discordrat | hxxps://mega[.]nz/file/5i1UAAKT#sM8tGhXAT4lANkXVmMoFk44dq8htbAYhDQ-PkHiFy0o

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2025, 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/5i1UAAKT#sM8tGhXAT4lANkXVmMoFk44dq8htbAYhDQ-PkHiFy0o

Score

10^/10

discordrat discovery execution persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTEyMDk1MzExMjkyMDg1NDU1OQ.GgKES3.CH-gWnZ5ZY4XpXnAiFted7cC94WbgTcPKDWeI0
server_id
1121520794992922735

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6600	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
180	1064	PROJECT Z.exe
188	1064	PROJECT Z.exe
225	1064	PROJECT Z.exe

Executes dropped EXE 12 IoCs

pid	Process
1064	PROJECT Z.exe
5184	PROJECT Z.exe
4796	PROJECT Z.exe
2012	PROJECT Z.exe
2880	PROJECT Z.exe
5608	PROJECT Z.exe
5404	PROJECT Z.exe
2884	PROJECT Z.exe
6100	PROJECT Z.exe
3796	PROJECT Z.exe
1508	PROJECT Z.exe
4064	PROJECT Z.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 28 IoCs

Web Service

T1102

flow	ioc
182	discord.com
225	raw.githubusercontent.com
133	discord.com
135	discord.com
149	discord.com
153	discord.com
164	discord.com
170	discord.com
187	discord.com
188	raw.githubusercontent.com
185	discord.com
189	discord.com
190	discord.com
226	discord.com
228	discord.com
115	discord.com
116	discord.com
125	discord.com
155	discord.com
192	discord.com
194	discord.com
227	discord.com
121	discord.com
130	discord.com
163	discord.com
179	raw.githubusercontent.com
180	raw.githubusercontent.com
181	discord.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_17177381\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_17177381\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_1534520463\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_1534520463\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_1534520463\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_1534520463\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_17177381\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_17177381\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_17177381\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_1534520463\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_1534520463\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2692_1534520463\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133894828644781915"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2645532622-3298555945-705856666-1000\{10E04E2D-A3EC-4590-86F9-12F0C13E0E83}	msedge.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
6600	powershell.exe
6600	powershell.exe
6600	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: 33	5520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5520	AUDIODG.EXE
Token: SeDebugPrivilege	1064	PROJECT Z.exe
Token: SeDebugPrivilege	5184	PROJECT Z.exe
Token: SeDebugPrivilege	4796	PROJECT Z.exe
Token: SeDebugPrivilege	2012	PROJECT Z.exe
Token: SeDebugPrivilege	2880	PROJECT Z.exe
Token: SeDebugPrivilege	5608	PROJECT Z.exe
Token: SeDebugPrivilege	5404	PROJECT Z.exe
Token: SeDebugPrivilege	2884	PROJECT Z.exe
Token: SeDebugPrivilege	6100	PROJECT Z.exe
Token: SeDebugPrivilege	3796	PROJECT Z.exe
Token: SeDebugPrivilege	1508	PROJECT Z.exe
Token: SeDebugPrivilege	4064	PROJECT Z.exe
Token: SeDebugPrivilege	6600	powershell.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3800	2692	msedge.exe	88
PID 2692 wrote to memory of 3800	2692	msedge.exe	88
PID 2692 wrote to memory of 4168	2692	msedge.exe	89
PID 2692 wrote to memory of 4168	2692	msedge.exe	89
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5332	2692	msedge.exe	90
PID 2692 wrote to memory of 5668	2692	msedge.exe	91
PID 2692 wrote to memory of 5668	2692	msedge.exe	91
PID 2692 wrote to memory of 5668	2692	msedge.exe	91
PID 2692 wrote to memory of 5668	2692	msedge.exe	91
PID 2692 wrote to memory of 5668	2692	msedge.exe	91
PID 2692 wrote to memory of 5668	2692	msedge.exe	91
PID 2692 wrote to memory of 5668	2692	msedge.exe	91
PID 2692 wrote to memory of 5668	2692	msedge.exe	91
PID 2692 wrote to memory of 5668	2692	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/5i1UAAKT#sM8tGhXAT4lANkXVmMoFk44dq8htbAYhDQ-PkHiFy0o
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x340,0x7ff893c0f208,0x7ff893c0f214,0x7ff893c0f220
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1912,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2308,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2352,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3496,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3500,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5028,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5008,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5548,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5548,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6316,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6312,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6708,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6704,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7280,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:5536
- C:\Users\Admin\Downloads\PROJECT Z.exe
  "C:\Users\Admin\Downloads\PROJECT Z.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6600
- C:\Users\Admin\Downloads\PROJECT Z.exe
  "C:\Users\Admin\Downloads\PROJECT Z.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5184
- C:\Users\Admin\Downloads\PROJECT Z.exe
  "C:\Users\Admin\Downloads\PROJECT Z.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Users\Admin\Downloads\PROJECT Z.exe
  "C:\Users\Admin\Downloads\PROJECT Z.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Users\Admin\Downloads\PROJECT Z.exe
  "C:\Users\Admin\Downloads\PROJECT Z.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7572,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7596,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:8
  2⤵
  PID:4412
- C:\Users\Admin\Downloads\PROJECT Z.exe
  "C:\Users\Admin\Downloads\PROJECT Z.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5608
- C:\Users\Admin\Downloads\PROJECT Z.exe
  "C:\Users\Admin\Downloads\PROJECT Z.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Users\Admin\Downloads\PROJECT Z.exe
  "C:\Users\Admin\Downloads\PROJECT Z.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Users\Admin\Downloads\PROJECT Z.exe
  "C:\Users\Admin\Downloads\PROJECT Z.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6100
- C:\Users\Admin\Downloads\PROJECT Z.exe
  "C:\Users\Admin\Downloads\PROJECT Z.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6760,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:6428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5244,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5340,i,4642941802826647759,2332234924567361071,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:8
  2⤵
  PID:6496

