190ce04c630103d7543fc79e3bbe918af0ca0eb24cf775d4e1c21d35a1bfe7a0

Analysis

user interaction
yes
max time kernel
152s
max time network
180s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exploit Client.exe
Size 296.1MB
Sample261027-mskvystsfw
SHA256 190ce04c630103d7543fc79e3bbe918af0ca0eb24cf775d4e1c21d35a1bfe7a0
MD5 e16a18c484e00775ae99cfe3ff1d7e1d
SHA1 30fc07d820f2187fdc8af104f0b38a57ceae3b49
SHA512 b47e9365b97b015392b9ca63f8850d4949625551aa7a720e3925d324894559ef767e23b54030e071f76448776f6c256ce20bb0efb2c71dc6bc574a56e78a358f
SSDEEP 6291456:7FbGizdzpQ//aGEnndNvs7O5tlbEyauTs4ffN/w+sG04wS:7Fb9zdv17Wyau44d/w/S
TLSH
T168E833AC9A66A960D9CA257DA4CDED29DF3534147C02E3F7C346B6F31FCA26600253C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5260	powershell.exe
5200	powershell.exe
3580	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 26 IoCs

pid	Process
2300	Exploit.exe
1248	Exploit.exe
3348	Exploit-Setup.exe
4716	Exploit-Setup.tmp
5608	vc_redist.x64.exe
3412	vc_redist.x64.exe
5876	VC_redist.x64.exe
3320	audiodg.exe
936	audiodg.exe
920	audiodg.exe
6452	audiodg.exe
3068	WebView2RuntimeInstallerX64.exe
1172	MicrosoftEdgeUpdate.exe
6580	MicrosoftEdgeUpdate.exe
6576	MicrosoftEdgeUpdate.exe
1796	MicrosoftEdgeUpdateComRegisterShell64.exe
264	MicrosoftEdgeUpdateComRegisterShell64.exe
6596	MicrosoftEdgeUpdateComRegisterShell64.exe
6492	MicrosoftEdgeUpdate.exe
5904	MicrosoftEdgeUpdate.exe
2316	MicrosoftEdgeUpdate.exe
1824	MicrosoftEdgeUpdate.exe
1148	MicrosoftEdgeUpdate.exe
2340	MicrosoftEdgeWebview_X64_150.0.4078.83.exe
2064	setup.exe
6160	MicrosoftEdgeUpdate.exe

Loads dropped DLL 64 IoCs

pid	Process
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe
1248	Exploit.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1784	cmd.exe

Checks system information in the registry 2 TTPs 10 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2300-23-0x00007FF6EDB50000-0x00007FF6EDBBD000-memory.dmp	upx
behavioral2/files/0x000a00000001c8dd-1205.dat	upx
behavioral2/memory/1248-1209-0x00007FFF41070000-0x00007FFF416DC000-memory.dmp	upx
behavioral2/files/0x000d00000001c3f3-1214.dat	upx
behavioral2/files/0x000a00000001c85a-1216.dat	upx
behavioral2/memory/1248-1217-0x00007FFF542E0000-0x00007FFF54307000-memory.dmp	upx
behavioral2/memory/1248-1219-0x00007FFF59E80000-0x00007FFF59E8F000-memory.dmp	upx
behavioral2/memory/1248-1223-0x00007FFF542C0000-0x00007FFF542D9000-memory.dmp	upx
behavioral2/files/0x000d00000001c3f7-1224.dat	upx
behavioral2/files/0x000d00000001c40a-1226.dat	upx
behavioral2/files/0x000900000001c952-1229.dat	upx
behavioral2/memory/1248-1231-0x00007FFF55140000-0x00007FFF5514D000-memory.dmp	upx
behavioral2/files/0x000a00000001c82e-1234.dat	upx
behavioral2/files/0x000d00000001c3f6-1240.dat	upx
behavioral2/memory/1248-1245-0x00007FFF54250000-0x00007FFF54266000-memory.dmp	upx
behavioral2/memory/1248-1244-0x00007FF6EDB50000-0x00007FF6EDBBD000-memory.dmp	upx
behavioral2/files/0x000a00000001c859-1243.dat	upx
behavioral2/memory/1248-1247-0x00007FFF41070000-0x00007FFF416DC000-memory.dmp	upx
behavioral2/memory/1248-1248-0x00007FFF40B30000-0x00007FFF41063000-memory.dmp	upx
behavioral2/files/0x000d00000001c415-1249.dat	upx
behavioral2/memory/1248-1241-0x00007FFF54F60000-0x00007FFF54F6F000-memory.dmp	upx
behavioral2/memory/1248-1236-0x00007FFF550A0000-0x00007FFF550AD000-memory.dmp	upx
behavioral2/memory/2300-1235-0x00007FF6EDB50000-0x00007FF6EDBBD000-memory.dmp	upx
behavioral2/memory/1248-1253-0x00007FFF54210000-0x00007FFF54243000-memory.dmp	upx
behavioral2/memory/1248-1255-0x00007FFF49CA0000-0x00007FFF49D6E000-memory.dmp	upx
behavioral2/files/0x000a00000001c861-1254.dat	upx
behavioral2/memory/1248-1252-0x00007FFF542E0000-0x00007FFF54307000-memory.dmp	upx
behavioral2/files/0x000d00000001c409-1233.dat	upx
behavioral2/memory/1248-1228-0x00007FFF54270000-0x00007FFF5428A000-memory.dmp	upx
behavioral2/memory/1248-1225-0x00007FFF54290000-0x00007FFF542BB000-memory.dmp	upx
behavioral2/files/0x000d00000001c3f1-1221.dat	upx
behavioral2/files/0x001200000001c3e4-1257.dat	upx
behavioral2/memory/1248-1259-0x00007FFF408A0000-0x00007FFF40B2F000-memory.dmp	upx
behavioral2/files/0x000a00000001c841-1260.dat	upx
behavioral2/memory/1248-1262-0x00007FFF54270000-0x00007FFF5428A000-memory.dmp	upx
behavioral2/files/0x000a00000001c842-1264.dat	upx
behavioral2/files/0x000900000001c964-1267.dat	upx
behavioral2/memory/1248-1266-0x00007FFF4D360000-0x00007FFF4D399000-memory.dmp	upx
behavioral2/memory/1248-1269-0x00007FFF48360000-0x00007FFF48414000-memory.dmp	upx
behavioral2/memory/1248-1263-0x00007FFF405E0000-0x00007FFF40896000-memory.dmp	upx
behavioral2/files/0x000a00000001c8a1-1271.dat	upx
behavioral2/memory/1248-1274-0x00007FFF54F60000-0x00007FFF54F6F000-memory.dmp	upx
behavioral2/memory/1248-1275-0x00007FFF40200000-0x00007FFF405D9000-memory.dmp	upx
behavioral2/files/0x000a00000001c89c-1273.dat	upx
behavioral2/memory/1248-1279-0x00007FFF54250000-0x00007FFF54266000-memory.dmp	upx
behavioral2/memory/1248-1280-0x00007FFF3EE20000-0x00007FFF40200000-memory.dmp	upx
behavioral2/files/0x000a00000001c8a5-1281.dat	upx
behavioral2/files/0x000a00000001c847-1287.dat	upx
behavioral2/memory/1248-1289-0x00007FFF4D330000-0x00007FFF4D352000-memory.dmp	upx
behavioral2/memory/1248-1288-0x00007FFF40B30000-0x00007FFF41063000-memory.dmp	upx
behavioral2/memory/1248-1291-0x00007FFF54210000-0x00007FFF54243000-memory.dmp	upx
behavioral2/memory/1248-1300-0x00007FFF49CA0000-0x00007FFF49D6E000-memory.dmp	upx
behavioral2/memory/1248-1311-0x00007FFF408A0000-0x00007FFF40B2F000-memory.dmp	upx
behavioral2/memory/1248-1312-0x00007FFF405E0000-0x00007FFF40896000-memory.dmp	upx
behavioral2/memory/1248-1317-0x00007FFF41070000-0x00007FFF416DC000-memory.dmp	upx
behavioral2/memory/1248-1348-0x00007FFF4D360000-0x00007FFF4D399000-memory.dmp	upx
behavioral2/memory/1248-1333-0x00007FFF48360000-0x00007FFF48414000-memory.dmp	upx
behavioral2/memory/1248-1335-0x00007FFF3EE20000-0x00007FFF40200000-memory.dmp	upx
behavioral2/memory/1248-1346-0x00007FFF48080000-0x00007FFF4809C000-memory.dmp	upx
behavioral2/memory/1248-1345-0x00007FFF532A0000-0x00007FFF532AE000-memory.dmp	upx
behavioral2/memory/1248-1344-0x00007FFF480A0000-0x00007FFF480B1000-memory.dmp	upx
behavioral2/memory/1248-1343-0x00007FFF537C0000-0x00007FFF537CC000-memory.dmp	upx
behavioral2/memory/1248-1337-0x00007FFF315F0000-0x00007FFF36948000-memory.dmp	upx
behavioral2/memory/1248-1341-0x00007FFF49C80000-0x00007FFF49C95000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_gl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\show_third_party_software_licenses.bat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\notification_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\prefs_enclave_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_hu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_sv.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\lb.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\learning_tools.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\ne.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\msedge.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_ru.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\BHO\ie_to_edge_stub.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\WidevineCdm\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\vision.contrast-black.svg	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Trust Protection Lists\Mu\Social	setup.exe
File created	C:\Program Files\Exploit Launcher\is-55A4LWLDZV.tmp	Exploit-Setup.tmp
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\copilotapp.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_nb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\oneauth.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\hu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\identity_proxy\win10\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\CopilotStable\Square71x71Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\copilot_overlay_strings_lo.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\fr-CA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\msedge_100_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\ja.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\CopilotDev\Square44x44Logo.targetsize-16_altform-unplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\copilot_overlay_strings_nb.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\km.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\identity_proxy\win11\identity_helper.Sparse.Internal.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU71A7.tmp\msedgeupdateres_ja.dll	WebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotStable\Square310x310Logo.scale-150.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\vk_swiftshader.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\vcruntime140_1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\CopilotStable\Wide310x150Logo.scale-150.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\CopilotStable\Wide310x150Logo.scale-400.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\CopilotDev\Square44x44Logo.targetsize-256.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\identity_proxy\resources.pri	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\CopilotStable\Square44x44Logo.scale-125.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\VisualElements\CopilotStable\Square44x44Logo.targetsize-256_altform-lightunplated.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\copilot_overlay_strings_el.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\.arch	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotDev\StoreLogo.scale-200.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\LogoCopilot.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\LogoDev.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\pl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Trust Protection Lists\Sigma\Content	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\msedge.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\WidevineCdm\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\voice.contrast-black.svg	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_ta.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU71A7.tmp\msedgeupdateres_km.dll	WebView2RuntimeInstallerX64.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Trust Protection Lists\Mu\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Trust Protection Lists\Mu\CompatExceptions	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\copilot_overlay_strings_lt.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_hr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\es.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.83\Locales\mt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\VisualElements\CopilotDev\Square310x310Logo.scale-125.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\bn-IN.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\copilot_overlay_strings_mk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Locales\lt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\msedge_pwa_launcher.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\EBWebView\x86\EmbeddedBrowserWebView.dll	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5668	cmd.exe
1676	cmd.exe
472	cmd.exe
4320	cmd.exe
6536	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Exploit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Exploit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exploit-Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exploit-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebView2RuntimeInstallerX64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6492	MicrosoftEdgeUpdate.exe
1824	MicrosoftEdgeUpdate.exe
6160	MicrosoftEdgeUpdate.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3348-1294-0x0000000000450000-0x0000000000531000-memory.dmp	innosetup
behavioral2/memory/3348-1366-0x0000000000450000-0x0000000000531000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05FE3F4D-62DA-4976-B72B-059E095ECF9E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F03ED42C-87E7-4D58-B377-065DF7AC36B2}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{5C993081-D438-4735-80E5-5E82C1E498D6}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VERSIONINDEPENDENTPROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{5C993081-D438-4735-80E5-5E82C1E498D6}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CLSID\ = "{E421557C-0628-43FB-BF2B-7C9F8A4D067C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1CA7367-21A7-45DD-8C49-614D55CF0803}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdateComRegisterShell64.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5260	powershell.exe
5260	powershell.exe
1248	Exploit.exe
1248	Exploit.exe
4716	Exploit-Setup.tmp
4716	Exploit-Setup.tmp
5200	powershell.exe
5200	powershell.exe
5200	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
920	audiodg.exe
920	audiodg.exe
6452	audiodg.exe
6452	audiodg.exe
1172	MicrosoftEdgeUpdate.exe
1172	MicrosoftEdgeUpdate.exe
1172	MicrosoftEdgeUpdate.exe
1172	MicrosoftEdgeUpdate.exe
1172	MicrosoftEdgeUpdate.exe
1172	MicrosoftEdgeUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6452	audiodg.exe
920	audiodg.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5260	powershell.exe
Token: SeIncreaseQuotaPrivilege	5260	powershell.exe
Token: SeSecurityPrivilege	5260	powershell.exe
Token: SeTakeOwnershipPrivilege	5260	powershell.exe
Token: SeLoadDriverPrivilege	5260	powershell.exe
Token: SeSystemProfilePrivilege	5260	powershell.exe
Token: SeSystemtimePrivilege	5260	powershell.exe
Token: SeProfSingleProcessPrivilege	5260	powershell.exe
Token: SeIncBasePriorityPrivilege	5260	powershell.exe
Token: SeCreatePagefilePrivilege	5260	powershell.exe
Token: SeBackupPrivilege	5260	powershell.exe
Token: SeRestorePrivilege	5260	powershell.exe
Token: SeShutdownPrivilege	5260	powershell.exe
Token: SeDebugPrivilege	5260	powershell.exe
Token: SeSystemEnvironmentPrivilege	5260	powershell.exe
Token: SeRemoteShutdownPrivilege	5260	powershell.exe
Token: SeUndockPrivilege	5260	powershell.exe
Token: SeManageVolumePrivilege	5260	powershell.exe
Token: 33	5260	powershell.exe
Token: 34	5260	powershell.exe
Token: 35	5260	powershell.exe
Token: 36	5260	powershell.exe
Token: SeDebugPrivilege	5200	powershell.exe
Token: SeIncreaseQuotaPrivilege	5200	powershell.exe
Token: SeSecurityPrivilege	5200	powershell.exe
Token: SeTakeOwnershipPrivilege	5200	powershell.exe
Token: SeLoadDriverPrivilege	5200	powershell.exe
Token: SeSystemProfilePrivilege	5200	powershell.exe
Token: SeSystemtimePrivilege	5200	powershell.exe
Token: SeProfSingleProcessPrivilege	5200	powershell.exe
Token: SeIncBasePriorityPrivilege	5200	powershell.exe
Token: SeCreatePagefilePrivilege	5200	powershell.exe
Token: SeBackupPrivilege	5200	powershell.exe
Token: SeRestorePrivilege	5200	powershell.exe
Token: SeShutdownPrivilege	5200	powershell.exe
Token: SeDebugPrivilege	5200	powershell.exe
Token: SeSystemEnvironmentPrivilege	5200	powershell.exe
Token: SeRemoteShutdownPrivilege	5200	powershell.exe
Token: SeUndockPrivilege	5200	powershell.exe
Token: SeManageVolumePrivilege	5200	powershell.exe
Token: 33	5200	powershell.exe
Token: 34	5200	powershell.exe
Token: 35	5200	powershell.exe
Token: 36	5200	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeBackupPrivilege	3020	vssvc.exe
Token: SeRestorePrivilege	3020	vssvc.exe
Token: SeAuditPrivilege	3020	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3580	powershell.exe
Token: SeSecurityPrivilege	3580	powershell.exe
Token: SeTakeOwnershipPrivilege	3580	powershell.exe
Token: SeLoadDriverPrivilege	3580	powershell.exe
Token: SeSystemProfilePrivilege	3580	powershell.exe
Token: SeSystemtimePrivilege	3580	powershell.exe
Token: SeProfSingleProcessPrivilege	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: SeCreatePagefilePrivilege	3580	powershell.exe
Token: SeBackupPrivilege	3580	powershell.exe
Token: SeRestorePrivilege	3580	powershell.exe
Token: SeShutdownPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeSystemEnvironmentPrivilege	3580	powershell.exe
Token: SeRemoteShutdownPrivilege	3580	powershell.exe
Token: SeUndockPrivilege	3580	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4716	Exploit-Setup.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4716	Exploit-Setup.tmp

