phemedrone | hxxps://uploadnow[.]io/en/share?utm_source=tNr04f3

Analysis

max time kernel
98s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://uploadnow.io/en/share?utm_source=tNr04f3

Score

10^/10

phemedrone credential_access discovery spyware stealer

Malware Config

Extracted

Family

phemedrone

https://mined.to/gate.php

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone

Executes dropped EXE 6 IoCs

pid	Process
2032	Resource.exe
4800	Resource.exe
4160	Resource.exe
5056	Resource.exe
540	Resource.exe
3164	Resource.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4072	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
5000	msedge.exe
5000	msedge.exe
4056	chrome.exe
4056	chrome.exe
1144	identity_helper.exe
1144	identity_helper.exe
5460	msedge.exe
5460	msedge.exe
2032	Resource.exe
2032	Resource.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
4800	Resource.exe
4800	Resource.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
4160	Resource.exe
4160	Resource.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
540	Resource.exe
540	Resource.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
3164	Resource.exe
3164	Resource.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeRestorePrivilege	2288	7zG.exe
Token: 35	2288	7zG.exe
Token: SeSecurityPrivilege	2288	7zG.exe
Token: SeSecurityPrivilege	2288	7zG.exe
Token: SeDebugPrivilege	2032	Resource.exe
Token: SeDebugPrivilege	2716	taskmgr.exe
Token: SeSystemProfilePrivilege	2716	taskmgr.exe
Token: SeCreateGlobalPrivilege	2716	taskmgr.exe
Token: SeDebugPrivilege	4800	Resource.exe
Token: SeDebugPrivilege	4160	Resource.exe
Token: SeDebugPrivilege	540	Resource.exe
Token: SeDebugPrivilege	3164	Resource.exe
Token: 33	2716	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2716	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe
2716	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 348	5000	msedge.exe	86
PID 5000 wrote to memory of 348	5000	msedge.exe	86
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 3024	5000	msedge.exe	87
PID 5000 wrote to memory of 4700	5000	msedge.exe	88
PID 5000 wrote to memory of 4700	5000	msedge.exe	88
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89
PID 5000 wrote to memory of 2572	5000	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://uploadnow.io/en/share?utm_source=tNr04f3
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa173b46f8,0x7ffa173b4708,0x7ffa173b4718
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,4319194168738872174,18303574118431575999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa0591cc40,0x7ffa0591cc4c,0x7ffa0591cc58
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,10608255250556260925,7966958080129182311,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2204,i,10608255250556260925,7966958080129182311,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,10608255250556260925,7966958080129182311,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,10608255250556260925,7966958080129182311,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3324,i,10608255250556260925,7966958080129182311,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3740,i,10608255250556260925,7966958080129182311,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:5224

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1600

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ReadMe.txt.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4072

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Resource\" -spe -an -ai#7zMap10601:74:7zEvent18538
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Users\Admin\Desktop\Resource\Resource.exe
"C:\Users\Admin\Desktop\Resource\Resource.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:2716

C:\Users\Admin\Desktop\Resource\Resource.exe
"C:\Users\Admin\Desktop\Resource\Resource.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Users\Admin\Desktop\Resource.exe
"C:\Users\Admin\Desktop\Resource.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Users\Admin\Desktop\Resource.exe
"C:\Users\Admin\Desktop\Resource.exe"
1⤵
- Executes dropped EXE
PID:5056

C:\Users\Admin\Desktop\Resource.exe
"C:\Users\Admin\Desktop\Resource.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Users\Admin\Desktop\Resource.exe
"C:\Users\Admin\Desktop\Resource.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6af834a0-ae55-4987-9638-cad664b8cb36.tmp

Filesize
116KB

MD5
6e2da7217b4d1b27263b27261b64a283

SHA1
42bb555e8e4aace90ccef63a9063d0dcd67f1a4c

SHA256
cc8e08a1da2f7ce38f7e3317554c753a86829286859997e78ac70334b18d11a3

SHA512
a70ea291242ffa1c88ea77d7aab7bcf2b3759c0b8bba736848d0eb6c336e0b07c3d15a5c7dcdd5beefe7ae8bd263eed888abb676dd52c0eba74fa3d333c82afa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d09a7f98d1fb6809afbaa660a1ca0ff0

