff43a80c103429a9935ca7e87b47d892b362a3faf801007afc1600

SHA512
58436e4dc42540533d59e81799b1641093de93a631addb22cc9a622f2eb9cd9282c134a699359009e8d9f4354b4dd85e338c2e117abca11e7ee77b433502bbbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
436f9dfe107d3e910c1773325530e00a

SHA1
a43d239f64a90c823196d9e0e0d67fc3a9a92f1e

SHA256
b87aa9ec8520223440c6f5ae7647ed4cd761b88c7865ddd50c803172a128c70a

SHA512
c79b113d7bc2bb60506894e34ffa0a98d8c847504ec48f8013c094d1327aefbac997c7c5ef07590616dd5be34f62bdd61f8671d7f833fe9ef657e43ec353467b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c5ae66a62d0183013e52bcfd26d4e42

SHA1
a5b79baac43076281ad2483b502031507ad6f4dd

SHA256
d6f17f71714d5c5dfd0778ae702fb63c6e535ceec7283fb3a9f02cbfac6d11ce

SHA512
b2a057a4c821279b2638bedb81f99fcf27b21591e52527b6f5c9c29db5ca3f5a9b1559b175adcf7d78f54126993faf8a98dc3e2778d8de81632b087081814280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
46c368467c8117d85f4b436d70f1d9db

SHA1
591aa8a9b24b40e1c77ab3409eb698dea0328b72

SHA256
cc13eefd677ee3719bed04241941570b8498bf6538cdd7a51bde5b20fe2a4415

SHA512
8c8e9e4d478da12297bb05473b8833b3a461d721ffcbbfac20c771e7cc4e9bfae404c30ef864e8af4dabed37e33fe947f1928bfbd6f476eca2e7c1ee2cbc5eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f230f8308c72b057574796d6135de7d7

SHA1
b63fb46a5d758868b9a36a4d00fe6cc297b32908

SHA256
80dad7119ab49159b42ae9b12539667d08e25dc8a7ec47fec5c9973b63b03005

SHA512
62c688bae9bec20534c74fb84d59f59ef36420df9cfb1dda43441b5c97126f27319270b7a90a9cee669a82f78e70d47ff06a98ba6d0fe8ae3c8d5d041cea8907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
23b10e9368339a9b15d30ea1fd3a3fd5

SHA1
a59121a4a5c0c39478e3d5a773ce9f8b38b7785b

SHA256
6a38d3d6c5f887447041226dddd72733ba7854630614014f693f220a224f5d97

SHA512
5771570583b2cb2bf9e1700044abcac6945d7dd4d50ad807aa4ae42766803fef7718112148028a83d954bdeeee3d5ae3b35a988cce1b20e563ff996be6bdf617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bd0358a696ee8895743be803a08f74bc

SHA1
858f222480726c4951e1ea1a0526ffb11d467b70

SHA256
08c5157f22f7c5746e46a417e3dd07e3fd705f112f83ef27848db30d0d01a4c8

SHA512
9c452ee5ebcf5d1ade5194f016522f1279756bd7f3b94f5bcf8639173896f4e8db946ff0912d458f011f53193428d41823358e7f4e1d159b4d9ad42c6c28905b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581018.TMP

Filesize
1KB

MD5
8574e4579e8dcdee3124fb5b3484157c

SHA1
4c82b56ca738e51a062d312c76ed164752ddb6c4

SHA256
11049f5dc0de01f03f3a4b92ac8f49e91eee858148c40e16e449994b34162c75

SHA512
dd8e3d1c602e2017f33da6522b4374589fec118fa839b9148af614f7b0963afcd2077e2a72ccee79c9ba0d4f263c1c32372d9119b3f6b41b3e5ef46dc65119ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
377ef37121798420f1cf7d380611ccce

SHA1
6a69838c259d7dfa5deb4c7e557a294a9c5cde4d

SHA256
4addcb45523dbabf9a8074f90d57f0189a7d944b03d7186907c762ba2b9fea99

SHA512
537b75a81190542f40f67fb72364b8a7e68d486a57fcb55616ab33a05d8d831b1e6ce38ca58f60fcb503b006ed9d82351366718682c147674ecf7885ffa52423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5966a3ecc31a3becc4fc09302865b190

