hxxps://github[.]com/NightfallGT/Mercurial-Grabber/releases/download/v1[.]0/Mercurial[.]Grabber[.]v1[.]03[.]rar

Resubmissions

21/03/2025, 04:46

250321-fectvsttex 10

21/03/2025, 04:43

250321-fcmlaattdw 8

01/03/2024, 05:33

240301-f9c34sdh27 7

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2025, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/NightfallGT/Mercurial-Grabber/releases/download/v1.0/Mercurial.Grabber.v1.03.rar

Score

8^/10

agilenet discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
113	3388	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
6140	7z2409-x64.exe
4988	7zG.exe
456	Mercurial.exe

Loads dropped DLL 4 IoCs

pid	Process
3524	Process not Found
3524	Process not Found
4988	7zG.exe
5920	msedge.exe

Obfuscated with Agile.Net obfuscator 11 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/456-828-0x0000000002920000-0x000000000293C000-memory.dmp	agile_net
behavioral1/memory/456-829-0x0000000004E40000-0x0000000004E60000-memory.dmp	agile_net
behavioral1/memory/456-830-0x0000000004FF0000-0x0000000005010000-memory.dmp	agile_net
behavioral1/memory/456-831-0x0000000005020000-0x0000000005030000-memory.dmp	agile_net
behavioral1/memory/456-832-0x0000000005030000-0x0000000005044000-memory.dmp	agile_net
behavioral1/memory/456-833-0x0000000005040000-0x00000000050AE000-memory.dmp	agile_net
behavioral1/memory/456-835-0x0000000005100000-0x0000000005136000-memory.dmp	agile_net
behavioral1/memory/456-837-0x0000000005160000-0x000000000516E000-memory.dmp	agile_net
behavioral1/memory/456-836-0x0000000005140000-0x000000000514E000-memory.dmp	agile_net
behavioral1/memory/456-834-0x00000000050C0000-0x00000000050DE000-memory.dmp	agile_net
behavioral1/memory/456-838-0x00000000059F0000-0x0000000005B3A000-memory.dmp	agile_net

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
221	api.gofile.io
222	api.gofile.io
227	api.gofile.io
228	api.gofile.io
230	api.gofile.io
232	api.gofile.io

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2409-x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5920_178329860\sets.json	msedge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2409-x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5920_178329860\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5920_1552194843\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2409-x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5920_465256632\manifest.json	msedge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2409-x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5920_1334784732\manifest.fingerprint	msedge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2409-x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5920_1334784732\manifest.json	msedge.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2409-x64.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5920_465256632\manifest.fingerprint	msedge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2409-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mercurial.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870058387744415"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920955164-3782810283-1225622749-1000\{F8CD45A9-5B63-4651-9C02-66EA67B95903}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
456	Mercurial.exe
456	Mercurial.exe
456	Mercurial.exe
456	Mercurial.exe
456	Mercurial.exe
456	Mercurial.exe
456	Mercurial.exe
456	Mercurial.exe
456	Mercurial.exe
3260	msedge.exe
3260	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
968	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4988	7zG.exe
Token: 35	4988	7zG.exe
Token: SeSecurityPrivilege	4988	7zG.exe
Token: SeSecurityPrivilege	4988	7zG.exe
Token: SeDebugPrivilege	456	Mercurial.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
4988	7zG.exe
456	Mercurial.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe