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 5668	3232	Exploit Client.exe	88
PID 5668 wrote to memory of 1988	5668	cmd.exe	90
PID 1988 wrote to memory of 5384	1988	net.exe	91
PID 5668 wrote to memory of 5260	5668	cmd.exe	92
PID 5668 wrote to memory of 2300	5668	cmd.exe	94
PID 2300 wrote to memory of 1248	2300	Exploit.exe	95
PID 5668 wrote to memory of 3348	5668	cmd.exe	97
PID 3348 wrote to memory of 4716	3348	Exploit-Setup.exe	98
PID 1248 wrote to memory of 1676	1248	Exploit.exe	100
PID 1676 wrote to memory of 5200	1676	cmd.exe	102
PID 4716 wrote to memory of 5608	4716	Exploit-Setup.tmp	103
PID 1248 wrote to memory of 472	1248	Exploit.exe	106
PID 472 wrote to memory of 3580	472	cmd.exe	108
PID 5608 wrote to memory of 3412	5608	vc_redist.x64.exe	105
PID 3412 wrote to memory of 5876	3412	vc_redist.x64.exe	109
PID 1248 wrote to memory of 1784	1248	Exploit.exe	113
PID 1784 wrote to memory of 2408	1784	cmd.exe	116
PID 1248 wrote to memory of 4320	1248	Exploit.exe	117
PID 4320 wrote to memory of 5108	4320	cmd.exe	119
PID 1248 wrote to memory of 936	1248	Exploit.exe	122
PID 3320 wrote to memory of 920	3320	audiodg.exe	123
PID 936 wrote to memory of 6452	936	audiodg.exe	124
PID 920 wrote to memory of 6536	920	audiodg.exe	125
PID 4716 wrote to memory of 3068	4716	Exploit-Setup.tmp	131
PID 3068 wrote to memory of 1172	3068	WebView2RuntimeInstallerX64.exe	132
PID 1172 wrote to memory of 6580	1172	MicrosoftEdgeUpdate.exe	133
PID 1172 wrote to memory of 6576	1172	MicrosoftEdgeUpdate.exe	134
PID 6576 wrote to memory of 1796	6576	MicrosoftEdgeUpdate.exe	135
PID 6576 wrote to memory of 264	6576	MicrosoftEdgeUpdate.exe	136
PID 6576 wrote to memory of 6596	6576	MicrosoftEdgeUpdate.exe	137
PID 1172 wrote to memory of 6492	1172	MicrosoftEdgeUpdate.exe	138
PID 1172 wrote to memory of 5904	1172	MicrosoftEdgeUpdate.exe	139
PID 2316 wrote to memory of 1824	2316	MicrosoftEdgeUpdate.exe	142
PID 1148 wrote to memory of 1072	1148	MicrosoftEdgeUpdate.exe	144
PID 2316 wrote to memory of 2340	2316	MicrosoftEdgeUpdate.exe	146
PID 2340 wrote to memory of 2064	2340	MicrosoftEdgeWebview_X64_150.0.4078.83.exe	147
PID 2316 wrote to memory of 6160	2316	MicrosoftEdgeUpdate.exe	152