SHA1
af9755f23ea383ede683deebe8b0e6016e9e3299

SHA256
77001c6c23fb51aca3add6fc1de447188e7dd38fb75f85727b8050a2a2ec64b2

SHA512
a03727b2b1e5fc14ee2888fc2abda6f6f7979d3e27a945fd663a29951a12afa08f40c7ec4a07053b7ce6f6e10caefd823427269c3b8aa3284a9c5ba8f09e767d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
272c4b408bd71283e34f517f74f68ea8

SHA1
0fd6be40aad1212962776bad2339bd2349377006

SHA256
db5992072f5eb59c5c632b8cf4a580ffa7e5a54981b5efef4621b704fe2a91b8

SHA512
6b1ca186591d5bbe7ae396610a7127df58988d22d1057fee3560eac46d12de8a7e2cba535da645d37603fd5b39fb72e44365d0729d8b7c221c73a6f79ac792fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
de7cdd9e6e2dff0c0c4ed8d5bdb3fd35

SHA1
645f5498127aa6003f745d4f038fb3567e1da1ef

SHA256
7c542b4d1f32adbac1a86ecb5e5c0f197c7be536a513e381a41b1edc9f1bc444

SHA512
d67aa48e542cdb9ce00eeac284fb85d37d36b1c0963adfbe572fd71fd2f9490b4ab559989947455cde98b85319c35634c7e3ec62b098880ccac539559b3267a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
ef48733031b712ca7027624fff3ab208

SHA1
da4f3812e6afc4b90d2185f4709dfbb6b47714fa

SHA256
c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

SHA512
ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Resource.exe.log

Filesize
1KB

MD5
ca3a05bcfe06cbb952df54443758a909

SHA1
b70d9f8bf6da29c5028eec57673cf6f1a4fe50dc

SHA256
5b6a9e6d17b3f0278bb417f3d04105fc48bd127b10ec8b3320f080e40cf02d52

SHA512
f4e591319ab46d2cd3a168b2c6fef916432226f96886d761fef7a7534297b820e58e57a4f50a6afac986a7e44fdf9c2566e87fcd2aeafbb4650c38710887158e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
138KB

MD5
6174ba506514ec4b51459759c8d0f0cb

SHA1
4c6340680c3ddaeae06d1a8cd34dfbba2de748c5

SHA256
f22347457dcc1547a18a9aa2526dc2d355b4af14ebc468c0ac56ba1f1084041f

SHA512
799ed2e2ed3837604edd51119424dbc749938a207cd414fa5a709f6b2eef7d9c2195e3b1ffb69a59242190dcf123113b21e895fbee0543e7d74f41abc5729df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c86ee3a470b51c737c0cdad1936f5953

SHA1
6eedd9e200b62cebba3bb4e4fcd0a34d51b09d1f

SHA256
e643d878b56cca486045de98f7b766a13b1cea4f5424fbdfc65c5aa802a84a93

SHA512
6c9b4ee222617fecc353b0ddf69f9afe3bc3c76eec30542acb0a0fb0eb7ffe966af330fc53a2165c86fc39c07410c64034fb822d85c64623f5e87caf017302ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
277a1ced282768a98284130d032a19e6

SHA1
e377300eca6475ccea8a8eca9fa165b9be583183

SHA256
4fb7dc92953aff750b6dd369195d3e1fdb3ae8725a406241321ec65daa8444fb

SHA512
7d05987115ad68dda658757dc2afab1392ee64555fbfdc338686248308f65e578898b68ed73a2ea6c2f992f9beda12032fcf255ba05f988749e2f4837646a1e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4101ecd4ba053059b7e8516e07022abf

SHA1
3fdffdb4d17e150cebe9c546d21f42159c8134bf

SHA256
e121730ea38e802d236c02688a08d6475416547f3ece007931dbf172dba33e13

SHA512
3661579d13f69d0b6fab18b9614ea84ffaac7990df27c0d34c4c43272329046b13de88f39b44b709b32a159dde6f5a28d9133a724de892905584a63a5ecec5b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12f74f0206e3c37272fc7178b4ef1241