Suspicious use of SetWindowsHookEx 44 IoCs

pid	Process
5172	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
644	OpenWith.exe
6140	7z2409-x64.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe
968	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5920 wrote to memory of 5080	5920	msedge.exe	87
PID 5920 wrote to memory of 5080	5920	msedge.exe	87
PID 5920 wrote to memory of 3388	5920	msedge.exe	88
PID 5920 wrote to memory of 3388	5920	msedge.exe	88
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 5284	5920	msedge.exe	89
PID 5920 wrote to memory of 4656	5920	msedge.exe	90
PID 5920 wrote to memory of 4656	5920	msedge.exe	90
PID 5920 wrote to memory of 4656	5920	msedge.exe	90
PID 5920 wrote to memory of 4656	5920	msedge.exe	90
PID 5920 wrote to memory of 4656	5920	msedge.exe	90
PID 5920 wrote to memory of 4656	5920	msedge.exe	90
PID 5920 wrote to memory of 4656	5920	msedge.exe	90
PID 5920 wrote to memory of 4656	5920	msedge.exe	90
PID 5920 wrote to memory of 4656	5920	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/NightfallGT/Mercurial-Grabber/releases/download/v1.0/Mercurial.Grabber.v1.03.rar
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffa7a01f208,0x7ffa7a01f214,0x7ffa7a01f220
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1996,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2224,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2496,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5008,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5000,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4788,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5552,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6208,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4776,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3584,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4940,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6892,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5952,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6720,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3676,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6448,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6800,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=5616,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5660,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:2428
- C:\Users\Admin\Downloads\7z2409-x64.exe
  "C:\Users\Admin\Downloads\7z2409-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5836,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7396,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1228,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=5284,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6352,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5084,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=6780,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=1060,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=7140,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5676,i,10650654053241129772,9729287554924740063,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4856

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03\" -ad -an -ai#7zMap17072:108:7zEvent32701
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4988

C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03\Mercurial.exe
"C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03\Mercurial.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
88518dec90d627d9d455d8159cf660c5

SHA1
e13c305d35385e5fb7f6d95bb457b944a1d5a2ca

SHA256
f39996ab8eabdffe4f9a22abb1a97665816ec77b64440e0a20a80a41f0810ced

SHA512
7c9d7bd455064d09307d42935c57de687764cf77d3c9ba417c448f4f2c4b87bcd6fea66354dfe80842a2fa3f96c81cc25e8bf77307b4ace1bbe1346cbe68435f

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
c4aabd70dc28c9516809b775a30fdd3f

SHA1
43804fa264bf00ece1ee23468c309bc1be7c66de

SHA256
882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863

SHA512
5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5920_1552194843\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5920_178329860\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5920_178329860\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5920_2069291373\manifest.json

Filesize
118B

MD5
395a738237cb5606743da99d5459bd59

SHA1
53a2e376dbba8020189b4d629d1ce452c43abc42

SHA256
6a15b2c0969575a4ae419e8b0eedc7c5515c8ae3dd73771e431e484689684aac

SHA512
0ac1112218d23328eb3cccf777c9bf7b0c31b71387fc620d0f91fec73994661021524ae66d8b81f26d1d7f4df8ac60c12f7852c72c65030d0c106a0ba773a8bb

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5920_465256632\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5920_804532560\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
c37f9d2c357647fca20f2eaa89c18edd

SHA1
cfd1035ed2d057c317b48546f467209cbbe15f2e

SHA256
2ea3a0b7e6145fd110653b1a77cb827ad7e4a145c29378344bd3d28f595b2072

SHA512
3563f4aca9e47f35de8cb38e42a3c0448bb3ec4c9183fa392abc28fee4ca08bf16da028ffbf31cf0c0f8301ed810238961e745590e5c71621bc5a2a889dd12f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079

Filesize
59KB

MD5
5c5df80037a8c758554af7e134b05fa8

SHA1
7eb5880ebf839f96fed6221a06910744e5465110

SHA256
f3696923b2d3308375c395f4eab029c6cbc20356c214884ef3a31c6693be7e00

SHA512
6f745c074a2e08fd352abfbdaf8ab7d596607abafa2c096982e14a60b32902bbd53b8241df7e2cfa7bcddc2cc98753df568017d111093ac57aba0716f675fb65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
355KB

MD5
b7b6fb8bb2e6a11872cd4b1b378d681b

SHA1
206787bd66c70c9d1aea113cc6dbcb84cc631d0e

SHA256
ab8b83283cfb42253cf027f9cf10e533721d7291fdc5ee1bd572b698a8b3c729

SHA512
077d32f9f1b9886a2f8820f0c496dcc6984a21e641137728f4261446a546d250ab7918cf2a44339bc35237ec175ea83eb2f65427457b2d20104a09d0c5cb828b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6