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	MicrosoftEdgeUpdate.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Exploit Client.exe
"C:\Users\Admin\AppData\Local\Temp\Exploit Client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Exploit.exe
    "C:\Users\Admin\AppData\Local\Temp\Exploit.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Exploit.exe
      "C:\Users\Admin\AppData\Local\Temp\Exploit.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateSvc'""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateSvc'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -command "Add-MpPreference -ExclusionProcess 'audiodg.exe'""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:472
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Add-MpPreference -ExclusionProcess 'audiodg.exe'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "schtasks /delete /tn "WinUpdateSvc" /f"
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:1784
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn "WinUpdateSvc" /f
        6⤵
        
        PID:2408
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WinUpdateSvc" /tr ""C:\ProgramData\WindowsUpdateSvc\audiodg.exe"" /sc onlogon /ru "%USERNAME%" /rl highest /it /f"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4320
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "WinUpdateSvc" /tr ""C:\ProgramData\WindowsUpdateSvc\audiodg.exe"" /sc onlogon /ru "Admin" /rl highest /it /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5108
    - - C:\ProgramData\WindowsUpdateSvc\audiodg.exe
        
        C:\ProgramData\WindowsUpdateSvc\audiodg.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:936
      - C:\ProgramData\WindowsUpdateSvc\audiodg.exe
        
        C:\ProgramData\WindowsUpdateSvc\audiodg.exe
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Exploit-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Exploit-Setup.exe" /SILENT /NORESTART
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\is-QPKT3NVC09.tmp\Exploit-Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QPKT3NVC09.tmp\Exploit-Setup.tmp" /SL5="$D014A,223391726,859648,C:\Users\Admin\AppData\Local\Temp\Exploit-Setup.exe" /SILENT /NORESTART
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\is-WRBOCCSZ3N.tmp\vc_redist.x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-WRBOCCSZ3N.tmp\vc_redist.x64.exe" /install /quiet /norestart
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5608
      - C:\Windows\Temp\{226DBEBB-4679-438D-B12E-7F4EE5519151}\.cr\vc_redist.x64.exe
        
        "C:\Windows\Temp\{226DBEBB-4679-438D-B12E-7F4EE5519151}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-WRBOCCSZ3N.tmp\vc_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /quiet /norestart
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\Temp\{6175A4A0-E441-4BD3-B690-82878AC58CE6}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{6175A4A0-E441-4BD3-B690-82878AC58CE6}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AC11FAFD-EBFB-401F-9BE0-C08F7DC6C451} {2709EFBF-A162-4622-B185-AA99F8BAFFE1} 3412
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\is-WRBOCCSZ3N.tmp\WebView2RuntimeInstallerX64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-WRBOCCSZ3N.tmp\WebView2RuntimeInstallerX64.exe" /silent /install
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3068
      - C:\Program Files (x86)\Microsoft\Temp\EU71A7.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EU71A7.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"
        6⤵
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Checks system information in the registry
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        7⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6580
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        7⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6576
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1796
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:264
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6596
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNDEuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4yNDEuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDY0RDA5NUMtRjkzNi00RUUzLUE0MzItQ0Y4RDg5MUE1MDY2fSIgdXNlcmlkPSJ7MEFCOEZCN0EtMzgzMC00MkY2LTk5M0EtM0IyMzE0NUFCQzRGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0Q0JBMUFGMS00MjdGLTQzNDAtODIwMy1CQTA5NzlFREVBNUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTkxIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3M4RmFudndmTWNkNjZnN0xWMlBlYVNSN1dVT3YwbHVGNGh2aWlyVG9rK009JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuNjUiIG5leHR2ZXJzaW9uPSIxLjMuMjQxLjE1IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2Nzg2MzcwMTA2IiBpbnN0YWxsX3RpbWVfbXM9IjY4OSIvPjwvYXBwPjwvcmVxdWVzdD4
        7⤵
        Executes dropped EXE
        Checks system information in the registry
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:6492
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{064D095C-F936-4EE3-A432-CF8D891A5066}" /silent /offlinedir "{449DACB2-B90C-4FAE-B6EB-898C9496087F}"
        7⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x0000000000000494
1⤵
PID:5724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\ProgramData\WindowsUpdateSvc\audiodg.exe
C:\ProgramData\WindowsUpdateSvc\audiodg.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320
- C:\ProgramData\WindowsUpdateSvc\audiodg.exe
  C:\ProgramData\WindowsUpdateSvc\audiodg.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:6536

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:7060

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNDEuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4yNDEuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDY0RDA5NUMtRjkzNi00RUUzLUE0MzItQ0Y4RDg5MUE1MDY2fSIgdXNlcmlkPSJ7MEFCOEZCN0EtMzgzMC00MkY2LTk5M0EtM0IyMzE0NUFCQzRGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RTI4OUM0RjYtMjFGNi00NDM0LUEzQkMtMkIzRDYwMUVDQ0E2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtzOEZhbnZ3Zk1jZDY2ZzdMVjJQZWFTUjdXVU92MGx1RjRodmlpclRvaytNPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxNDAuMC43MzM5LjgxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0NSIgaW5zdGFsbGRhdGV0aW1lPSIxNzg5MTQyMzUyIiBvb2JlX2luc3RhbGxfdGltZT0iMTM0MzM2MTQ1MDU1NjQwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iODYwNjU5NDMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3OTEwODU2MTAiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1824
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{839F8DD3-8834-4C0D-B202-3BD700455460}\MicrosoftEdgeWebview_X64_150.0.4078.83.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{839F8DD3-8834-4C0D-B202-3BD700455460}\MicrosoftEdgeWebview_X64_150.0.4078.83.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{839F8DD3-8834-4C0D-B202-3BD700455460}\EDGEMITMP_8861E.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{839F8DD3-8834-4C0D-B202-3BD700455460}\EDGEMITMP_8861E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{839F8DD3-8834-4C0D-B202-3BD700455460}\MicrosoftEdgeWebview_X64_150.0.4078.83.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:2064
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yNDEuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4yNDEuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDY0RDA5NUMtRjkzNi00RUUzLUE0MzItQ0Y4RDg5MUE1MDY2fSIgdXNlcmlkPSJ7MEFCOEZCN0EtMzgzMC00MkY2LTk5M0EtM0IyMzE0NUFCQzRGfSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7NjY2OTNDNkMtMzJFOC00MjAwLUExMjItREYyOUVGMjI3RTZGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjE5MSIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJEYWR5IHN1cGVyIHBvd2VyZnVsIFBDIi8-PGV4cCBldGFnPSImcXVvdDtIaHZISVdwVU5aVE1uVjJWVDFsZTNmNVlKUTlPU29URDZNeEhEbEE4OVBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxNTAuMC40MDc4LjgzIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iNDUiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjc5NjA0Mzc5MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY3OTYxNDgwMTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2ODA5MTExMTU5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjgyODA5NDU0MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzE3NDEyNTc2MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlZD0iMTk3ODU2MDgwIiB0b3RhbD0iMTk3ODU2MDgwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMSIgaW5zdGFsbF90aW1lX21zPSIzNDU5OCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6160

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1148
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1148" "868" "820" "852" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge_7z.data

Path C:\Program Files (x86)\Microsoft\EdgeCore\150.0.4078.83\Installer\msedge_7z.data
Size 5KB
SHA256 78ba8b213576176bb94eda7ba2d4ec3e16fadd42b5a018329252eb1b80d67994
MD5 ca9592f4474eb2c6306204ef1f984fb4
SHA1 cb3c8350819aced1f445c488ccdb55f75f01b792
SHA512 f5be47c9df869743e0c182dc58fa2c1de1a7712b49b8813d6d63c10f2e841a4dc1d4cecc5abe0741a3a19737f6f096a5bd71b469607709baea780621c27eb534
SSDEEP 96:UkZR2aD9rlyyEXIPMR4uXF2dNW/Yj6l094kjD6weLWz3pssV4VeahhFaW+Fy9:UkZvNlyyoIPAPEdNWIXj6CKsKT3A2
TLSH
T116C16D235E7E8A66AD5457DD8A0AD13E15DCD37E7A901354B917BF328005E1DF3603C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.241.15\MicrosoftEdgeUpdate.exe
Size 202KB
SHA256 9a5c0ee0ce2b6a8e425dfe1498163950da4bc5f71a6c3ea7e7bf17b8116f04ea
MD5 175703c2b8a430061e8f550e958983ae
SHA1 1c0ebaafccba4ee4e9f26f86a1f5e3c754803ee1
SHA512 aeaaa014aa4acfe5d36bd152b991520e89cf63a782004fb3b93a1d7cd23a7e7636ebabbd5be56d432bc983b0af662590575fcc89de9fbb3ea3c276b1d49819f9
SSDEEP 3072:w7rfRYdZ+X/mnITlED/to+Mghf+GvC6C36oPWDDVgB+v5Uuhf9+a6QhLsCgY3ZPa:pAO8lED/e+3C3kD+B+ICy
TLSH
T10A144C1277F80A69F8F36E3158349F26E93BBC319D34E6AE1641118E2D34A51AD31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Exploit Launcher.exe