SHA1
c700e325d182894d200ab8926b354bfaab14db97

SHA256
24dea6dd4e275ecbe4ae21805862ca12cd8bdf56e548a148e7d26ece354c708f

SHA512
04880fe0340dacf9acd6fbee8ee2643747abe527f68f2b76ff6da4178ad31bcda6b567b8ee1ca0d62fa9a535dbfe1c9d411861856ae1acdba3a030c823dd02a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
af981e3d51a9e48ff44e18d3d53c52d8

SHA1
48c4b2765dab20806ec3eda0e2e9f3cc8063e579

SHA256
c5f227dc1b7b7351ca3afae86ad0ae351750deec40a62d2c58f0931ceb84ac51

SHA512
f90b33043a9577d59e9a9ba45c3004165cd7c1c47466e8f71476de884216fd13011c68ac1e2051bb70ef973ca6a600442317fbe796649b62ce143b74b4f24d22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e02dda58037c2fa958914f18b6c2c95c

SHA1
ddd292942ab7f07d26ffae6097de9c96ffb7b377

SHA256
1b17a6bd810bab7d93c20e27e3c711c66b1543d36384e13f56049aa438ca922b

SHA512
8274df237cad0d6727ab3dd7c4dfac83f3ce87d822033dba0aebff4436f66607dee2f1b2274fd1ec6683e4f0f45a2f5c8c312a37193233824b5a42d16f264a4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
373114913e594d83aae8ed80626cf3d2

SHA1
abb531e98defc12fd900c4befa6051f14b76cd6b

SHA256
8cc6fa0f5f96e669b7d4257ffa01df118db78d6820e5b0bd48587647cc4a7a81

SHA512
6e1a3fdd12e96fc042fa406a949cbc0c7e4b4d3a83ecc8ef595033046e53c05130fad536d1a4c86fddca28b045cd0a29775ba1296591683de80e27723873bbb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5806e1.TMP

Filesize
538B

MD5
30fa4d9f4de48a1846ab20e446f8ecc0

SHA1
7e37a86486d5e16744886e29e0bf13f32d1bbb2c

SHA256
529a6ae2e538595537e992086b5cd73c22e4ab36c2f9c01494b3678979d5f970

SHA512
963fccd7edf68a56a3effa33ced20d0734541e4601557ae90e67158be73f05d7fb9bb34c16e4c6e7c46b474e1be58b6b209a35931e875171d2cff8921626a140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5024b09f12c3abb5b4ca9695f1f70868

SHA1
9cf23470d97ab8693b96295b501b799638a47cc1

SHA256
c393a47a3dc9e2a86036459e49601c6e259e3c5499a56b56ec04ef49ee859585

SHA512
e4fb2156185ef96ea0cf6ae5f45d4b2308bb3258bb3988b1f4af389be1c376fccb6c8f83a9b80a5ff2cc54dfe6f08916c77d87b24f79bce86bc2492f12db607a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
96fa1fec1d61875ba024b6e2256715c8

SHA1
d802dffcbff21432ab8e43b861bed59bcf8431a2

SHA256
9b3f3be9681584645098543a239824ccb77180d4fc328d9bab31fbbded02f683

SHA512
8cb913174884a0b7c86afaefb136b5fde51d81cca93189bb689f27fc86a074c1a823bde4ebc4fa40b69fad9683c9b8ca0a3cbf998299b3008215208b2e83ed25

Download Submit
C:\Users\Admin\Desktop\ClearConvertTo.vb

Filesize
368KB

MD5
1fd50932589a07098ac29f5a25c7b070

SHA1
145788860323fd6399c1e84176d3c66c6d55f485

SHA256
d9a6cc18ea3272a9ab9870d766bb37e1ff052b1d9cdd5084b6dd224c28c20af3

SHA512
37404a436ac4ce1eda4051841fba273356e772a0d27cd6420b060c9ec1ad4b4c3e434ddd3fc2445a2b1c1a7a900c964dc5e84da4ffd76539b1da579f5b68c0a8