SHA1
752fa131ce0024ccf4056599acb37c1cbec39d75

SHA256
83e93bc695843c6ad63deb8012108337e3de5c0aa904918154f99634ee07fc6e

SHA512
066ec72805b890b856ccb6cb92f3ea5b1c09f3c897cb9cbe838beca8518f87a4529092b83a43fe77eededfba1e248750b64186b3d0d9b7a0d0001f4318f72fe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
36349acad862bb763e8815d43e822a89

SHA1
d2580563b949bfce72c795ec6710d26b4e51c68f

SHA256
ce24bd08d4bd33cb0be659544867804c42b9ee5dac18cfcf07956d52837d1d13

SHA512
ae64747cc76b778922592d734105fdccd3399cf47a99fb2379feabe6966b7552a01b6cc3fe6b84e5bd4e489980e45b34f18b597ea05664d250d9cc88f4e61c03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9434b86f4445596559e26bb8dd79a82

SHA1
b9d12f41d1fb97a86d4af181de65549ac059e965

SHA256
d96f869f95d5bfd616e7e0fe9726edcca511c40f479dad34b8a8764d7cbf07ee

SHA512
cd850dc5bb1477abd30302cf2dd35bd83f6e2307e45b220e851e073997b99b7f0a3c02b60195d0f58e66d51455dc15e6c2e84e56f5dbaa3c794c2ee787b7b19e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7d09fcba8b91c528db6ba35072bad46a

SHA1
cce7b84b4a2c6df9ec48be5661677ab21c7cf7b4

SHA256
7998cf57e3f69e98c3f8e42e94e51570a97e295037037f69560ceb02d3115b2d

SHA512
cc8f52dca8618eea9ba9553b3d6720ef306c2692c197e8fa327449f1b8802aef8aaf65891ee7a70c2ac0ecfd3628e1fedd55245fffd84047494b136e0839e940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a204d968d1751a5a7b209488f2c993bb

SHA1
c02f5f5cbcdc24aa72f25824e815d37e84566e0b

SHA256
7decb1c649a2496063520a589a91c536c7053de85c125b336a009e13ab00dde9

SHA512
85ec4b19926d382ca29581afd61ccc01c935737bc8c709a3d6cf42fdf5cf8ecc7cb07e86f650d72d1efc0d04a5744a21ff636dc83d068cd93d2f90753033686c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1447684527895759125b2a1a7ddfeec

SHA1
e4985e0c4ed45e7d365e9ef3145b84a1f62fb444

SHA256
9469a5d5cd2f12778741a1e7559bd4a56b68063b1687257d54a868c35be66288

SHA512
68cb94276a875d42bac4f156ef0d3c2d61285a9cc6bda918daabdac8a422775f1e9f7a7d9305a96870f573df767a9088ceb7a16c55f50f6eb0e734e83af4718e

Download Submit
C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe

Filesize
257KB

MD5
60d3737a1f84758238483d865a3056dc

SHA1
17b13048c1db4e56120fed53abc4056ecb4c56ed

SHA256
3436c29dec2c7f633f4766acaf334f6c395d70ea6180c0ea7c1610591d5d89b9

SHA512
d34f42b59349f3be1ac39a57207f616a44f56a6c74157be8116fff5df75275928065065a89f10bd79849e58b14d1e5e0ea156be5996ff8ca4f5d854e107c96fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update-a8bab0f1-c735-480d-8509-10f472d4694c\downloadly_installer.exe

Filesize
16.1MB

MD5
61016d79751db97b3908e31a438d89aa

SHA1
668c2f50db94be4d8f4f1b9a3719a1741f5bb802

SHA256
1b8a0d83673e2e5df870918d436ae62a7d65dae9351fbf59e3ca20902a5c33e0

SHA512
7e8b8bd34cda535052c57e6b5535e88546399d68be3ac1426c398d4a4fa63efdc9b5c32074478401dbe06e49f144bde2927fb9225b00f805427725c11519ad73

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7A714.tmp\x2s443bc.cs1.tmp

Filesize
3.0MB

MD5
0d5dc73779288fd019d9102766b0c7de

SHA1
d9f6ea89d4ba4119e92f892541719c8b5108f75f

SHA256
0a3d1d00bfdbded550d21df30275be9bca83fb74ca3b2aabd4b0886a5d7cc289

SHA512
b6b1cf77bcb9a2ad4faa08a33f54b16b09f956fa8a47e27587ad2b791a44dc0bd1b11704c3756104c6717abcaffc8dd9260e827eccd61551b79fcedd5210fe61