Path C:\Program Files\Exploit Launcher\Exploit Launcher.exe
Size 1.9MB
SHA256 d191d5e0f391ee2916d716862f8d17798ba66c897e52783cf62a6ff6a19d8945
MD5 7acdb75cd03fd0497145841e2bfca50f
SHA1 239a7ec9c6a79e6b0508d44db183ecd2ea25a0aa
SHA512 d1a01b41cee93f3e30d9556fffe12820bb04891f1630e68c7d2237563624d812bf0a89f92922db9d1109f734be17a563e03023f1fb92ee13ca3d9de0580ac242
SSDEEP 24576:mpQfkI/XhegVuxGt4V/peLpIm1NJ37428Nk/jBUWM9Fq40OMNyh:CgvL8BeLpIm1NJ3k2GTDq4rMI
TLSH
T1E195294BF74888B4C130E675CA5A4E72CBB5BC8D943C679B17C42EA72E4634166F6F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.log

Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Size 192KB
SHA256 55aa8b6d945c6bb154d0a359beea7734bb9acf0153df3e18160728f794e2a6a2
MD5 d462846f73d2790ccf8f3567639389fe
SHA1 07b405d0fcb64deb462805022bbec42e75f13606
SHA512 29b6e58bd4204cb6392981174b7afb3bb0bc26fcac87a96ae54f5142a0244b96d02f092ea7800fbee7e5bf4758232cca3ff9ebda966b85abce20d38a7a499ecf
SSDEEP 6144:N6IJ3CH+yFFPowBW4sQyFFPowBW6a8yP0AdO9XFoTy+2:n
TLSH
T12A14173637F90619BEF79A17E9BADC66B93BB9562C19C40C0091168E0C72F01D970B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003a82\SDL2.dll
Size 635KB
SHA256 4cf0eb7bb018e4d3140221de6863b8d2e70b7f40d695f0028732f7b5c6004c9b
MD5 4aff18a32174861c9387b9e943394b25
SHA1 27def9ddcb206e4936a676b4d3a95052f3968bf7
SHA512 d98a286b131e38f1d6da524ae6a47793ffd4d7167f6a4c2655678db2b29352712fdd18099b213a85b6a4fb1b12ffdcb60adc1e2496b6a766fcb10f3e0788d333
SSDEEP 12288:UaDchZmQQVMi+X92o51RPU/+obEkaoTv7vhL2jTTBRT+XLVnP/D7fQ:/RQQ2Tv51R874joTv9LeTBRTuZ/D7o
TLSH
T1AFD4235FAD2BBFEECBE32CB9C4140DB663647680433441DA5A18E695FBF9106642C347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_image.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003a82\SDL2_image.dll
Size 58KB
SHA256 4924026eb1dbaff96640e9220276591c50a089cf7d71bc993543eb742233f9fc
MD5 269fa6fc7b09db18b64307ee971293c4
SHA1 6e3f8012a02b9705a89d3309768475401a7b8720
SHA512 507cf95041c2972236559c142d69099b7a46b0d06ec530f01c96eec89e56f233b8f603b7f0f38a7592cefe1b2997abb2bdc37984f81238268d0cabc0ce4dedcb
SSDEEP 1536:3iAZGqAg+yyHSZmYCY3zNiNlpgFNmlydsir9+gPAipEOm46:ygAByaImYCOANlWKlyidk5j6
TLSH
T14C43F2AED9CB81BAD573BC7A6EDB9C07B9547D1603338639C1EC027AAE00550BE40767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_mixer.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003a82\SDL2_mixer.dll
Size 124KB
SHA256 385635f0edeeadb0795018378815a8b66a6886ce19a2e138bce9c807ab600d17
MD5 ecf5cb69023c92e433964e50e95351c0
SHA1 6357674ce8570fc04c1a3b7e5b04cca012e954bd
SHA512 b970c0d1165ebddc5f97ccc651d19147f57619b91f77881190f3694e1fcc3f906ae72c112c2c6f4000a6ab3a2243355254eca80deca0ff4e6514e57848886ec1
SSDEEP 3072:oDVb1Kzqv7dhgcTeEsCY6dp2v99lGcl908vSxQ5WZgeGKCssFo2:CVszqjgYeWf2vDPwQIdOssFo2
TLSH
T1D3C30241E06CF01CEB9BCB35426380097326BFC9469A7E1F4EF594AF2DE0D6856245AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_ttf.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003a82\SDL2_ttf.dll
Size 601KB
SHA256 87bdd3cf0cdbbe52b610b099bc35f51a70b35d5edc0e57549d6c9e08f1671fa1
MD5 3c13a2cf6c4551e0b9f21f88e48493b1
SHA1 c4a654a4da7707275b5095ce51d52b1bfaffd874
SHA512 9a473228411d27a1c48ce40bfd221cc2766ead298f0da954477cbf304f2790d82b3f63b3f01ec969d7421cd85ab37edb318c76df761be82da879baa77b5083df
SSDEEP 12288:9CNB1DfwMbJHRIjGpBL00WDw2GTiIWYJkmUOGLXv+fLt:92xBJxRG0HfjJ/Gjv6t
TLSH
T16BD4230B716231F6C9E9583BABD45839F820B5CD8A6688D77A63093FCDF75364C62183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\PIL\_imaging.cp313-win_amd64.pyd
Size 796KB
SHA256 6f390eec1df68942ce6962510e650abf47ccd44769672536b20ff1333cd12831
MD5 b6646f9a49c06d0dfe6f196f04cb114d
SHA1 5249b41b2c7c1dd246205232765c563d27909285
SHA512 4715c05e54cfe6790ae8d8059d761cab3263917f6a486aaebecf1ed2b5ae6de85c3e8e60688035f3bcbdc142e07f1250144f0cbf19da18baaee52f4b56eea70f
SSDEEP 24576:TuyEib1zT+CyIObm9E3ZkXwFeayGHYYn1MnT8Nd:C3yZTUZfIELHD1gy
TLSH
T1470523B7DB7EE3ECC9A50BF0D151066D2A00153021A7A6072AA0BDB187748D37CE1F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\_bz2.pyd
Size 50KB
SHA256 408188761d1982ec2d347e2a8f6376e3cd503dd353cbc3ea6d9fcdc1f487fcd6
MD5 5c3fafc4b805155cc7ffbce3685c4ced
SHA1 f77fd3987e6a79561b9be9db48f70e6c9d726eb7
SHA512 2b220f91aaeddb072c4738b6edfad8f6a6c0efbcbbba77b1c07c43317645705e992b556e04cb57e83db7331b5381dbe76885dc3e33af987f39986443783e3d9d
SSDEEP 1536:GaZvOot0tWhC7Z8mtBOJMJrqIILV+0y7NsR9QfIbHbvTcE:TO57jOJO2IILV+aTl
TLSH
T10333D19E5F39D052E793AA3213D4DAC17A74AFD354278B2B30E8525A0DAB7C0E711339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\_ctypes.pyd
Size 64KB
SHA256 cbbab2cf6e77f0cbca776a3bd1f7461c3ab8c0a52fdac6b4b9487911bcfca884
MD5 f203b0208e0aa1056db5c762bf7c0fb9
SHA1 3d66a786c364db1a5828ea91b0db34033ae492ee
SHA512 96cb7f03e8b6c9d02c276d740e94db59db9da5f0529a73867419e7d5ab1867e2488d1341d39681666e5052b47db3efd99a8512972d15b615a1f46680e2b50ca9
SSDEEP 1536:wt0F+fE9n9aFB0Lg0RtH7XKFDnmqGL8IIyP17y7NsR9WfIbHtvTc8:40UfE9k0LrH7KRn0oIIyP1HTv
TLSH
T16B53E1CB453D4006D7935EF292DCCE83FE35B3B36855469920EAA2BC07677C0A71A13A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\_hashlib.pyd
Size 38KB
SHA256 2e169db453e683d922589d0e83949b3f08d1d76cf174831d742ffc0526f76b70
MD5 7bea696b9a12ad371342d849dd22ba63
SHA1 b6dbd37f9d1d29c48bad8b45c0d0a5bd8b113d24
SHA512 bc6c0187cd5baed14fde37f2f0b6fc7d34720f05e895a083e4d1de06072c32d105743a120cf16ed9dd2a02f34234350da74e0aac412d783e2e87c91fb71b292c
SSDEEP 768:oU8tHSCtcTccgym7fspaOIIvIO2hy5RNLaRYT2Ip4HTxf1mlIJslS:N8BpIcumDFOIIvIOSy7NsR9tfIksk
TLSH
T13A03A0CA866CC096DF63797292E8DC83F938B7E328548B2B30DD91D94D573C0A71116D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\_lzma.pyd
Size 87KB
SHA256 4b6f20b3844ac0926cf35dd6d41cdf18f8ae574916cb9a4456704db230e48ca3
MD5 051c689e95255fc1f0a1ff211c1cfd2a
SHA1 215b2816c150931cfee400e027ad300e9061423a
SHA512 d412a57e73931a2504f4e3aa9b0c21e7c275db01588eb83875b513e094e1e4c48f5d299177263807ae1c070c6d44fa97f4a24f645be9e4c5815c80c0f8d45f8b
SSDEEP 1536:hONInnn16oSnV3hIAuIBEVdS81dn1uNTcMsOR+1TXOPhJII01Fvy7NsR9QlfIbHB:tnn1wndwM81d1ud3RqT+II01FXTB
TLSH
T13793F1CB2235D153EA230DF29BD8DE63B932FFE30446852F20E652A616673E0D727119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\_queue.pyd
Size 28KB
SHA256 8a2ec796879738e20b54ce6edc7e433ce8be3ea46468f8c0268bec7a3f34e9e5
MD5 775c9fca1e832492ad820c6e933d9eac
SHA1 c3511d8b483ae64c1c90a04dbb5e1cf4de488f26
SHA512 920f3a946ecdaa683e965546db0bd873e0583a81bc588d8c28ec4a09134fb8b6b0aac1b67d7ecaf453ac08f9c4c3fbd36907983dd5df69241ec4a8f589fc1bb3
SSDEEP 768:rbMdiPBlqjtCh6k986X4pP6II9UDVhy5RNLaRYT2Ip44Txf1mlIJClM:rbMdiOjtWx306II9UDjy7NsR9EfIkCi
TLSH
T1D0D28DDB867D8057DB636E7152E4D9C1FD38BBD31915862B30AE92950F233D0E326329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\_socket.pyd
Size 46KB
SHA256 1fba6805fe4c272b9ab046b6f5a1c8add4863201f54631d8dd9180533ad1fe59
MD5 32d8b5440d4d2625e8443b2ad0a98173
SHA1 e773b0f363a90b472b9cd7481b606916c9ad6a35
SHA512 f82e997856e64059b1ca5a55f183a08cedbc8af033c88c49313d4d932415cd93e0fcf8d10ba1f9583605ef5ddb904a83e8156cea4531366771b49a81abfc0cb7
SSDEEP 768:srF4IG/W8/OjFE5cYS9bFHuLikjEsVZpeTxIIywO9snOhy5RNLaRYT2Ip4qRTxfp:sB4BLiAcfxkp6TxIIywOmay7NsR9UfIS
TLSH
T16123D0C761AE8043C653BEB023E4DC83F739A7E3545986AB30EA63494E573D0E746329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\_ssl.pyd
Size 68KB
SHA256 06ef48185765e2e4272e5b6ce4ede5c55c68a02ffade03a9c0b8bf8890c7a046
MD5 a6815442938f5d87bdf7090c5e76b185
SHA1 baa7051893789767ea0cb405832bee9101f14f25
SHA512 4b59c8b048ce099cb01d9c2a0bcd680ee213bf7e535cf14cfea5578307fa8ffa61b055adb7c24a102a75842da1ccd966fbec4f2700b0ce944acb49c4ec4b5193
SSDEEP 1536:iLj1gbkjsT7MT8m8zX1zeALY0Zug7xIIL7V9Py7NsR9SfIkG5:61bjQFm8zRnLY00gVIIL7Vph
TLSH
T12F63E0CA8B1D942ADE52AF33E2D5DE83F674B38369508A1B20E893F54C173D4B35621D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\_wmi.pyd
Size 30KB
SHA256 ad05163b6024a2f30b21d2171d4ed7149938fd06926cb152ac6e6e6dddf1f551
MD5 1647bda87fb44495dce86ae1db5232c6
SHA1 4f2c3686981530b8920a4442d388543866c7514a
SHA512 7507455159a1aa5f23f1055dd58744969b0884b1c3163244549c340a94348bfb8b186f5f71dc0ae70bf3e5547c50e2e883a8c1958554486dc0634a34c462a32b
SSDEEP 768:jZHKQTFnM5PRxHPpYMIIILijD9hy5RNLaRYT2Ip4XTxf1ml9dH3jLTcQfg:dHrpM5PyMIIILijD7y7NsR9dfIbH3vTS
TLSH
T165E29FCF46B9D107E653AE7153E0E882FD3977D324558A6B30EA62D50F633C0A32625E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\base_library.zip
Size 1.3MB
SHA256 fa8a8b5baa012aaf273a3a80f20067baf555b66bff4394cb48aaa14d63406f10
MD5 5c79b9de6c67e88c72d2aafcde9ac8a3
SHA1 492965e70a67dbaf680cbd99e2d28e71b66daa30
SHA512 30cca515f44e7fb55646dfe8136d71fd7eaa35318b4d22193834d04eb80d854ee588c4aa17e51046c1cd99aeab160cf1b65c385e6dadca8e4ebe2ad317adea18
SSDEEP 12288:+BjEAqjwt3i2cPPdxhYZoFUDqfZdjdTTZ5PL+DzyiUW7WpBAuIva80201jwCVRDe:wjaE5cPPdxhYKdZTo7WpulmSuTx73A
TLSH
T165551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\charset_normalizer\cd.cp313-win_amd64.pyd
Size 52KB
SHA256 6f7e62dfce92bf7b15377270c70fc09e4182d499752bcbee31afafaaa060f1b1
MD5 367aeb8b9132443d8e20dd94598f8746
SHA1 47a7c6e4325e31eecfb873b2886737d1d5605886
SHA512 dc9798dd4317ac9cecc954dc93d8eefe596d21dd431f2bce9ff7e944d3126e81f6c1348a296ec2ba788dbcf9bdf484f3c324ba28dc00747308ac37a5c99df296
SSDEEP 768:wsSgvEVvIcS/8sxGJOKwE8ERfKiCsqZYjJ4ewWbTdoyeNQ3aGRJopD:5SRFS/8sIJhXfKivVTZbleNQ7RJY
TLSH
T15033F1EC3B42CA3DD462C5B07525122CD63A1927E25297370A573EF41FE67B8BB10592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\charset_normalizer\md.cp313-win_amd64.pyd
Size 60KB
SHA256 3ac0af66c31eec518e085b559fc8ab8067a1fdba51eec030bede1dbc2bb76e55
MD5 695956acdbee37b454a2d40fb2aa4778
SHA1 84deb23cbaf7fb77cd85f1313be1b6ff1a59b157
SHA512 fd13550d805355bda8d320309e6967ba1ace33eafa27fa801d47185b5de58bf5b4e8da62efa9935353e7826f9969e3d3f15a065c3457df7b12ceb17fab4cf940
SSDEEP 1536:mEIb0hBZVkyjTKr8gNWJuvMLMzSFtZR2Xy9BXjbzM85EAzBp:mERQua8gNtkLMz+tCqXg85N
TLSH
T1F453020A81DECB35FC2765324DE51C0C35A5285153860F7B3AC27ABBC9D2FA83B66191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\cv2\__init__.py
Size 6KB
SHA256 674817e87409bc589608ef9f4dd4c1a49f600b5e85ca8b106b3b0a9eab5c46cc
MD5 7a1a1e395f7c6e705a19284b5da0bfe0
SHA1 a3e15ae678446d82db4144339d10ce873763a87a
SHA512 fe825e14c055023ecadb1ecdb8150845ae30e31d96498f9fafcfb083b0a957f43ac0a8d558d8e98784e70f948b3a5524e9a924ba3818b60fd2c6a36139fc4c5d
SSDEEP 96:cHqnQSu/3aOjcEYIL9GE6AUmZris46/B5aVOQOo2/nH/h5M966GMBWtReWE3uSI3:2qQ1aOjIKtc6/Bb/H/h2BWtc93k
TLSH
T1C1E142465DB2641A0036D69DFF9180A4CF5F5FE35628240BBADC21C86FB8460D3F99B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config-3.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\cv2\config-3.py
Size 748B
SHA256 de28c7b5213cca148f09469916584611b3d66c1c8c432880259d6a3a92380213
MD5 e8ed8f25854821c8910bcb8308507dce
SHA1 8a3ac32d3df44794e8a834a6b6a8a1ed3f3aa5f7
SHA512 f3f36edf288a870f5e1f14f3b1113031721e12f30bf235b0e5385711e2bf7f08d0123e6ab14600ab069d2e692d81b7abc3692fb69eed34374fefab3b24f03d86
TLSH
T1B801D07E080F246492B2C759D88440DDC3D762E3F2238554FC6C6300E738CCC4283979
MD5 SHA1 SHA512 TLSH