Filesize
72KB

MD5
17e21dc3d8c9eac495dc8449593897e7

SHA1
a8dac04430026d6d3a9b380f26ad78189a77dd0b

SHA256
d6118e4f2ccf8687e7acae8f0e663c432999c4e99975bedc295b06b494918e9b

SHA512
52a57e96a7aed282bee138584211a89f8dd58e5b77f3f11ebc8d098d537c6eda542f99fd0bfd887e703ec303d08f390934815c518d7da95192f1cacdfcb4394e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8

Filesize
67KB

MD5
94845794fc9299d9b5a3cc7dac811a07

SHA1
e2d95d099b263bcbfd067c74e429333265550723

SHA256
792edca08361b5854bdf5d25d93bc4470ecaf2e21bae110bd00f8903c2d261d1

SHA512
05847c1ecd1f21f9c6cdfd8c6c228ab740e4721e378fc1c74781564574cb40afee4f38495535ff9030b8bf01dae7057a4f9fd2ef74b1e2aebc6a4db6eaccb88f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba

Filesize
71KB

MD5
ddb95c908fd8272aa35380c618280159

SHA1
d9fa506593fb8e10276e3a7ef4aafdf98441a9bb

SHA256
e7bc4b78537f1f146e19e570149548c544e998af6403f42fe6a44c6630d650fc

SHA512
a872b65ffef0a9dff9cadc1fea4c83c0fe6a2c9349f7b64141902d29c59f0dea81409ef5dab99f5fd21f747c7f5294df14e2f79f1079053501f33bd3f6d73644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3

Filesize
25KB

MD5
84a745b6be5d6889b2372c83daa17655

SHA1
5bb176962a37ca7eaf139c3a0c0ef848a8d45470

SHA256
19481514184cf22d0520c2ad55e4c12ebbc157af0ba8963b33bd149f5a60b812

SHA512
4bf2b655d4351fa250360f91b66ae51c09212cf70e8b89dafde243460316b9f76f1ed1412904f6d4ab56ec19621cdf7aed879bd09efd41f9f5467ffaa15c78f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6

Filesize
29KB

MD5
1f1e610d1f3b543dbe5a5f6352fb04a7

SHA1
5677647d519cb9c6fa7336c9fadeee53df3ee487

SHA256
ebeb8e8cd8408138d571caae5841069d0463033c17ef989b11af24604420a12a

SHA512
2d816c0923b110bf6948b2978d4cab9eefa781598fe62c66b97654dfbd83509e27801f182cf84214d5c51c6864f3aa0d4b86ad34ade53ee7f908a6949e8f4b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9

Filesize
22KB

MD5
086390d55a0f392c606508a8a706d4bb

SHA1
b7efe13ac860490595a7b820ae3f60ee94f968b7

SHA256
7218eab72ddfb732c0e860e8c9e4aab7687d23341ad549a12ab025df36d6f561

SHA512
c11b04b1f86c3b25ea119755602a1e5a93c44966a16c9bec08ef98da789f71603eafc0617f9f7e9d544af72250e7bf12af7d16d7a6af074d64edda4901153c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca

Filesize
25KB

MD5
0615271c2015e6ab9909fa098bbe781e

SHA1
a9094205512f8a494514298e3de741e1b2141927

SHA256
5609b2b7377cabdb1a1802b97aa199d97c56b42756fb1e6a0b110526bc53468c

SHA512
48991cd28a5e8cedea2d246d1f0b777f040053f55a7bc9fdf454815b313f1185dcc5577e51847c8f79a1de6e5864720eeb1c03e14d6b5e156df48b62c32f54d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
a7dd4496d7bbd13bf6c96de2f1d64385

SHA1
ebef5b4bda8788a686c838573f0d657aecda4ad3

SHA256
32b3b2cb2b38b49453ac1fa7abeef6101fb20e564d2e0fd6b29b27be5c92e02d

SHA512
a3a35a529a0008711cb9762fede0803e8000831ba4d94ff5ce6bb1128b0ed472f56c0902475b058a3dcd688ebf0e1c80030cfbbce2a94a10f9260c41cf043fd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
517a1b137d32d66ce2171c2c21180a32