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2212

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x2cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7008

C:\Users\Admin\Downloads\PROJECT Z.exe
"C:\Users\Admin\Downloads\PROJECT Z.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Users\Admin\Downloads\PROJECT Z.exe
"C:\Users\Admin\Downloads\PROJECT Z.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2692_1534520463\manifest.json

Filesize
135B

MD5
4055ba4ebd5546fb6306d6a3151a236a

SHA1
609a989f14f8ee9ed9bffbd6ddba3214fd0d0109

SHA256
cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5

SHA512
58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2692_17177381\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2692_17177381\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cf3da7267cb6a35a74a4dceb3097a615

SHA1
a1b06c52d03147a6adbad9d32436b3b497115584

SHA256
18a6d652dd17544c9feb2e01621ed64b958b1a26bcee81e29ab29d5a409dc222

SHA512
6238eb406a42dfdf3faf7b62c92c6c0993974617f2ff403f6cd0a23dd2d53893bd96e92e78bbe6ba35ff191cdbcb8ecd69318c76547df76341ce9f2d43aae71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
cdd6f1c978930b619767da40e56bf5f5

SHA1
7eeeaa10b856fcc5c7c0eea8b21fe4d2a26b600b

SHA256
c8929f39d57cae470a2105567966de4276fd20ce1401be29ef32a3039a151860

SHA512
abc408ff60f44d694fc246959894864eadb639ce735b94aebd9b8b89e8037757afa3d67a6fd8cc57ac50fd7d0c8bf1733a4837faee34792287d14586c14b012b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e8d9.TMP

Filesize
3KB

MD5
25028f24788fbf846c0ecfd0677808ea

SHA1
493142c9e0dcbd0b2d8d9830de623c6f05b6ef7f

SHA256
e55e7954e9ba3123162759d65c8bde5327b87511d798627d49fa3cc4ae59e7d9

SHA512
e41e80a07f77c0a9d0a5722ce6bd486488a61eea6a5a8188332feac5f2b4ed7f3d42940939708c340a418172cf6263d3befbb32ba5042b280c0cf053b5aec7c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1f8308d05d0274e4fe364afb4c2f20e7

SHA1
f71e41796e091c67aa51943c6103db5697c7a0e5

SHA256
38bb71e5c80919248b121be8ce4c805853307b265f994ffe9d8f8969f7397a77

SHA512
16962431777743aa1d79372709aeceb996970224faee4a2aeac3c4bed3310ff12a455dd3a6f669695cc1c91184b4d9a4afaa3cf3b918fc2c13489f02a8f67905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
07ec674e85c1fd2db735112b9e4ed9e1