Submit Download

config.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\cv2\config.py
Size 123B
SHA256 6c6367abce55995ae4a8d3c199420ec53afab287cb17dfc2f430378af75dd301
MD5 73e8bcbeba4dbe040c5f9a096ceda9de
SHA1 52c2e1bb717e8e8bc8409313c7e7e9d654033229
SHA512 f61394e48d8ade108ffd1f38a62267b36c2a1f525aa193884d1128ad47a0ca43ff852c8ce22a789a520964ff8e526e77264d5c61e1e4d8c0753703528ca36ba1
TLSH
T111B092FB84F2608C8212CBB9071E86C4411EEFDEAF422980384039928618CC00306038
MD5 SHA1 SHA512 TLSH

Submit Download

cv2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\cv2\cv2.pyd
Size 20.3MB
SHA256 3f73e96ca467c52bde2f05151a170bc94d2616a9483f8797cfe7624958b99474
MD5 797d5239bcd569a5b91355f50984cc07
SHA1 f0fe083f897b78057176b42393f65dd55932efb6
SHA512 094309f0c5fd67e6d4a2d21834dcda9d77543ddaaf97d6d93628b849db21f5ecbd506fd2fab14d0a355946d10f3c84db678603a8cdeb92e31bae8027650f7e9d
SSDEEP 393216:21/DRLxCMo79Pq/dPIDnU+m2ffHTr/YiWFu/BAwO0qvS5vd0QVoNJ6LnNF:2BrCMUYPI7s23HTUiuuhbqvGvdzoNkLN
TLSH
T1E92733F1FB53A989CCBDA3748AEC84319AE23451F00BD947316FBAA438176527F1E152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_config_py3.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\cv2\load_config_py3.py
Size 253B
SHA256 074dfaf20ac94f2ca3815393de3a394944470334c51a85b9521f452e0e17bb85
MD5 39b5b0b9ffe1c35c95bbee8a325fbd1e
SHA1 217417fd40e92b47faff557c03542e5137424872
SHA512 1b1e8bff9e749633c00627a6006fadafd53d78bad1b5796f9c5fdb38155da5aeef2e0ddc9589431c43a8f61c16808cd781cea92f42073defd05bda3dc18ceb20
TLSH
T13DD0A7105D4D1D3400E5C27C0B2DF8B2D3EBA1423F01E14BFE5C87D22F94A14C381A94
MD5 SHA1 SHA512 TLSH