SHA1
f7768392b3aa3a8056a1011dd7c8bcf2bd05e301

SHA256
c0b57ed2134eea6603a5b34b63a22fed759f2f6c811769b67662f1c75cd3eae4

SHA512
68053e8887e61d51dfb01f2ecfe6fd1ef9b670024e3c18a8a33af5e9ecf5e6f534ba11b7a310119d0af76ca36b4a68e1ce2574b64e4fa78896bd8f7cd785b56d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582cd7.TMP

Filesize
3KB

MD5
0031ddbf28b4c5b935b5a6ce986f61fd

SHA1
20716fcc733a2628094180a3b06f975a87034f63

SHA256
1265ad3bf4cd0e9d13164cbbac9848ef5ef22c6afa44b6ddd168a0cc3608b419

SHA512
d12f779e0b274fb9dcc8101de77c5e84ae47d9ea71be6f017905b2577c52ff56d9f7be3244893681b378e2c9ce799cbaf5c7531f1485410ea4880b5c5b384014

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
15e92cf3dcc168e248913bc0c7a24b27

SHA1
4e4e03f03e58b092e38e950a177225d64532ccab

SHA256
cec2c1c8a343a79a896faeb332a21d741c2a91dc4adc04920b20dd2eadcc1da5

SHA512
004e61d077c6169a50cedc0fc69706c5a6fd4a5c568437a4775c8a56c08444001975a351a4fc19f07396c7625d87b73a30eb84878d43aa9e8484a76eb88d58f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0e8108a5ab68119e6ef187275a28f7d1

SHA1
0e5a0fd5dc403be5f2c59268b49afd1dbc84e082

SHA256
028d855c61e457bd07eb1b426b36d477c5d669d83825da1eac9302351613388b

SHA512
103f4e79d4e4202dbffa31957cba23e900a8262a39c75226ea140144701ddc094a05d2737096339672aba2e472d7410682b33ad1853c16e80f1292ea18f3af6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
de241c5009fd04d3257a938775425061

SHA1
9c96121cc7175abba2bbbbe837c90c53bfc5cf07

SHA256
6965d3a0fb623dc2a960278092f6a31a7b3932645a0fe60c17a7ee64f0ec4190

SHA512
5671a07c1bb234b976a3ea9049fe16da3d27cab92aa339f9035c0a3ef98534c63ee91459635db9475c716283a2cb4175d3c06eb56fb17cd1fa712749cc6b41d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
a781e9f9fa11281d194492582081ee21

SHA1
b3c7301d94de503d90cde8e50eae2d32b1ab70a9

SHA256
5bfd6a6db651ce28cec3292b6d2ac254417448efe04f3a7c8c027fa9d96be5ea

SHA512
41570c0b1910cf556bcce151ffee8bbb7c7668c453ff66bdb4f7726d7bf61c18f6bb99884b864801865fdeba4946686dcef6f3e20df48fa908b8c475e38c8bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
5aa5619b966b4536ecadc17a7f7e3e60

SHA1
0e1167eac085f1278c5296e8fde6c0d86d239892

SHA256
d28c20e88fc84646fbd9b7aad265c17ff27ab1d725e5df33b4530551ae9debc2

SHA512
8a8f216b6e61b4badc55ccb47801b81c8fc538d53a7ec0e85835e3ba524b93c0e9d156e266b122fd0dc91780390c5e9b7475b260905f88cbd8d636e5c8ef6f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
ee70c48fd6e9fb9df62383e7c64fb743

SHA1
3ff00684e3cb68ab2fa752da755d05dfb4ca9c9f

SHA256
a9923936ac33e12907c34489f09a3aee76b844a3e79a381e4a696e8cf1f3ef1f

SHA512
53c46fcc7a1abbe2b015950f91a6f14323c1667897614aefe1d1699e2970471828447343080f5773ad59a61d4f487d7784f222eeb90f4e6ea860de5f508fa36a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
7c3b9525247f008094be53c651a5c471