Download Submit
C:\Users\Admin\Desktop\DisableComplete.wmv

Filesize
565KB

MD5
e576ca1c63742ee84940ea9bb6611fb2

SHA1
a38669088391930fc2af1077a1214727c0f7d0c9

SHA256
b79ae8307f3cac50a7f56235e991737a097ba4a45ee7dfda6f369d999187c3bd

SHA512
38a526ba33d23b5e7c65c91cdc92d294de79935f92bebf0a1fcb779f4dd044b743396c869653311e88e9d90bdf1de5dffb90fed5dcbcd296e14541ce3f540b64

Download Submit
C:\Users\Admin\Desktop\DisableRename.xlsx

Filesize
11KB

MD5
53e40c8fddba3d77bd4051fa10ccc29f

SHA1
e3024bb8173cac5ec79984a93e38413035e730f1

SHA256
cd7740b8de631e64cd488a1151c87067f70094ef3b4425183cd3b8e7548e3d17

SHA512
da8b7d3e335c20c6708ea5b170b1ec3c9e8cb400c5b39a7b6296b59dd41fdab79c4de15ba5a2b0290d4ef60d7a25299b8caab9f1e6cef95055da95dfb90e5936

Download Submit
C:\Users\Admin\Desktop\DismountUnlock.m4a

Filesize
303KB

MD5
1dc9eededbe00f6af37c5ae0fbcb593d

SHA1
564e0884b86cd730e1c4dcd6527e2a5c07323ba5

SHA256
57d2b921aecb7f7f5741309eccb702877a7277e956a64111c98785f79ee43437

SHA512
53f138699677c040615f318b42a64e10f41fe70fdd7f7bb15cebb799fb4cf7b9d6ffa3b8068b4dc7bf49f7196e91070a08c699e61e2a089df312854a5097cdfe

Download Submit
C:\Users\Admin\Desktop\EditLock.wdp

Filesize
417KB

MD5
8b6f14fac773100f8a6ae3a802c7d160

SHA1
98ddcf21ff59734194a04478b77d29d5a5c423e3

SHA256
06133eceba7b4ab0e7b846a3c016db0e7e80aea0c36bd98035f38a556e8a0bd0

SHA512
340f326371f196a0747fd7613969e8196035af88732b38163ba0c6f3c86bd8c507a120eec10bef9238a168751a22e0ee48e84cd026ebb67209f3c4910cc217fa

Download Submit
C:\Users\Admin\Desktop\FindClear.dwg

Filesize
237KB

MD5
329b5bc82a94685bf44fbb5d5ca06ed7

SHA1
75fa29b1121a734ec3dcb9cb43636f620be1c65f

SHA256
1eb14472950e311c35c919951a56885cd5767b9c50a70fe07d82d811fe5c9da9

SHA512
8af4fbeb8cb9a3661975771efd9da3963e9f946e60c73ded7ace706cd01c981aa0d84830b1caf3b34e4485e8fe01bc1ad1654ed40af497a4202b5f7017cbd02a

Download Submit
C:\Users\Admin\Desktop\FindGrant.php

Filesize
802KB

MD5
9291589fa2338f6a35da38799bc79794

SHA1
29632eaed4e625fd8536a47329648860ee93b04e

SHA256
1f126514d04877005354cd6b150974ec9d8fa3a7261e0e7f1346ad1efb8956e8

SHA512
5d3aec4b1129fcacaa3280deaf8e33c31ec162082b6df8b05775855bed51a0b62d8e4b13096359b062ad8c764c3c3e268a9a3fefa6880fdc7f2d550429995e8a

Download Submit
C:\Users\Admin\Desktop\MountGet.lock

Filesize
253KB

MD5
3cab9d079f8cb7a2b2ffad55b9df8d44

SHA1
c834fcae506d77478945c07f6405e5d7b7395377

SHA256
ed19bf87cff4ff47bf6fdfc6746f148ecafd47001b5ff93358da4544137e46af

SHA512
6dbecf56e7a28f7a68ad5c28422f78c74ad5e7ee6269e08d706e06feff74ac100f32b3f0e58967af7ce5725e189121b87322a8f2366b518720b119c0d90884fe