Submit Download

version.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\cv2\version.py
Size 96B
SHA256 fc17efee9203c23cac641981068621e80d3b0bbabe459f4133c9b2b4d91957fb
MD5 e6e8c06803795d74d3e45bf58daa003d
SHA1 41ff46af73f32d3b3936ceb831864c17fde1b14e
SHA512 b8cd9a4d52e707917cf0aeba941fb272b3dfb27924b62c5cd488252c69a0c6137e67eed0297e88a31728cc1dd90f8a475ea92a6ba105c1fa7fdf05ca406797ec
TLSH
T1E2B0123E894050B028340E06C880F50382A01890E14F6570E10B1842F19730C55A102C
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\libcrypto-3.dll
Size 1.6MB
SHA256 7da0afc1bc917a912fd157e5d2396123f7b6be92edfdbff050ef71774a8ad2c9
MD5 aa0ece3a738602200958501731e38b9a
SHA1 2c37ed52867559d4b4733f720fe51b5700485cf4
SHA512 f294e29aa2b7bed5da7946fcb61b3980643b9570ec95a709345154f02c2d6f276a7a509e047c984179a67e53a62c42022727bf67e2c932c99358bbbd0ed8a6dd
SSDEEP 49152:XFIijQckstNJGIJNfmrYtc1CPwDvt3uFlDC0:XljisZdN7tc1CPwDvt3uFlDC0
TLSH
T15575236025BFB84BF6DAA4788F34886789294732F348EEB36D79891C0C14F0E59B15DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\libffi-8.dll
Size 29KB
SHA256 ced71befa72b674586413bdf9db7d93eb734e7ed28fbe5cc66b505f729442c46
MD5 fd7d7aaa1e2f055b6c76ca37198ce8e8
SHA1 b30272b20e284612d94e089451593e2a3ccd61d1
SHA512 fe88cb5ea43bc583b851c6c3216edd715804ecb7bb77d01e654110dc3a3eaec60fd51299de9fc70cc8b20a79ac87fe2d200715149a3d04d469564a8626feee08
SSDEEP 768:gp/6aepjG56w24Up3p45YiSyvkIPxWEqG:yA154spK7SytPxF
TLSH
T130D2CFB34521BC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\libssl-3.dll
Size 223KB
SHA256 67b5c42d9df7102dab4064f8dc94684493e2efd1ad295e22c23a21802fa65adf
MD5 243a4f88b461b5ff73f2e2dee3960745
SHA1 39f3a9b1d4e0d6ac027c0c8182bbef010e9fe00e
SHA512 0ded0491e6b778fece5b02fb3e5a41de8a95bf6d47c9f5916415c34555a4615f240a6df069d31b8b5efd7eed5a86ec4f7344a2743c02e2b505a342d3ef187f03
SSDEEP 6144:BR9QsJP5yKVAiWHW11DcPpyOTx4GLHxt2eye3gdtJ/v:+sJckA5HWeN1LHxtQ
TLSH
T18F24F184312F5537C963AEB0CBB0E2C5D76CB7039B00EE16BA83D91479A1B4CA37C656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libscipy_openblas64_-327b2e0bcffce2882e0dc04cdeb4eaa6.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\numpy.libs\libscipy_openblas64_-327b2e0bcffce2882e0dc04cdeb4eaa6.dll
Size 3.7MB
SHA256 368c031ad77901e6657c2d7daa157be55b0109cf26b3f9e36f96cd20f9fa89a6
MD5 627ce5e85771be7606817d5ec8cf84f7
SHA1 28ccbf93b5fb4b708a99ee316d1600d04fd693bd
SHA512 4dae06a74a7cc462dd6fd5d6ed94dba4f51b7e49431c14e05658e0f349c10863757145946b5b22b6ad973323d404ba26aff07d16cc9be23a101b47914fedacf1
SSDEEP 98304:0HuJQSQOVyVbOvyQEaAjHSe66NwmgybdauLd1:IuJnQO2bNQR+1mmXbPLd
TLSH
T157060197A8F37A0C850ED8D89C04F039778AC5D4E4FFD1CA7B4585EA9480EDA33A5DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiarray_umath.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\numpy\_core\_multiarray_umath.cp313-win_amd64.pyd
Size 946KB
SHA256 ee6bb28fecffe537e81cf503bae1d10709cbeaa9f82d6ed77e71845e30977892
MD5 f89f6e2d71e8389dd1e82e9ca9db599f
SHA1 8fb6622b4f90aee33fe849fcfbfbe159e6ea5639
SHA512 83842bcf23fff17daac5f7367ed50e941803a86bbbab8af673098990888d5e225e49cce673769d01c02ca49bba094dbae9cfe4e7e0949dd06a9d96883bb54294
SSDEEP 24576:1rA7oc8vLtKWYz5j/jN4rNWTn2+UaSiEfoUDry:1rA7oVQVzjgonPGiEfoUHy
TLSH
T14D2533F2508FF8E0F9FC0CBE95076C8C8873760725291A59BF719F07A2926653F9A905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_umath_linalg.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\numpy\linalg\_umath_linalg.cp313-win_amd64.pyd
Size 39KB
SHA256 15fa125136ed7b5c950c0de82064776f4fbe04b5ad3ddac5dd4647254f242e48
MD5 bbbb9c5048b4f4f805903603dc412bb6
SHA1 47267cba0e35421ebfebb911f62b915be13e973c
SHA512 7c7e0ff8b31c08b358e34c764e48c241a756e58a8821e3d38e25f2f473ae1f26c5c65742bc2342e04c1aaa5a5d135aca6e1d57bb45cae66359525944629e75a3
SSDEEP 768:aMt3dgjlPEifTWUexVLpY2fRJKH3hVgr969wexMd9CbzfR+pJxz:aMtNKY9fprf3b6G/9CbDREx
TLSH
T1F503E1A713A2567CC0BB68F11A89448C7D233926871103EF94DD383CC9BFB855F68752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\python3.DLL
Size 70KB
SHA256 cbc4876275178244905ee45a9ee6ec9fa4bfb9aad6209a03b756d38a186f80d1
MD5 2862d7a3de70a60be154aa7590cfeef5
SHA1 74cee0f36417a8f2ec213c8f0c755a40bbb8a051
SHA512 3fe520a0928b2af4a20e73a7943059573f965eff3ac59f6f03f5a2c4761301dc0ff42c7f87baccb2eaca2ea3bb83d84d81a1e0f0e04a5a2d2a4745b4b30ab7cd
SSDEEP 1536:FotssyKcunV8Po1IIy0Sy7NsR9QWfILQB:+tssyKf1IIy0jXi
TLSH
T1AE634CC25B5BF8A2D6F665FC78DDD9CE242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\python313.dll
Size 1.8MB
SHA256 bc3a80483e1108aa96321311b7bacf576eb3a4155a179dc5ff531f14ba1cf034
MD5 ff8c1ad614bec9f8568e3b1f51a8d3d6
SHA1 1d46d454b4abd07e2bfde0ac6d369a77a66197a9
SHA512 52fead9fb17a6d8ab73e6acaa67bde308a667b59de65b90eb25f34c0e3ec0de6f5b4329d4e17094dc5aa20054d768538fdce15a493a85467bc319494ba6baf52
SSDEEP 49152:yXoWHCMeleTI6q/QnbczucggZfeaJ7PiuXmlcLFEXpEHZgLlA:koJQsrwozuZgZfd7qu3LFEXeEq
TLSH
T10D853331F929E8D3C9EA29754584E40B3C6D0390A4BF67EEA178D1D614AFE314A3F64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\select.pyd
Size 27KB
SHA256 246ec5551d090526e5b53f20a941f64303bbe70357f90dc0e1f70a9cbb79cee9
MD5 5777402302d0c6c7f701772ed80e82c2
SHA1 0f00a5a267396cbb1c531319a96c825ec1d98cbd
SHA512 969f2b5de1d1af9c60b918fbca8c86167c98b1f1a92032d7b834d8432ab43c86bd87fe053524246759b55a8d5033e01f8913b9e3289d5502a559a52b0c367f92
SSDEEP 768:RoqXNA8H+C/pnLuII9GDhhy5RNLaRYT2Ip4MfTxf1ml6Z+7UbFgGHl:RoqXNA8H+CRLuII9GDPy7NsR9GfILEzl
TLSH
T1FBD29EC6897DD116EA53AE7152E4D982FD38B7D35455C72B30AA62E60E233D0931233E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008fc2\unicodedata.pyd
Size 262KB
SHA256 77d94fd7976d4fa8a05d1a8ed527bf5b1d0adbdbec267ef75c308d7a77032790
MD5 f4dfef3d4c91229f8e49c85e4e54eded
SHA1 ef876886a6f495c4f5856b53a737ace9004a56dd
SHA512 30fbca61fa47689cc177442de62c91a8dac3e500bbccbbb791a3cfac45e8e1012f2bf943a94a7fb2af18255c51044a315b474bcc0af30a7e963282c3667133a2
SSDEEP 6144:RQmJ676Si5jL61y9mgzzQ65sPdlhNQJFUy1k/bsmJvS:RQESi5jLk406OPlNQJFUEk/bsCvS
TLSH
T1504423F6CB1AD22CF6D3B9776B93C442B832F396081DD079105A515819A37E2A79B33C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gb2312.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cf82\_tcl_data\encoding\gb2312.enc
Size 84KB
SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
MD5 c5aa0d11439e0f7682dae39445f5dab4
SHA1 73a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA512 eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5
SSDEEP 768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
TLSH
T1F383286043498EC0D70811DBE0EB7B923AFEBC7297C4D4A052F6CB859A3745D684F6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cf82\numpy-2.5.2.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cf82\pygame\freetype.dll
Size 292KB
SHA256 4dd9fa4f578f522eda55f230aa14933d8cf4f649c3c80a593e38d482def8912c
MD5 3683ff9502c8cd3e20248e75681e41a0
SHA1 6ee416aa56ea23a86d40b5e37e4c5f65ebd8905b
SHA512 3b02852992750277d3c92c890a4c7de41a2c774ef1864576755f0a5c4319c95c5fb64ac20b95f891f48941f962084c7698a76c5d37866b54364f123e97676095
SSDEEP 6144:J5wIPaqdQZ+70NVT0VIFjRnQhfBNN5mO40AV1LP330sXbNq61H1DSxLekY:JjaqdQc0NuVO9QhfP54d33zXbJH1A
TLSH
T19D5412CAF250787CDE6130F32CC59644B99F6C6345B74FBBEB8042B9946E4A91C643E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjpeg-9.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cf82\pygame\libjpeg-9.dll
Size 108KB
SHA256 dc0c048646622f0211dd5f5cec22e9d2c5dfc73ffe837b84b4042011fde86845
MD5 7b106a16d47feba739ebb630a140db1a
SHA1 496956bd613e822051365770c370580ec760acc4
SHA512 292ec38c2c3319042cd19a93b31efd730521fab498f95928b26f3cbe6b326084ff6723a1ce6d9358d4e6a64d6d1ab5875a79f3a5055ee961f124f0eb431de1c2
SSDEEP 1536:ziJrdxZ0YtLe2LbLYA0z23xCEy+w/WdLMJg2CSUKURDF8cYO0Zx0j+rT4:zi0YtLtbUA0ihFy+AWhMFnJCFZU4+r
TLSH
T1B2B302DB23D78E79D66700790E83DDDCF56CE807B624CE4D819E708A86AE9588C53368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libogg-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cf82\pygame\libogg-0.dll
Size 16KB
SHA256 a93df1acdf423c2c9e3820c528f16e41af196565a77cae927bcd5b2aa28081df
MD5 6f9ec7628241076dc69e55906c06a3b4
SHA1 0f05e9dfc61cfd0677bc1ead8d54e8f5e381da66
SHA512 f2583a6b2da1a20859e223451030a2fe74e773673d2566a0b5a1543d8cf41c7dce859d6839f79fe0e4d9fd910d8974a9b78d460cbbf6b2bef3bc9367a56378dc
SSDEEP 384:vghoK4TbDJQJIfIFM82sVyWk9sZa7gJXci2:3KcDJ7IkmkSpsj
TLSH
T13A728D37B269C77CCC76E0B64A6EBA40F3AE2C07F613578E909523B94C621D89530636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopus-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cf82\pygame\libopus-0.dll
Size 181KB
SHA256 67e9d16faa35612ce78d7e9e8632c1ca28ebdfcff0396dd58f55da43956ef9b7
MD5 c96180aaa851e6643439c302323b989a
SHA1 4e5badf2c26931024f71f9646aeb28de370cf543
SHA512 c56d577f990f302a6e41ece417b75b349ae5e4ec8749329afc17d6da4e90e46df3eedbcd11b9046341c9d68d15d9ec7107f1c440419505d5430c5f6c1e8dcb36
SSDEEP 3072:dG9HN4pmg76qkk9yuqK1oibvj/xuAOMEq5neZpy4p27LZ8xR+X0iSiWNv:yKmokoyq7jkAOFqKpp2nKxRriOv
TLSH
T15B0412831B196C3CD1D2097E0FA78D50F1FEE41397274A2A95C70CFB74B63A319A16A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpng16-16.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cf82\pygame\libpng16-16.dll
Size 98KB
SHA256 bcbc22b09905fede587fcd497070d230f28d134e9253d69405ec29f8c861b2c6
MD5 3c1d1a5f726c1e9f692f404749a47841
SHA1 22408b9a852f5971043c706ee6a5f58384ec0a2e
SHA512 48e4741f2301b0b892f859be94efcd31404de0532b043aaa0ad7dd956cb4c6ff40d617011a3db5f4b961c5b2f020de036944f976bd7fb2647fabef6fb91f0edf
SSDEEP 1536:xpwYLwD+3KUFmQr5ChMGyIHxy1S0wrzJIfW9C34fC3qZdBszVLO1p4t7A+wIhHeP:t2+3KUFmSsyZS0wzJ+736dAVL+p4FAr1
TLSH
T189A3F1F7B531BE6BDA1246B108773855807CEE243F73DF63069A50FAFA0298D5212297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cf82\zlib1.dll
Size 52KB
SHA256 12939a66d4b5cd3f58e1199473763068d843863f7876017da12ae75c9f1b629f
MD5 3910910ef3bf560560949f681a7316b5
SHA1 cbcab977af2b6064fc433ab891d6f47ce7a137d7
SHA512 d2c68582d5d08080906f1b63c551b27ea3f803e31030a227c51f5d89e6e6ef563d0478741dc3d5d6404eb97f552904655ec4811ec07094ea7fe76db075484f34
SSDEEP 1536:iYkJirxkBWuSzeIKSPgMYhCmAziPPC5aywO+N/Fh4:i7QduSaXTRAzFoywOkb4
TLSH
T1DA33F18345F17DB6D41BDCB5EC32311469622C33BF135A1E0FA9253B98BDB24E424BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_sctf3uvg.saj.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sctf3uvg.saj.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\is-WRBOCCSZ3N.tmp\vc_redist.x64.exe
Size 17.9MB
SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
MD5 8da7373f3ec287fe1c3ad72a7b2922f0
SHA1 46adcdfbe9aebe767657b7a802cc366f827ced77
SHA512 c42c82cfd5eaa2165b600f6109cb14ff4308cdf4cff656a1375b4a933f1630bfe54c99c4d0fb9ed3bea4dc4e4fdaa3db8e7c58356cca07c2954f4c297757d62d
SSDEEP 393216:rCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrW:rCpQpbQ1tBj1gR0SP53tRvlLpM2K
TLSH
T133173332A4742132F6F16437F968F1307E3CA72863D09D99D3C8AD99396488267F725B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start.bat