SHA1
e81b408ce7684a5883809f1e37110172d1ec77bb

SHA256
8ef399344f678e417681ef6128ad7d7d134ad55cb5d81a8a35db62914f0e4ed1

SHA512
485909843f28652257234c22d7e9097237da441ffc4a0a5eaf088559d1a9f4053247cb4529f25a850e10def0016160c8dc0c728eba9ed06283d9794858b9f402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
00764b86fff94517e671a2b93b90b2c8

SHA1
4437d333cfb9568ac1c63ada42be1682ce904702

SHA256
e268e7721f38a5653ab0a4bf7a54414e6d1283b987da69a7f370cc103068eaa3

SHA512
c0867cccdfe4628ab1a83d3a06eb097e47b0a4f585843f282cc81ed5c3f7df14519c4ac7b25ee35efe91071e87016c0b9a809c5971da03d4756a55f1399c2e33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
55875125254d3dc3a72f012cc5bcb044

SHA1
49971ed5a5982b9e33676acf2ae1baafb19c2d0e

SHA256
c7dd602b36b0cf75f5789126660a3789771afb90ea5eb7304926ed0ce5627883

SHA512
26a445284ddbbf98f0ee911df65aabeb104ed817e7ba7b1119e79e5a9bb3fd5e03a2bcd302bd15e957caedbd785fda19e972a8ec3ee1ffd51df99c3d7bd47e20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4b544b14-1843-4673-a1cd-26e23142833b\index-dir\the-real-index

Filesize
2KB

MD5
80456a45a8072007489ab77b4dc1ff1a

SHA1
07c71c01fda77ce7e40264d80f40f9bde0a2efcb

SHA256
748d8ba871eb4fb871a5f35b1e72e5a612a52c78fa56212bdcf646147fe61e5f

SHA512
b26084271ab46a19a43738aaba054466eb15856842eaa52298ff09fe9f2b2eaacb6b540b397de42fbe9be030111c0c6ea9d9be3ea8426e77d657e549ebbc3a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4b544b14-1843-4673-a1cd-26e23142833b\index-dir\the-real-index

Filesize
1KB

MD5
62451f3b7a767c8ba71c26752e51f230

SHA1
0b169279c89262a532e5cfb0e4acb24abaafef8a

SHA256
399d4aad41b1776bea677655724f51f7ddb66865b34f6ab6b45ab678fb75aa17

SHA512
5f98ada5720dd825895e1b676640ca98b6512301f4d9f202fc5a3e4346ef9bb7eaf861f128edfdb13e42849c64b663dbac40fe2e7a47aaccb797cbc1edb6949d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4b544b14-1843-4673-a1cd-26e23142833b\index-dir\the-real-index~RFe58fcca.TMP

Filesize
1KB

MD5
7159b100b0ba26b563dbf955319373e2

SHA1
de791736c505c22be0d46d1b848b9ad779b93545

SHA256
0d80a7620782ebc499d07c46ddecbef0207b351a37439b5c7369a750de1b25d8

SHA512
cd3a43f3d3078f78d2c54510ff3334c1f22d07ae27fe8e66995eb7453d9dc665c3d0841734f6547d8fc5abd47938f9d3dcbaedd2589a9f843946eafea50b7249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5a386b68-8558-4f98-9bcc-00977f37bcfd\index-dir\the-real-index

Filesize
72B

MD5
57e0fd55ca999317cbba5924ed4208f0

SHA1
9d44fa580ff8cd35ebcfdfb0fd8750f0d4f6b381

SHA256
2dafd28b05886c34bab210763c88be5fe6e842a5871dce70868a49e927ad1b45

SHA512
15d9c6670284fe75458d55b52bedb142af69a4206a3931aa9ebef0f77050ca60bbe869d9b3476153a16f1f130f4d9ff14c8be5079db178c9eb6d8ccb58601f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5a386b68-8558-4f98-9bcc-00977f37bcfd\index-dir\the-real-index

Filesize
72B

MD5
584734f505e4b1afb9aa77e98803a892

SHA1
0755425854759397ffb5f9282bd923cbe4263937

SHA256
ed1df1fc1cd534542a4a13c6a5a4e2511cf37c39731095aa653851aab8349e81

SHA512
c81ed6f9617bf3f5f2387dc829658350b72e19c5d7fcbf333ba52be24cfef13d16158b0e238d022452b5612388c95fe362ba45cff0ec4dfe1c7473061b32bf2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
5e75cdf45ab35bfaab6aee8b278b4955