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UEQ93.tmp\MassiveInstaller.tmp

Filesize
3.3MB

MD5
d8d247f50f2fcedb15d0c36f718d8485

SHA1
f8dc3506c4692f84045c8943de487ffdd4724778

SHA256
c7b839dce273e007b2a9739bc123584ca2c4ebc1fe3fe783ca004a38113ea221

SHA512
c9a31ad4de6e991353cdb4d2821134ae6dad4c420e3140ee455557844d84e651da089c56198b7b13b914d269f378b166e26dae2d8555d8f0cac0631c49c36ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V5JFM.tmp\downloadly_installer.tmp

Filesize
3.0MB

MD5
8097152e93a43ead7dc59cc88ea73017

SHA1
b21d9f73ecf57174ce8ec5091e60c3a653f97ecd

SHA256
5a522e16c4b9be7d757585c811e2b7b4eab6592aed1fbc807d4154974b7bb98f

SHA512
d885a2ecba46c324c05d63b5482d604429556fe864202b1127866f2798ead67228390fb730d44ccef205c8103129d89d88a9541a4657d55c01373f8db50f7b23

Download Submit
C:\Users\Admin\Downloads\Deskbottom.zip

Filesize
236KB

MD5
0575625e5ced1be9f4018c5afa456406

SHA1
70f86daa07564d318c2825e08e2f70e8bcbd7967

SHA256
37e612d9c4d2fdc46c132a1ebac107c720e45135f5c79956140f8d38a951332f

SHA512
992f17fe1348d9f4d5f3870302a268998194e8d59c1087b3474568434e8dd90aeefe57aff7d0caa91fcfe7239cf9e9f38094b3767ae9d9bb592c41942282088f

Download Submit
C:\Users\Admin\Downloads\Downloadly.zip

Filesize
15.4MB

MD5
fa4f62062e0cec23b5c1d8fe67f4be2f

SHA1
0735531f6e37a9807a1951d0d03b066b3949484b

SHA256
a88edca3b030046fe82e7add6da06311229c5c4f9396c30c04ab3f0b433eac6e

SHA512
0ffd333dc84ab8e4905fb76b3be69c7b9edba7f4eb72cc10efc82f6ae62d06c36227f4e8ada4f896e359e5ffc664d08caf76e15a40bd17e9384e73842e845995

Download Submit
C:\Users\Admin\Downloads\HMBlocker.zip

Filesize
38KB

MD5
5968e8a8caa61b46ba347f8c521c1f2e

SHA1
88f9a7ce6e77d191c9a57ecf238ef5e9e9ba6c7c

SHA256
a181f8925c8c66614be38de89e6dc38cf85715379a10de8d9f9d70b04891ca35

SHA512
6b0659ff7a5548cd1b752a72a70b147d1c9676dce14148430961a7b5204d4e3a42de5530d423ebb879f8e5c72785a45e5b20bd40cbf93cfaefe981534e96cbe3

Download Submit
C:\Users\Admin\Downloads\ProgramOverflow.zip

Filesize
560KB

MD5
44481efd4f9a861444aa0aa05421a52e

SHA1
22e9b061f8fc3147dd0ec8a088a38272b0d30bcf

SHA256
7b8632db07cb8693963402624e6ad884187b23f81ec7968fba2631909d5919b2

SHA512
819cf783345751f6fb000142b59ebac5b72c8878adfaec1c9472bf242d7a469cdf21a2d89c6e292599606f19782c1951752f763bd89efed35e1b0f2d2fd52827

Download Submit
C:\Users\Admin\Downloads\ProgramOverflow.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Walliant.zip

Filesize
4.5MB

MD5
33968a33f7e098d31920c07e56c66de2

SHA1
9c684a0dadae9f940dd40d8d037faa6addf22ddb

SHA256
6364269dbdc73d638756c2078ecb1a39296ddd12b384d05121045f95d357d504

SHA512
76ccf5f90c57915674e02bc9291b1c8956567573100f3633e1e9f1eaa5dbe518d13b29a9f8759440b1132ed897ff5a880bef395281b22aaf56ad9424a0e5e69a