Path C:\Users\Admin\AppData\Local\Temp\start.bat
Size 896B
SHA256 757956b7756c497057210b183bc4ff4f1fd58e2708e13a50c4fd76f97966c102
MD5 1493d2145647c9350ae7b2a7b99303d7
SHA1 8eb6fb002946b674f736fa3aa5eafb16d9ed635c
SHA512 eb8da135211d1f3bc1ad8561818a93b816b08c53f3b2747113bbaf9b2b320f27d7b80a2f86d718c2b96e10fc6df09540d5bcd9fb8e163184c7585750e59a9649
TLSH
T173119C505867182B19206006C5001E0ABCDE01FF75EE07E775F0AC6D09D68B9D7BAFAD
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{6175A4A0-E441-4BD3-B690-82878AC58CE6}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{6175A4A0-E441-4BD3-B690-82878AC58CE6}\.be\VC_redist.x64.exe
Size 615KB
SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
MD5 2de7a2a87f61fd6ead5276047feaf36c
SHA1 d9a03aa94dfb0f485a9fd281d89d2edd499408f7
SHA512 ea8dac8d0cf79b2d8302a4405ba2d44be8dbca316038d90f19bce6d0760685105771e87b1e905ff58e6ee10e154ec9ad6c00fc575dd8c82ea4eed856fb5569ac
SSDEEP 12288:73mgqnIZuYfCYqFet4CovkM7RVYnE2EwCeYG1LM7d:73WnIZuMCxezot7rgd4e2d
TLSH
T1AAD48D32A5614033FBF105B3B928A6303E7CE728275188A9D7D4BD1D7EA84C1A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/920-3845-0x00007FFF542C0000-0x00007FFF542E7000-memory.dmp

Download

memory/920-3849-0x00007FFF54220000-0x00007FFF5423A000-memory.dmp

Download

memory/920-3848-0x00007FFF54240000-0x00007FFF5426B000-memory.dmp

Download

memory/920-3847-0x00007FFF542A0000-0x00007FFF542B9000-memory.dmp

Download

memory/920-3846-0x00007FFF59E80000-0x00007FFF59E8F000-memory.dmp

Download

memory/920-3843-0x00007FF76DA50000-0x00007FF76DABD000-memory.dmp

Download

memory/936-3841-0x00007FF76DA50000-0x00007FF76DABD000-memory.dmp

Download

memory/1248-1344-0x00007FFF480A0000-0x00007FFF480B1000-memory.dmp

Download

memory/1248-1588-0x00007FFF54F60000-0x00007FFF54F6F000-memory.dmp

Download

memory/1248-1288-0x00007FFF40B30000-0x00007FFF41063000-memory.dmp

Download

memory/1248-1280-0x00007FFF3EE20000-0x00007FFF40200000-memory.dmp

Download

memory/1248-1279-0x00007FFF54250000-0x00007FFF54266000-memory.dmp

Download

memory/1248-1275-0x00007FFF40200000-0x00007FFF405D9000-memory.dmp

Download

memory/1248-1274-0x00007FFF54F60000-0x00007FFF54F6F000-memory.dmp

Download

memory/1248-1291-0x00007FFF54210000-0x00007FFF54243000-memory.dmp

Download

memory/1248-1209-0x00007FFF41070000-0x00007FFF416DC000-memory.dmp

Download

memory/1248-1300-0x00007FFF49CA0000-0x00007FFF49D6E000-memory.dmp

Download

memory/1248-1311-0x00007FFF408A0000-0x00007FFF40B2F000-memory.dmp

Download

memory/1248-1312-0x00007FFF405E0000-0x00007FFF40896000-memory.dmp

Download

memory/1248-1317-0x00007FFF41070000-0x00007FFF416DC000-memory.dmp

Download

memory/1248-1348-0x00007FFF4D360000-0x00007FFF4D399000-memory.dmp

Download

memory/1248-1333-0x00007FFF48360000-0x00007FFF48414000-memory.dmp

Download

memory/1248-1335-0x00007FFF3EE20000-0x00007FFF40200000-memory.dmp

Download

memory/1248-1346-0x00007FFF48080000-0x00007FFF4809C000-memory.dmp

Download

memory/1248-1345-0x00007FFF532A0000-0x00007FFF532AE000-memory.dmp

Download

memory/1248-1263-0x00007FFF405E0000-0x00007FFF40896000-memory.dmp

Download

memory/1248-1343-0x00007FFF537C0000-0x00007FFF537CC000-memory.dmp

Download

memory/1248-1337-0x00007FFF315F0000-0x00007FFF36948000-memory.dmp

Download

memory/1248-1341-0x00007FFF49C80000-0x00007FFF49C95000-memory.dmp

Download

memory/1248-1340-0x00007FFF4A7A0000-0x00007FFF4A7B6000-memory.dmp

Download

memory/1248-1339-0x00007FFF3E790000-0x00007FFF3EA08000-memory.dmp

Download

memory/1248-1338-0x00007FFF52660000-0x00007FFF52672000-memory.dmp

Download

memory/1248-1334-0x00007FFF40200000-0x00007FFF405D9000-memory.dmp

Download

memory/1248-1347-0x00007FFF48060000-0x00007FFF48075000-memory.dmp

Download

memory/1248-1342-0x00007FFF541A0000-0x00007FFF541AF000-memory.dmp

Download

memory/1248-1316-0x00007FF6EDB50000-0x00007FF6EDBBD000-memory.dmp

Download

memory/1248-1217-0x00007FFF542E0000-0x00007FFF54307000-memory.dmp

Download

memory/1248-1269-0x00007FFF48360000-0x00007FFF48414000-memory.dmp

Download

memory/1248-1266-0x00007FFF4D360000-0x00007FFF4D399000-memory.dmp

Download

memory/1248-1219-0x00007FFF59E80000-0x00007FFF59E8F000-memory.dmp

Download

memory/1248-1262-0x00007FFF54270000-0x00007FFF5428A000-memory.dmp

Download

memory/1248-1259-0x00007FFF408A0000-0x00007FFF40B2F000-memory.dmp

Download

memory/1248-1223-0x00007FFF542C0000-0x00007FFF542D9000-memory.dmp

Download

memory/1248-1231-0x00007FFF55140000-0x00007FFF5514D000-memory.dmp

Download

memory/1248-1412-0x00007FFF41070000-0x00007FFF416DC000-memory.dmp

Download

memory/1248-1432-0x00007FFF315F0000-0x00007FFF36948000-memory.dmp

Download

memory/1248-1225-0x00007FFF54290000-0x00007FFF542BB000-memory.dmp

Download

memory/1248-1228-0x00007FFF54270000-0x00007FFF5428A000-memory.dmp

Download

memory/1248-1603-0x00007FFF4D360000-0x00007FFF4D399000-memory.dmp

Download

memory/1248-1620-0x00007FFF4D330000-0x00007FFF4D352000-memory.dmp

Download

memory/1248-1600-0x00007FFF405E0000-0x00007FFF40896000-memory.dmp

Download

memory/1248-1604-0x00007FFF48360000-0x00007FFF48414000-memory.dmp

Download

memory/1248-1595-0x00007FFF49CA0000-0x00007FFF49D6E000-memory.dmp

Download

memory/1248-1593-0x00007FFF54210000-0x00007FFF54243000-memory.dmp

Download

memory/1248-1582-0x00007FFF54290000-0x00007FFF542BB000-memory.dmp

Download

memory/1248-1589-0x00007FFF54250000-0x00007FFF54266000-memory.dmp

Download

memory/1248-1289-0x00007FFF4D330000-0x00007FFF4D352000-memory.dmp

Download

memory/1248-1587-0x00007FFF550A0000-0x00007FFF550AD000-memory.dmp

Download

memory/1248-1585-0x00007FFF55140000-0x00007FFF5514D000-memory.dmp

Download

memory/1248-1584-0x00007FFF54270000-0x00007FFF5428A000-memory.dmp

Download

memory/1248-1580-0x00007FFF59E80000-0x00007FFF59E8F000-memory.dmp

Download

memory/1248-1578-0x00007FFF542E0000-0x00007FFF54307000-memory.dmp

Download

memory/1248-1252-0x00007FFF542E0000-0x00007FFF54307000-memory.dmp

Download

memory/1248-1570-0x00007FF6EDB50000-0x00007FF6EDBBD000-memory.dmp

Download

memory/1248-1581-0x00007FFF542C0000-0x00007FFF542D9000-memory.dmp

Download

memory/1248-1255-0x00007FFF49CA0000-0x00007FFF49D6E000-memory.dmp

Download

memory/1248-1253-0x00007FFF54210000-0x00007FFF54243000-memory.dmp

Download

memory/1248-1758-0x00007FFF48060000-0x00007FFF48075000-memory.dmp

Download

memory/1248-1609-0x00007FFF3EE20000-0x00007FFF40200000-memory.dmp

Download

memory/1248-1757-0x00007FFF48080000-0x00007FFF4809C000-memory.dmp

Download

memory/1248-1756-0x00007FFF532A0000-0x00007FFF532AE000-memory.dmp

Download

memory/1248-1755-0x00007FFF480A0000-0x00007FFF480B1000-memory.dmp

Download

memory/1248-1245-0x00007FFF54250000-0x00007FFF54266000-memory.dmp

Download

memory/1248-1754-0x00007FFF537C0000-0x00007FFF537CC000-memory.dmp

Download

memory/1248-1753-0x00007FFF541A0000-0x00007FFF541AF000-memory.dmp

Download

memory/1248-1752-0x00007FFF49C80000-0x00007FFF49C95000-memory.dmp

Download

memory/1248-1750-0x00007FFF4A7A0000-0x00007FFF4A7B6000-memory.dmp

Download

memory/1248-1748-0x00007FFF3E790000-0x00007FFF3EA08000-memory.dmp

Download

memory/1248-1746-0x00007FFF52660000-0x00007FFF52672000-memory.dmp

Download

memory/1248-1606-0x00007FFF40200000-0x00007FFF405D9000-memory.dmp

Download

memory/1248-1621-0x00007FFF315F0000-0x00007FFF36948000-memory.dmp

Download

memory/1248-1597-0x00007FFF408A0000-0x00007FFF40B2F000-memory.dmp

Download

memory/1248-1590-0x00007FFF40B30000-0x00007FFF41063000-memory.dmp

Download

memory/1248-1572-0x00007FFF41070000-0x00007FFF416DC000-memory.dmp

Download

memory/1248-1244-0x00007FF6EDB50000-0x00007FF6EDBBD000-memory.dmp

Download

memory/1248-1236-0x00007FFF550A0000-0x00007FFF550AD000-memory.dmp

Download

memory/1248-1247-0x00007FFF41070000-0x00007FFF416DC000-memory.dmp

Download

memory/1248-1241-0x00007FFF54F60000-0x00007FFF54F6F000-memory.dmp

Download

memory/1248-1248-0x00007FFF40B30000-0x00007FFF41063000-memory.dmp

Download

memory/2300-1235-0x00007FF6EDB50000-0x00007FF6EDBBD000-memory.dmp

Download

memory/2300-3616-0x00007FF6EDB50000-0x00007FF6EDBBD000-memory.dmp

Download

memory/2300-23-0x00007FF6EDB50000-0x00007FF6EDBBD000-memory.dmp

Download

memory/2300-3482-0x00007FF6EDB50000-0x00007FF6EDBBD000-memory.dmp

Download

memory/3320-3840-0x00007FF76DA50000-0x00007FF76DABD000-memory.dmp

Download

memory/3348-1366-0x0000000000450000-0x0000000000531000-memory.dmp

Download

memory/3348-1294-0x0000000000450000-0x0000000000531000-memory.dmp

Download

memory/3580-1408-0x000001F534580000-0x000001F534632000-memory.dmp

Download

memory/4716-1399-0x00000000008C0000-0x0000000000DAF000-memory.dmp

Download

memory/4716-3842-0x00000000008C0000-0x0000000000DAF000-memory.dmp

Download

memory/4716-2156-0x00000000008C0000-0x0000000000DAF000-memory.dmp

Download

memory/5200-1351-0x0000021D68680000-0x0000021D68732000-memory.dmp

Download

memory/5260-19-0x00000202DA690000-0x00000202DA69A000-memory.dmp

Download

memory/5260-18-0x00000202F2BC0000-0x00000202F2C72000-memory.dmp

Download

memory/5260-17-0x00000202F2BA0000-0x00000202F2BBE000-memory.dmp

Download

memory/5260-14-0x00000202DA620000-0x00000202DA642000-memory.dmp

Download