SHA1
c5c4522e10c58b31611a318c0daec00e8df52489

SHA256
bdea172a7a4a7b97fc75f611dcc1adf5d278e8ce72e961d8d7edd44ad3e19794

SHA512
6d10ed8aa8748311b4283e3b7919b365129a5ec485072b7f3dd333210117b20224af762c02d36ca99745345cdd8f55bdb89585c6a584e359e82799a7dda7e9c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9926d18786fc4ee17e7b2596ebc7c2be

SHA1
081035ad1fa74385c42ed52f3bf952d82c1a04df

SHA256
d6fbba0b39b074315452090ef7827405a5192b443dbc2a50950f5307400b67e6

SHA512
f046c6e56153943cb8fd8c9549e4e45e3584488de1c5f85809e3339c1c038dc803ca5b1e8bb589df6ba30bb7cbe380102399e6ed918669b04fb49a0b9c129908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597267.TMP

Filesize
48B

MD5
b50a3d7d0b432d078f6c92e04843eb73

SHA1
48dead197608701e63234d3a458c639a5ed8e109

SHA256
646338972c3ceeac864b9430e849e38dfc9c5708cf66f22fb15ac7afcc95389e

SHA512
9475df5899ec206b769695c9986718620e1665413f8023a8d8fb7457a8243190defed005a2de6b09816635ae6f6f7d6ef797395e44b54139588b4ef78985e84c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
3943df4e116ce156ca4e94da6f68c392

SHA1
b7fb899d6440b565bf7e5f1991e387f26561b730

SHA256
275bd08bcf2b623e11570188069c1525e643c8592845537a6eeb1a1120c3e4fa

SHA512
48952a7cc0f5badd3754c5e2c3104da903fa31b940e59e6c9f536f85a4faff6657c52a2b09a946e407160eb35e9e8a15fb2b930447ed1b2a1d9ae1d34c902fc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
9eb51990f716880a18847277e7b016a9

SHA1
f14ba3c7bf0ed686b2a9ed7f337b4c8a756dbf59

SHA256
2cb31d6f69d06f33e633e9b59f5ff6932cc34f08e42a6ed526180e3ffb505f31

SHA512
55a95f96d4899d5cbcc6734bb6ee594d69bcd188dbf606e2b121e437052c96be12e0cccd1cf5573efc50024bdefc88bb3cb59848c2e964ba02c21015434bf39f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
9270cc92945acc17fdbd268afa7ff3cd

SHA1
bf267dd30e9c4079e5da4a996572b83a9ae07353

SHA256
cdba8fc7fb5e9c2c25591207d130b5e135caa12b84e1a42fdcdd9f427c0800b2

SHA512
86f655fb200ed02c31dbd880cbf42fb2d4476df568f7d3f02c244bb2b1e170edbf1f6184c13cdd4c7cc941a4c91bc9155bc0449679f407afdba96e1b886e3fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
6dac59a1d0b19fbe7c0b911565cdee3a

SHA1
987dd60b4b534366999c886398bea91e1b94b2be

SHA256
06e2fbb03ea02babd011bd6bcd989c69b88e39833135d01a983230f9d5eb71ca

SHA512
e7a56537456a2f2c9b5939f7d72e8048156013d978d4a300e70a8c1f797362fd3f384c2f37b77aa7430f654e84b6845eab965cdf1ebf246b48a0aa8689812092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
6605cc968eccc585a4eaf9dd6109513a

SHA1
cb77f19b1f2f785c58b62487e04c9d31421c7c54

SHA256
f95f144d2c7579b2cc86ae6860134d3aa13acc698b8e403a31e5b6ff908ef58d

SHA512
cc05b79a81976c9b373d7055fb9d3fbd19a5d2ab2398a4550ee940b98c9eaf21a050ff1d2aae2382fe8c83570d5912c8f9e4c9491762fff7df9ec4b152b5ddef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
a6bf70ec0a43b8fde3dbe962a00676a1