SHA1
8cbfb911433b0f6c58871a07be854a01d5fda551

SHA256
884fbf511287219062b164bfd2e227b484da02055db5b1fd05c02c691a0a42d4

SHA512
094629476896d5db32872f9ad01521ce6e82121f07fb79ef8d392e1a3f9e3c7d17c18bc9969edd6b0121f06e3ba736814096001e86b1780471f4c3106487d2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
b4cb7cee2194e2e5dbe7b54b7966f4e8

SHA1
9eef9492424f7e747b8b115bffeca9238ea8208c

SHA256
74d9b31fab0d5127485bdad67d4ebc7a58381b7c24d51b5df726f7fa2cf72e6e

SHA512
f35148a1f3b1b0faaab33ea5ce310d0e71970b3c0f42d46c34ee1f70a5ca546c2ae562912f9fc4063e64dfeafc8708b61b90091ddcd28eb0834241ca5fa40317

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4eedc77c8af8fee10b8a58c1b80bb91b

SHA1
1662c38ab50cc7f142059ad3eec5ac9b1aeff930

SHA256
b9d25c526510a02e0cff09e2902610d252f53b3398efa3ff4c5ef615a03c4213

SHA512
400ab6449c0d9bd613132c37d394fc584863e5c5f9ca57eb38c9ed278e558d0e4f643681734edaedd448e55fdaf1d7ea360b6d8c2db435988c943f72b731d600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f8a8.TMP

Filesize
48B

MD5
189818fa950f096a80a3f6d7350ff13b

SHA1
ff902f0b466d7c3bad6f0d476f7826570eab083e

SHA256
19eb832dfd60c7c3709a617909066fe5496513ea0046a2f0dd8c9f734cf6c5d7

SHA512
feba1ce7d15a9e52c78a459d5f2a533d2d7eb4560a4d4299fa61d78d9d79135356cfa13b8a8b47f4ce80392565482a26b8471f6b013c8276935108f74af45d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
e6dca651e4b9f9e3ecd34ecf9c1e6e7d

SHA1
8a1c6a8145e767cd07a50bd198be9945dea99bc2

SHA256
039c39625a813b44f3346eab622b3d676246de320833b31337b6f19658fc2497

SHA512
bd7675693acd500fd9b2980233fb70b74b30efe3f1328e62a1e1e3ec72edbfb6c4a82fbab7f676e160b2f9a7cbad9f28f100224ac6a87c12addb98f40bfcecb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
269b21a8151872e7f5a70a9e07b36e07

SHA1
28513883b0ef6998bbb52a81136dfa8e7ab0aff3

SHA256
829b138679679a1f20c653f39a6e72662498d6b1a789a28fc07a26f60b81484b

SHA512
fe0689812b9db85c57d78406d63af1da6afe969c88f842406d1431590d0a7b3451e83064a3e601409342260941d92673ac52a7e2374e7cf68587698fb8245d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
5e69f07554764b9f7800c815617fe040

SHA1
c75e5fc34281b29f2fc655c652d27c6937f00106

SHA256
b3a3c5e23d6822decb5e84e2849158fb8c0c07b2d848db72731065c9d6ded06e

SHA512
f7f9b9869eefdfcad07d11b07c80d83239b269af998e8cbc8bf8d74fefe48088673512a58a09fd00066c0fbaa52902053caca8833cd5e155967844ce3226e3ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
d000047beb221121ef8e08ccde3a9354

SHA1
47892c3de12b6446e21919f5240797ba58e89a36

SHA256
72cacb5f2c4a1d18ec1306048e4931c3a8af0e64e96052cbf4c03b44b3955ec0

SHA512
274205789cfd70165c1848c994102070ca12a5e2299c93343aa2c8e81b5fd37ce85daa0ba740c2ab2b087acf98862645d2125451ce05d5f86e1f0043a7731242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
48KB

MD5
be97d5476a538cd336a4bfe06d468302

SHA1
f24e6487b4917b4e858d7e36cf94777d6fc0a8dd

SHA256
a533aed556b7563ef4e6a641d09227bd5904871e83cbb3ec463004dbd2f3b596

SHA512
bd022029b744d4810b181a7bb3a3a414af40d90aad60a11c0571bec65df3bd35533462c39e13e8ce8a033c0e0f7d5804dca2dbad45eaacd7b5a8574cd2b1aa74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
516ece2c0a0be06174518df8288ecb1f

SHA1
1bdb2dd838ce170208da7ab5e4437105ed1cced9

SHA256
341cf1a538df950844e36b66578f18d939f1b76259e1bce62bbdfee3484722ba

SHA512
388ca96196f6598121aeedf334fb4ab6fa21744fa99c4c2296a4da4d2073eb75ee7d2d51f10c11e16c2c1f6e48fe675999dc3baaa5c1e1533dbc95d9bc7f4b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
48KB