Download Submit
C:\Users\Admin\Desktop\MountInitialize.reg

Filesize
466KB

MD5
27894deb72fc1c73d757bb2540463b15

SHA1
2e1b24704034fc3710c95bcbf85726646afeb910

SHA256
276cd5cfe02217196ebda48a810c80d895997a2ab38564529f8e76b4d01f5f09

SHA512
38c57de078da2c6ae11b4658cdfb3754fa9eaa587b387a1e4d50c6129accbd3c478f3924f4be10ba4aa399e63b5e41b512402e48496ef353479e57f8f74088e7

Download Submit
C:\Users\Admin\Desktop\MountStep.mpeg3

Filesize
204KB

MD5
485f2c55acacd049f8d43d95fcb35ab3

SHA1
628f3049b7d9da7eb7aec575ac9339fb2fc3136f

SHA256
a0e3c02bc343b7ae90722216d98963a423b58a88a23e76cadf6529a8b66bc820

SHA512
0d9b8ae8f5990e5f056c4fa7761e7f004a19a1d1e8de16ba4ff7fa848f6c2a1baa93a75e5afc1550ff20ab852fda045a8112a71f748dc1cc9c26df4a288924d7

Download Submit
C:\Users\Admin\Desktop\NewReset.cab

Filesize
385KB

MD5
ccfcc01acaa8628ff9299163b272154e

SHA1
ba00cd9c5fed8355a2522e52faf7a211a8e358aa

SHA256
de53a787cd04997f477b0860005a3aaedb90382a6ce451fb3983d423ceab1e64

SHA512
2e56e4aef52db81b81553e2b53b1ac181f73b6a9f69316f3093651a01cb9d2759e048c23cb1971fe506165a65e5ec03c20846bf558422f8ac05bf4b8ae8d2555

Download Submit
C:\Users\Admin\Desktop\NewUnregister.wma

Filesize
516KB

MD5
8f8fcee36844ff43fec4d4e0a347e9ea

SHA1
e13aed523238ed21d2ed6ffe83410b95979a05cd

SHA256
76715824f3ec2ac8fd06ce922dde279b072b856660a567ec09f4704adc49155f

SHA512
9edc22d74ca8ee579e380f6570506f9ebfd16dd166393961bfa7efd2e60a254d08ced1d4e2f395e586873f65c83175fd1a536363b1ddad9cb45af05baa0c3c0e

Download Submit
C:\Users\Admin\Desktop\OpenUse.docx

Filesize
19KB

MD5
7d777574c4344aa560fe6ddf8b87b4e2

SHA1
ba6781d86f1d4c8aa2fbe0336ab90d79f9779dfd

SHA256
481a729f65c06cd267cd5a40e398de1f7029cea7addfdb07e315a71d6fbd0a81

SHA512
c9c1ca6ec79af9a4cd0e29f8a6e344d0a7f0015c5fb81cced5f22efdb22933c7bad4cbb0e479479963fff6a221af5bd3c72c831bc346fa5d309ff0545ec93a8d

Download Submit
C:\Users\Admin\Desktop\OptimizeSwitch.xhtml

Filesize
483KB

MD5
00354dbe9589e612296d6386ea64f666

SHA1
e4e0a61fcad4f78666726f552bbf196f6e002e9d

SHA256
3fc1cc0d0ab22405af1fc7aa2adfcb44b6cf7db8bfce14343628756a4f5bbcd4

SHA512
c4d7abd128069d54c0d46d61866afd48a64b285e37b6fe83b0468ca555f11ac0074e4f8fea1f293e7a8a970b94974ee144d471b5ad73855097465fe34dcd227b

Download Submit
C:\Users\Admin\Desktop\PingUnregister.3gp2

Filesize
532KB

MD5
0fe01797f735f70a905ffd2af17cb6ea

SHA1
19dce7676da2d4e43496918aa0b1cc4c9b98ead8

SHA256
2a1f10da06a45574db3c636f1bb52f7a0d0a52cfd2de7aec513bde0bc5faadb5

SHA512
e4ba00a6fdb2d3dd4ed7be078f49efc601cc8966cf05ac8300a4970ae8744813dd3e357dd54fb45e868d68359e4fd63c266d9cf82a6b3b23c5a6706fb6e52cd1