SHA1
ee3e52028197370863dcf769e76bdca0b4c1efeb

SHA256
a48f186fc124e825683126c4ec63ffa9326f6fd170db82d40e7da4e9a56ac3bd

SHA512
4340338a2ad21af19aa0505cb02c3774f5b9852acad8f3d5d93041010384b59e55afadd988b4b820435af81ac3f90a3828eeddb87ea47f98ec52657e0240a121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
1cba7b21011f382dbb86f963c74b11ef

SHA1
6330f99976f3b2c2b6c14c66c603135cb6eaedca

SHA256
f269a506263a141f53745630a946f620342a1f8c0b8e14c87ec2bd73a68411c5

SHA512
39bc89a2e7ecb48f75370a2e42ba42f839f9f20e97d0f90bbb4c5d1072ffaaa4c88bd8854b4113a46b0d45149d414e98af9da4a0726d5eba84850835bd152920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
5488bd5f06975adbdfb2370bb6e1439c

SHA1
eeabd2a14d1aa4b7cd9edf308be02b4670077669

SHA256
a989cdab7d2680616733755914725017c8134cafcf85633b090d488064c92c64

SHA512
f79a7542438c7e5912d4b70371fd88b73ca073f9a385674fa5eef387705863a1516b1b166d95417fc62490c683ddd73034ee4aa1bee8a75f15d3ea3a86b10a9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
36058ed8cf94954436aa6aed069afffc

SHA1
0bc4c92f4f8c9bd4764c1e2586c7a8c1f63b24d2

SHA256
186496e91de6158d01cb256b8c6cdb0d5ae564f000302e2d50e72e3b852a6f97

SHA512
54b613523e8ad87cb8dee0573df4bc158a3fb23d51063868556451aac693abed93e9c5d1c6e785fbae7b0a83191982d6fe9c054e9540915087dc8992a92525dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
94359892b36c905fe11f6c4a4a5d430c

SHA1
ce3c62d8d1f946551d13574586a75ae092642e4f

SHA256
70abe9efe952b2c9d50786fa6ccee8718edc7734cbc914956bc0bbff42bbb427

SHA512
a4d649493320d11029857793d553114926bd444d686d2e3c75c9ba353daf06c727bf0b72c125a1cc06509da78d78b13378084264647af40579135973cdfbcbf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
99bb4739d3ba981f82569ca07dbea095

SHA1
dbdf3ced76beca7f242fe772dd3f0a19e4d1a41a

SHA256
f78b9138ef28da083efa336819e85a3f94f4ab2c8643af3c070ef7c55a880ff6

SHA512
4e9f6025cd95a7435515f5aa5f484dbbd23fe05bb30b6e5c9efb9b3db32d8b3ba132e9459502d0c1562a0811c64ba17b164702d10ca944771818db94a1489f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
75318fb88058420923cd893a666646ef

SHA1
52f21a2d8d2985301f621077af35bcd280fef768

SHA256
45e64b9f9b35b19ada0ed7adf715a50822f04deb044ac1faa92371d034636b62

SHA512
3f5b7ed2f7da6be205c93f5a078142bdd3d46e9beda98acf570f8180956d007c12ac700f8244412a34940f4baf747de80d1f792e90222859b8816268202a207f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
55a23c46b94c87c72aa9eb5ad792aea3

SHA1
8ecb9371fa3f1fa7876dd401dfba91c4b661c6aa

SHA256
42c33ff88e4e0794b67e098b1203138c6aff074f708abe5fe181344a22704150

SHA512
48cf5adf8bcd26b778388cc8458c46615c9db56e08a600beae8984cbda2ad300228d23cc38dc3ac4db2bbd5ebd67a330aab533df6d5e075cfc0e3b83a4e8255b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe590c89.TMP