Download Submit
C:\Users\Admin\Downloads\mmc-develop-win32.zip

Filesize
13.5MB

MD5
380be19040cb6a051b6723d8b67a5785

SHA1
f957c51199969d92f1f0c8889690da16d62938a9

SHA256
28061938a1282f8ec3d5e45b0780126e4db95de29d88c2d99bf7fc4767ba9554

SHA512
fb2f495f1a57a726a9ad68a1dd0633c2090c9f2f44002567d171e3d8001fc8bd15d57e92a837d9474cf52c4f2492254bfcf07d0a70c7c5638f7d05750b2bc8df

Download Submit
C:\Users\Admin\Downloads\mmc-develop-win32.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Programs\Downloadly\Analytics.dll

Filesize
49KB

MD5
4bfda9b9b1176dc30c84a70fed2c1316

SHA1
72b1921cec6686f52d05a5d0cbed274cd01a0f00

SHA256
2d17ed0895df0d2f958573eb601a1485604e63d9f8ff905fc1fc74f1c43b2904

SHA512
178939745a74943c239db8c740a8f547649004df5c5b469d55967d69008803377bb47befc158b1d6faef421f0c5b583e975d55207c6f92a5b8769c2ae83ce9d1

Download Submit
C:\Users\Admin\Programs\Downloadly\AppIcon\icon.ico

Filesize
3KB

MD5
3387dda8a9109717168b2691a8c5bdd9

SHA1
ede213dc7dc627177aca420745a883b4cc1fde13

SHA256
99c2bab37ee04bc9dc210bef0365120ceb55f7d2f859eb1823c1a9d23ad75482

SHA512
581f0fe668584b5872cbc64e03296090ba323d83d250cee9aa65430cffb35c1dc367c04245f7f89643c752cfc3b8a681fa7a842355d52da1e98e1708c6749ff9

Download Submit
C:\Users\Admin\Programs\Downloadly\Downloadly.exe

Filesize
526KB

MD5
c64463e64b12c0362c622176c404b6af

SHA1
7002acb1bc1f23af70a473f1394d51e77b2835e4

SHA256
140dcfc3bde8405d26cfe50e08de2a084fb3be7cf33894463a182e12001f5ce7

SHA512
facd1c639196d36981c89048c4e9ccf5f4e2a57b37efc4404af6cafb3ec98954fe5695b0d3a3ee200b849d45d3718b52cce0af48efba7c23b1f4613bcaa35c0a

Download Submit
C:\Users\Admin\Programs\Downloadly\Downloadly.exe.config

Filesize
4KB

MD5
894f0bab00555ff07b8a97a05ef659fc

SHA1
e3a469e2654ab2630e13243b432abdbcd269836c

SHA256
6b56cc5c8bbc5cad7f55212643ed4a7408b43fa297642f250a05d3a59be21a8f

SHA512
697673191d1491652d0d42ca727b1be11cdf59ab11fe3330bdea8134de3ae32f4e83482c09e588b5b542ed869e1e5dc9e1094533b666d30f28b298f9046e8785

Download Submit
C:\Users\Admin\Programs\Downloadly\Massive.dll

Filesize
3.1MB

MD5
aa8a9be864bb1e25c6c371834beace33

SHA1
e3904292b2ca564258c9278d6cd5cc7dfc69f95e

SHA256
b384459db379a1f47877f38b5d0e6f615ee1811230ad5d1f456c800e63f0246d

SHA512
8ba1bcb21509276ac21146329c5b3508cd68fdaabf462d1579fd6e63992d72d74fbe095e0c242eec9d9f1e1c165b5d0be065b341b5e74c1ab84441cca7358806

Download Submit
C:\Users\Admin\Programs\Downloadly\MassiveInstaller.exe

Filesize
10.8MB

MD5
df851a46df574a7ddf3d79f20b3a8d70

SHA1
99ab5b3959ee37fcff5145f120c4d2f6c2c2c388

SHA256
02bdde9831c72990fad44ee43602215ec1a66f2cf25c8b012772be5af8142904

SHA512
3b67917c3473e8fcd7bd6a026315927f552a00ba170cb1e5a5f355fca2238ccef3e1baf019411bd0a9ab4090a085733e58ea56acec4fbf90b60c05b06ba0feb6