Download Submit
C:\Users\Admin\Desktop\PopSync.ADTS

Filesize
319KB

MD5
bb72050bc813e1fb2668a8731d97d9b8

SHA1
990d55974f2200df8b54240b98ac4b7d4151aba5

SHA256
f571ee0de7312520fc49a215fbb110379f121fe4bfb3a4fdc6f38a0e83078136

SHA512
027f0d3e09c4e265862c678daa5fe489af31ad78b00d51fa782462060d91cfa36547885ca5cbc16a4039a687c22711d70ed21982005f3f49614d018df2c5f546

Download Submit
C:\Users\Admin\Desktop\ProtectClose.mhtml

Filesize
548KB

MD5
c36b2ea0c9bfd94ef7a0b4741d554d0b

SHA1
2270bce4cc3adfed3ff87716f45cd8a05919cd69

SHA256
71adc3ff843672261839bf9680fd9f31629a69a719facced30293cfcf5bf469a

SHA512
0d9b6f37c91a01970e1d621be0c837c17cbff7d3e7115344926a8d30b5524f855b001b1f5173ae539e124462be023a96774d4336ef1f0d0998470c0a0b10d816

Download Submit
C:\Users\Admin\Desktop\PublishCompare.DVR-MS

Filesize
401KB

MD5
945a3f6e5e2cbca42ee56500aa60df49

SHA1
e89e97345cc35588d3f2d89106a4215214fcf4b6

SHA256
9b79d4ccceddd21593ec2862acd51bf94b87da23fb13b10779e420553068a187

SHA512
115865c46830ed37027ee35790fdb93fee9b034e5971e8a1bc57102fe8854cf6d00b83da1e53bd0b99d8d9699df862dce20ac35f34aa1367d481ae51982a8e18

Download Submit
C:\Users\Admin\Desktop\ReceivePop.xlsx

Filesize
434KB

MD5
cc5bbeee5bce1dc8e5f2e2912a30de3f

SHA1
a34b532c7412b64e1d7b2a8734202852a28c36a1

SHA256
1ec34e78ae389dd8ccc1a0b71c2d130e697b9223db7b7c516ed8d91915bb695f

SHA512
6f80216c08a0d42824d68fbd23c5fe60115e900f63c104fe40e3e53b3a1c038c2ea477f0235b19e50d16cfe3677adfa099656500b7c51fa9b34757c587919649

Download Submit
C:\Users\Admin\Desktop\RedoEdit.kix

Filesize
335KB

MD5
18987b3745c042074d53982035112d74

SHA1
ddf770df88d7132e381a3ad428e6c44695c9c460

SHA256
7a6198f2c18a8b5913a53f3a4216be82ac64166133eb574509215a01e5a7bb91

SHA512
bb8e5b7097647655741a9cc562fae6e0c3f6c21ad22dcc9e455dddbe7afc03905b5f83d713e11b8a91cc68e2b9cdb39e041532d4eb7f76a088dd5bd12c5fcabb

Download Submit
C:\Users\Admin\Desktop\Resource\Resource.exe

Filesize
137KB

MD5
4f38c635b15d7f9087a758baca7c6662

SHA1
0cbfe507872829dc19e63436fb8e9759dfb42271

SHA256
0404b9addf506f9b143521aed1b3a1003c2c8f16828221946a4d06dac6e85bfd

SHA512
dde8048dc7add02f03196438f171c52e6bd04fe099be061c6f2adcb8ed893d4e9279a823d8bd1c6d506d6f1e1857bb1ff5f5a41292e643db8aa6f025f4a8fddb

Download Submit
C:\Users\Admin\Desktop\SendSync.ppt

Filesize
499KB

MD5
339023816234921a8b8647049be762db

SHA1
c8a26b65f92812d4f2f64971db6ccfc92f6eb3b6

SHA256
3eeac72f57f193ce1f11c4ac5f3d671354cfb5d5312dc62b91f8d25cd147dc21

SHA512
16690a99043393d72c532261d427c4af555b5bcf2225963998ba37c536ad45b92e161bba278aa2e9737499dc3023828ebd59ab8a75d50b78cb0c782550ce2876