MD5
6d34f6ddfa636b61c5a49111df25d946

SHA1
0432354808057cbbd40253a961865ec7b4404748

SHA256
e83627663804672a53cd50d9cf2c1b4038581c99a869078ab17a72b6565b5b65

SHA512
676d2ec8a1b372da59340189773308dfeabd5dd7034ce9cb1816b7efbb957d5651a1e31a8857691b2792d1e72110c0ef8cc0d0f9a6b29dda3818bbb4f5094ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
bb1ed11de5186c4bcadf911b78810883

SHA1
e1c672a8407c695dafc756aad57b6ad151f4ad7c

SHA256
5058a098ad1644b9592073a094db7cc8e69b8aea1aad82153a3b1bdc1e8c1e0a

SHA512
bcf8d464b8d7c5415471df3e8859cf8c72686396fe550847171ff2097b3ec828795322b7870a494e08ec9742d21996a0c79312dea509efca2e2bc37b0124e3e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
53KB

MD5
ec43744c6a9048a5da3d5006e4a3c0db

SHA1
7281ad52ec7aaf7a6ee7462df467117f613f9b8b

SHA256
06ca732c9abe9123b32e5d4976dfa09cd1e67eef52ae11edf74867961d5d4450

SHA512
d4ab26d0d06d7ac3f97c24ee4565ac62e91d10289044a2a3961ddbc744b97f52e1a51d75759203fd3f6f99aee840dbc5e60dfd69d9384009aa31bf053e46f36a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
53KB

MD5
f2593730a659515449e8b2ebffa7cbfa

SHA1
a9d7d2d404c53de74bba4eeb927d638ba8951508

SHA256
99138fd26e9fe11461a666e5414765bd3c2ab92a6dfab0f2ecdd7b44c7dc2fd4

SHA512
e694eff983f2f7fb97e4e561fc484d31bf09bebc0e19c7be20fdb3bb47838fd83c518866e3b72a8a2ab048a88e30a2f15b92826b4998a9f38665a46413a1fe0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
85e6c81d86eedc23c7fae85de4112f6e

SHA1
9ac6c8081bd1c3ad4d25f43e20d741a13dd801a8

SHA256
d9fb5e099f8c88f0d74060f012d6b6a8c4609103225167195eb59e0b5234002c

SHA512
9ed29e0a6417d68ad37645c332a144cea10c61d5c132a1b3ebe8f9cc12086c30f116d54fa7d4fdbeb718ab2c3c2a631c046adb849fba4cc9fc2cfe2fe3fccebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ybssjkzv.pt4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\PROJECT Z.exe

Filesize
78KB

MD5
1cfe60212af8fdf275836db034c6e52b

SHA1
e01d8df215c8758862c454bd9ce04f83eabf4a94

SHA256
befda001511ea804568050456d739908a914526badba12bf5d9d1841fbfbfc65

SHA512
082baebfe0dff8cb268ff3fbd3ec5ac78db905d61d39ed7730511931f2d57872bac982e0ecfe8352cf4f0907c41c20a6383da0f0830ab0456a5a9d7abcd71cf7

Download Submit
memory/1064-323-0x0000024E33120000-0x0000024E33648000-memory.dmp

Filesize
5.2MB

Download
memory/1064-410-0x0000024E32C20000-0x0000024E32C2E000-memory.dmp

Filesize
56KB

Download
memory/1064-408-0x0000024E32C40000-0x0000024E32C5E000-memory.dmp

Filesize
120KB

Download
memory/1064-407-0x0000024E32C10000-0x0000024E32C22000-memory.dmp

Filesize
72KB

Download
memory/1064-485-0x0000024E33650000-0x0000024E3391A000-memory.dmp

Filesize
2.8MB

Download
memory/1064-406-0x0000024E32C90000-0x0000024E32D06000-memory.dmp

Filesize
472KB

Download
memory/1064-321-0x0000024E32920000-0x0000024E32AE2000-memory.dmp

Filesize
1.8MB

Download
memory/1064-320-0x0000024E183C0000-0x0000024E183D8000-memory.dmp

Filesize
96KB

Download
memory/6600-534-0x0000020E58D70000-0x0000020E58D92000-memory.dmp

Filesize
136KB

Download