Download Submit
C:\Users\Admin\Programs\Downloadly\Newtonsoft.Json.dll

Filesize
686KB

MD5
785ee25cc12c75540fbcf20dbdd08140

SHA1
e94dac0a508e27a30a5472b2ebfa1016889a42f5

SHA256
d091c67e46698a82bf806eaf2d2c13c3da5d5aa858ba2ad1891fc7a5ddbb4de1

SHA512
a70cae48b3291b9abcfb003289c1567dbc2be9b542501c3bb70c58ec6c730d545b7aaff8f4c6e3a254225670c3b4ce91e0436515089173d020dd09ba6eef8873

Download Submit
C:\Users\Admin\Programs\Downloadly\System.Runtime.InteropServices.dll

Filesize
19KB

MD5
88ced8603c157573f2caa7d546cba154

SHA1
079c6cc8ad485d14612e2685332e47637bc0162c

SHA256
2ca21604678973b95244f99f2d433f7662fb6b65ecf5d35ae5d3bb9a1e9a47a8

SHA512
e74d7d20dc939bb9d93586994de053de92cc2eeeb03603a1e6619389350584970d6d589f3873fd0fbef6abcafb34b5661601ad448dfe088b7480660b81508573

Download Submit
C:\Users\Admin\Programs\Downloadly\WinSparkle.dll

Filesize
2.0MB

MD5
598e7f89a37d006066a497440a8fbfd8

SHA1
067508e7621e8106a7d32587d2b17176172417ad

SHA256
f5f8540822f4c449364e0f71fdf85b33dfca50e73bdc0d59dd6de2cbde367bf3

SHA512
f8c2c73498f0e42ed7dadd8b8af257ead79e8404856bf0877cd71028564a9be9e9787fe40b54e5ffe00f863140fa987302a52399143d97b23bcc0df83b12626b

Download Submit
C:\Users\Admin\Programs\Downloadly\log4net.dll

Filesize
274KB

MD5
e4b95eee136c9c270f9b69b72162f300

SHA1
2b774fcfe5072b4c9ad61c9ebe7d0f26a57dc0ab

SHA256
02017ccacc6855755e8568f411ed248394606c004689119b59bb9ec8134caa39

SHA512
223e593a6bfa57353685ab4b5d77cced8c0dbf07ebdbd2b21077460f0a176428e8fea18eda98e65adc5e95844f089bbe5cc07362eda8cc1afdd9a4d5d95c3d46

Download Submit
C:\Users\Admin\Programs\Massive\Massive.exe

Filesize
3.7MB

MD5
42397eb43466f7659053d8bf97497d74

SHA1
a4fe1de9ea08b15bac7ea65b68d14ad3373877e0

SHA256
df6ad67d8d7bcd3129ca0b2377135e379e99380993838b26da0c92f3ce017109

SHA512
fd2c5ccfdcd2f8f7ad458a0f3180973d202bfd4f71578e1da56ccf9eee0fb12276d22e644f9a159db02eca838b4bab1bfe38cf6e7f2a583e5dbb142d72d59646

Download Submit
C:\Users\Admin\Programs\Massive\MiningGpu.dll

Filesize
606KB

MD5
e72cbbe8eee96adc4ccf8a8058d59d6d

SHA1
31236643077f556745d10727943ccc4aa44f3b73

SHA256
7613707891a06b00996f3988c37b6e8c771272bdefde2f29a95ce46637b16b76

SHA512
523e1e438c6f5e25804bdad08618c1b4b5c68aa146b5f9aa780a4c1e4acaff5a5ca9ee1d3661d25cd2a2ffa6089f8ecb9e935a676afff18831f858691f38b611

Download Submit
C:\Users\Admin\Programs\Massive\SysGpuInfoEx.dll

Filesize
92KB

MD5
b412db9083f140cf9054816edf27d258

SHA1
60338ec1b5f4cda1a6fcb851b4058a8dacc12dba

SHA256
2d6113737940a6562cecdc9bd0bd0d9a93be29486e1abbf7cbf82d5fed489be5

SHA512
e5357d7a0b547c7d5d68db9679b0fbdd47b331e048a716fb3be5ea916c91113324f2209db072a63fde7ea8b46d8e44a4a29bce15547d1a99446880c351ad1e36