Download Submit
C:\Users\Admin\Desktop\StartUnregister.wdp

Filesize
450KB

MD5
9f1dd3d63e98558de9319ef6e98c6311

SHA1
36cf96d95be52e8f28f5bf87c9d2c19479b20f6c

SHA256
5998a8d006a1d0dc373421a48ef7287006a3fd3de377482babb64d2ef1e270fe

SHA512
65209f2d29aee76463a96d5d118a1fbe0c407163cbef68d71e198385729b41b48b365efa380fc993425a71df5cad1eb6419e673de03b0afef6134393d6e4f149

Download Submit
C:\Users\Admin\Desktop\SubmitPing.xlsx

Filesize
13KB

MD5
e63af22cf8404d2954374efec2a3d293

SHA1
49031e6812c5d7b8c14141473da3968d66e878c7

SHA256
688fa410027f26b9007acc551753a3910619f05314b34a3c06dc6fd6419e0a51

SHA512
de803e1ef061f773c81c7771884363c04ef8e28d79a82ecdf3647cdc4568227b00ab8102953dd83f7425a4c1afe40372b0f577c91cf3dcc96eb8cbe2cada20cc

Download Submit
C:\Users\Admin\Desktop\SuspendEdit.mhtml

Filesize
270KB

MD5
44a3f46afeb7f455b2f034c4652d04de

SHA1
bd9c4d4243c2a6c293fcf4480edb702cc6f2896a

SHA256
6e0a183dc92fa591e78e0e29745ed6a6738167eedec1e924f106980777fbf2f1

SHA512
bccb45790506016ec3a29000471889cd7076265356cce5d2cc19fb589e3a169d2bdca113aefcb7af3438924ce7cd736c673283e364f112cce177a5d4fea5f3d9

Download Submit
C:\Users\Admin\Desktop\SwitchRestore.txt

Filesize
352KB

MD5
09ea0ea03f62cfbd8082e4e828cb358b

SHA1
c88385e727420ba0faba54dab0eb330035223293

SHA256
fd04ff9c1d05f5db3ad23d4476e66a9d7721a5421211e7981782fbb655d22396

SHA512
55363b045625db303d6311c510b8a5117d2438aca7f048b814aa7d064a799593cc09cd7da0fe996c62e873ac22e0df359a37de302e425afc24c50dd2cfdab7c5

Download Submit
C:\Users\Admin\Desktop\UnprotectFind.mpe

Filesize
286KB

MD5
8a9b71f4738e395a392eeb50281e4109

SHA1
8c1dcccaa794b35523fdbccfc88820576b974d05

SHA256
100df600ed66b1d611dc4d4d81b7cd43da362c9a72f4b9e1b1a46eb83b2b7eac

SHA512
984759bea44308b64c95f072814da0a821f69d9ec591027ed926ce3e4a9c749135bf6c34448bc2adb0b84375a105150f2e292b622e6e68bcadf0bbdc3854799c

Download Submit
C:\Users\Admin\Desktop\UpdateSplit.mhtml

Filesize
221KB

MD5
cb4ccbde4f3f2fb14d812274f24c9c09

SHA1
745455cb5be04f80e9e9ac2b172c12fc585a342a

SHA256
ea4f614ef5e9bc56600321d8feb0aad60a667946c2239be3ff3470d234c6a065

SHA512
63d8f2f356f293f8b119f8140efb5c37bc54068a9e03d56f2b8187b8eed3e55be4db374f7365f6640cef3db967ad684de3d76130f6123256fa8fde30b3cf24e1

Download Submit
C:\Users\Admin\Desktop\WriteUnprotect.ico

Filesize
581KB

MD5
ba61b854928900fe0a9bb1ab73d0d407

SHA1
9b7d05775f1f18e692c3678fa48936c9ee12e681

SHA256
b4ffea7ef552cea96edc81f485f49862409f628f51fdb59b2fe88ebb4274d17d

SHA512
5070cf895c66be45a4be3c6cfcf4ee87847ef60305d0b23244b6ff24278bd2573fb64a1f8d46a525716880c0b9d23b07a3f219c4e76cff179472e9dcdb5aa605

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
889e2f348fa835ccf75ccbf4b6a9c11b

SHA1
4ef8aecc0cef8dcea5c467f3a64e90de4d85571d

SHA256
5ec2d3be91076af618b4c28b3222157492f01695a4a14be79f00b0d638a44305

SHA512
f0a13d829beee93d815305eee6f94119e94d3c305cddc8919eccb5018b0fcdd3b637dc8831583bdfa5704544e068f97a81b05fdfd23353de6c6ee6e991910699

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
80292ae4d30f8b561c2a0e7f4a81afe9

SHA1
61d1f7cb010a143c6a974834aeb70cfd8993ad3e

SHA256
72c903c510ff96f662ae0e563338c5348660d7c3401dca5f23ab26cc34f9980a

SHA512
d7e1c5d017534800e1afe1216b67b28e4e970c3360763aee133572fd0d5fdf03a90ff21bc436954e79a8cf76d0452e75c362792e9ba30f54bfab96069faf638f

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
3cb5a20a132dbaf9524e643c6d6b370d

SHA1
dbfbd9e38fc850d6e8ddfb8ecee3400099122e62

SHA256
0a5ca8b7109b0c81169877662987b3540d28fcc45523a9c7b9a8f0576b3b6380

SHA512
cbafdbd2e68958bf7e9fc022ade60aaa1c78a7c02cab486d6d212128fcbb4f7dfd3e48fbdd31ba2fa590bae43f27fb94379069f5c2166aefb4956aa084728a69

Download Submit
C:\Users\Public\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
eaf9f30b134bf64c6100ad3f317c45f6

SHA1
7ba792f670eea0a66af0af89d9613d8dfc67b2f4

SHA256
49185e4089fcf7f0e542de4a00e1149a5de20b66e6566d1d009e46b4f66a4213

SHA512
fd20f3a86bc6b639349c33cefb1883744963e9a8931198b1728a8a0079442f3d7ce3432b367205c425e9dbcaa763dabd827919c900abc2b2698510f14233c94f

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
bd0304616a3d54be488d1e7e5f8a5bb8

SHA1
507a216c2f9d05b07f510d0c566ecbaa3127338f

SHA256
713b296f920da03f06f80fcbfeb140a80a59805482881c04d0a8be7f2ea677d6

SHA512
e472dabdaece4f063390c4aa82df3efe722fdf538de83d539cf80307003c8a6054c0538ce9450a26fad8f08f97e19da3c62076fc36d20571b555c84719e9f3c5

Download Submit
memory/2032-537-0x0000011B15380000-0x0000011B153A8000-memory.dmp

Filesize
160KB

Download
memory/2716-546-0x0000025AEEFD0000-0x0000025AEEFD1000-memory.dmp

Filesize
4KB

Download
memory/2716-545-0x0000025AEEFD0000-0x0000025AEEFD1000-memory.dmp

Filesize
4KB

Download
memory/2716-550-0x0000025AEEFD0000-0x0000025AEEFD1000-memory.dmp

Filesize
4KB

Download
memory/2716-556-0x0000025AEEFD0000-0x0000025AEEFD1000-memory.dmp

Filesize
4KB

Download
memory/2716-555-0x0000025AEEFD0000-0x0000025AEEFD1000-memory.dmp

Filesize
4KB

Download
memory/2716-554-0x0000025AEEFD0000-0x0000025AEEFD1000-memory.dmp

Filesize
4KB

Download
memory/2716-553-0x0000025AEEFD0000-0x0000025AEEFD1000-memory.dmp

Filesize
4KB

Download
memory/2716-552-0x0000025AEEFD0000-0x0000025AEEFD1000-memory.dmp

Filesize
4KB

Download
memory/2716-551-0x0000025AEEFD0000-0x0000025AEEFD1000-memory.dmp

Filesize
4KB

Download
memory/2716-544-0x0000025AEEFD0000-0x0000025AEEFD1000-memory.dmp

Filesize
4KB

Download