Filesize
392B

MD5
4d184d8fd99d5154ad84411c0effd4c0

SHA1
a65c10719178014294c3a11cec41fd2cacad5098

SHA256
59f545f5b13a4c661860d4544a30104ff1e0895e1869b894413d3d13b42becd3

SHA512
7302585eea94d074eaaee1578573c468b9867e7445fb24aeb6ab27aed2f647108a1e6cf38c0b15f875373a0e6cbd3828030085db86911382dae3f38c4fed37b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.20.1\typosquatting_list.pb

Filesize
638KB

MD5
da8609745ded15c07f9b3b42a794f1bf

SHA1
6f51794da7f06ce1e79ea3e42a22f67d068525bc

SHA256
7dd01720dc53471b5cfb185a9b1e39be94a095c53e5dc8a295818e425ca265c6

SHA512
a04bd2845bd6df19cd59eb6d62be863ceffca5841f8c878c289364418a89e4b0f1efa4224f3fb0d10a010ce73a23a60e81e6d7437ec27da3541f085e22ac938b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
369ebdad3ebb536f13a1ea2844a32f98

SHA1
8def1a7a9b636c108b7ea69565df54e6c0e15dbd

SHA256
98aa1f05227aede3695bbf669e6b34b0212e469cdaa99c263dcccd83d83e75a7

SHA512
78b42c46cd8cbad3594d32c79da5bb05043289b2e09b5490191fa5ea1e212aef7f7ae818552065940dab5efff487d22200e7f16391fd8cacf8e2a10424cded5b

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.exe.crdownload

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit
C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03.rar

Filesize
2.9MB

MD5
635903bad1ada856d701f34d3070ccd9

SHA1
3ff98d91b9a3a47bf9f64bdf161efb9c5ac99fb0

SHA256
3759744039346620e9613f40f90e8f318e5f54ad49c070e2bd23b667f7e65bf6

SHA512
fee2c64124c47bcb1251b7b87969a1ff493e24bc196633e3a301565b126f5ed2e2967d4d1426ff5d9be9466c852bacf405229308acf946368e00ca887a4ef015

Download Submit
C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03\Mercurial.exe

Filesize
3.2MB

MD5
a9477b3e21018b96fc5d2264d4016e65

SHA1
493fa8da8bf89ea773aeb282215f78219a5401b7

SHA256
890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645

SHA512
66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c

Download Submit
memory/456-829-0x0000000004E40000-0x0000000004E60000-memory.dmp

Filesize
128KB

Download
memory/456-825-0x0000000005440000-0x00000000059E4000-memory.dmp

Filesize
5.6MB

Download
memory/456-831-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/456-833-0x0000000005040000-0x00000000050AE000-memory.dmp

Filesize
440KB

Download
memory/456-832-0x0000000005030000-0x0000000005044000-memory.dmp

Filesize
80KB

Download
memory/456-841-0x0000000008780000-0x0000000008788000-memory.dmp

Filesize
32KB

Download
memory/456-840-0x00000000053E0000-0x0000000005410000-memory.dmp

Filesize
192KB

Download
memory/456-839-0x0000000005B40000-0x0000000005C56000-memory.dmp

Filesize
1.1MB

Download
memory/456-838-0x00000000059F0000-0x0000000005B3A000-memory.dmp

Filesize
1.3MB

Download
memory/456-830-0x0000000004FF0000-0x0000000005010000-memory.dmp

Filesize
128KB

Download
memory/456-834-0x00000000050C0000-0x00000000050DE000-memory.dmp

Filesize
120KB

Download
memory/456-836-0x0000000005140000-0x000000000514E000-memory.dmp

Filesize
56KB

Download
memory/456-828-0x0000000002920000-0x000000000293C000-memory.dmp

Filesize
112KB

Download
memory/456-827-0x0000000002910000-0x000000000291A000-memory.dmp

Filesize
40KB

Download
memory/456-837-0x0000000005160000-0x000000000516E000-memory.dmp

Filesize
56KB

Download
memory/456-826-0x0000000004D90000-0x0000000004E22000-memory.dmp

Filesize
584KB

Download
memory/456-824-0x0000000000160000-0x000000000049A000-memory.dmp

Filesize
3.2MB

Download
memory/456-835-0x0000000005100000-0x0000000005136000-memory.dmp

Filesize
216KB

Download