Download Submit
C:\Users\Admin\Programs\Massive\WinSparkle.dll

Filesize
2.0MB

MD5
9d660209b1e0353f4e28c81929e90eef

SHA1
880db9173e6f6fcf90dc059df41c6576b7df5aa9

SHA256
e403f1550d010c03f7645cbb97a364370b4e831ab725945d75160edf7202e3ce

SHA512
7901c1369c7ec0ea05be995289dd61e5a35d2105a9b4475233fc8326dea7d5b1a68e3d4754887ea0859cf835a4b9b8477684e19942adfb184b33a0e42a511e1f

Download Submit
C:\Users\Admin\Programs\Massive\crashpad_handler.exe

Filesize
514KB

MD5
607a62e1edbee0ef95ca388cab43e5af

SHA1
44d9527140cee1eb32712bf05528546e54752488

SHA256
a9ecea7bc1de86a3fe66f96aa1c402794df4b1ea0170684cc9c08b12120f1ed4

SHA512
1a97f28eb29eb74fb58bddc8a5c242b85608ce70c99de3f4d2d1bf334de25bfc7a296de7f1f798ef87d48c6928720f0fcef7b43a7f9be6d04c007726e50bc090

Download Submit
C:\Users\Admin\Programs\Massive\nvml.dll

Filesize
985KB

MD5
d805b489c366b1a4e2b5cca7c05a1274

SHA1
92ab5416431924dc485649dc54e91bcee7867cb7

SHA256
2b06637175bf7816d3d8d046caef555bfa5b87cc2143403e516c2d8ee053e97b

SHA512
6875f0cbcf3097d43782a462c3933d94e6f6efed6cd207d770edd4c4f75f7bb3028ada9dbb73ddfbcb04a48c0957d5c6b0892014142b5621f91f37d7c0cb6ad1

Download Submit
C:\Users\Admin\Programs\Massive\xmrBridge.dll

Filesize
161KB

MD5
52b18788d85803093e262cc59f6b9ea1

SHA1
39ae3cf445e8c155c040c9f93080fe0952ef98d7

SHA256
c01b3d50d526a7999462152e7949c86fcf1720b3d558eb5bb9d0136e324230ec

SHA512
30b0b7ae7645c4c98403301e170eb80f2bb67325fc294abcd03bdd61b2fd0cec9ee716aae90d632e71503e926b74fe2b91773893d306eb5f5db0957d1dad04a7

Download Submit
memory/252-780-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/252-800-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/652-674-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/868-799-0x0000000000400000-0x0000000000705000-memory.dmp

Filesize
3.0MB

Download
memory/868-675-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/868-518-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1288-910-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download
memory/1288-900-0x0000000000400000-0x000000000068E000-memory.dmp

Filesize
2.6MB

Download
memory/1644-997-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2356-680-0x0000018B6D6C0000-0x0000018B6D6CE000-memory.dmp

Filesize
56KB

Download
memory/2356-664-0x0000018B6ABB0000-0x0000018B6AC34000-memory.dmp

Filesize
528KB

Download
memory/2356-666-0x0000018B6B080000-0x0000018B6B0C6000-memory.dmp

Filesize
280KB

Download
memory/2356-668-0x0000018B6B0D0000-0x0000018B6B0E0000-memory.dmp

Filesize
64KB

Download
memory/2356-670-0x0000018B6E730000-0x0000018B6E7E0000-memory.dmp

Filesize
704KB

Download
memory/2356-679-0x0000018B6E7E0000-0x0000018B6E818000-memory.dmp

Filesize
224KB

Download
memory/2356-673-0x0000018B6E6B0000-0x0000018B6E6D2000-memory.dmp

Filesize
136KB

Download
memory/2356-678-0x0000018B6D6B0000-0x0000018B6D6B8000-memory.dmp

Filesize
32KB

Download
memory/2508-1119-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2508-1120-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2508-1118-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2508-1121-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3764-790-0x0000000000400000-0x000000000074F000-memory.dmp

Filesize
3.3MB

Download
memory/4300-791-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4300-690-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4444-1048-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4444-1010-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4444-1065-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4444-1069-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4444-1060-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4444-1117-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4444-1097-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4444-1062-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4444-1116-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4444-996-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4444-926-0x0000000070CF0000-0x00000000717EA000-memory.dmp

Filesize
11.0MB

Download
memory/4680-899-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4680-911-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4680-862-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads