kutaki | hxxp://eekifoods[.]in/pejsb

Analysis

max time kernel
90s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2023 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://eekifoods.in/pejsb

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://treysbeatend.com/laptop/squared.php

http://terebinnahicc.club/sec/kool.txt

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Drops startup file 4 IoCs

Processes:

Invoice No 47302.batInvoice No 47302.bat

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qxbyyafk.exe	Invoice No 47302.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qxbyyafk.exe	Invoice No 47302.bat
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\silyglfk.exe	Invoice No 47302.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\silyglfk.exe	Invoice No 47302.bat

Executes dropped EXE 2 IoCs

Processes:

qxbyyafk.exesilyglfk.exe

pid process

4536 qxbyyafk.exe
3024 silyglfk.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4536	qxbyyafk.exe
3024	silyglfk.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2440 taskkill.exe
Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings msedge.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

3416 msedge.exe
3416 msedge.exe
220 msedge.exe
220 msedge.exe
3356 identity_helper.exe
3356 identity_helper.exe
3884 msedge.exe
3884 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

220 msedge.exe
220 msedge.exe
220 msedge.exe
220 msedge.exe
220 msedge.exe
220 msedge.exe
220 msedge.exe
220 msedge.exe
220 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2440 taskkill.exe

pid	process
2440	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings	msedge.exe

pid	process
3416	msedge.exe
3416	msedge.exe
220	msedge.exe
220	msedge.exe
3356	identity_helper.exe
3356	identity_helper.exe
3884	msedge.exe
3884	msedge.exe

description	pid	process
Token: SeDebugPrivilege	2440	taskkill.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

Invoice No 47302.batqxbyyafk.exeInvoice No 47302.batsilyglfk.exe

pid	process
1244	Invoice No 47302.bat
1244	Invoice No 47302.bat
1244	Invoice No 47302.bat
4536	qxbyyafk.exe
4536	qxbyyafk.exe
4536	qxbyyafk.exe
5020	Invoice No 47302.bat
5020	Invoice No 47302.bat
5020	Invoice No 47302.bat
3024	silyglfk.exe
3024	silyglfk.exe
3024	silyglfk.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 220 wrote to memory of 100	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 100	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4244	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3416	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3416	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 3948	220	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://eekifoods.in/pejsb
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb91ad46f8,0x7ffb91ad4708,0x7ffb91ad4718
2⤵
PID:100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
2⤵
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
2⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
2⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
2⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
2⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
2⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
2⤵
PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
2⤵
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
2⤵
PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10186736198702047339,14777282887692207419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
2⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5104

C:\Users\Admin\AppData\Local\Temp\Temp1_Invoice No 47302.zip\Invoice No 47302.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_Invoice No 47302.zip\Invoice No 47302.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:1244

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
2⤵
PID:3020

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qxbyyafk.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qxbyyafk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4536

C:\Users\Admin\Downloads\Invoice No 47302\Invoice No 47302.bat
"C:\Users\Admin\Downloads\Invoice No 47302\Invoice No 47302.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:5020

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
2⤵
PID:2832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im qxbyyafk.exe /f
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\silyglfk.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\silyglfk.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3024

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Invoice No 47302\Invoice No 47302.bat
1⤵
PID:3796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Invoice No 47302\Invoice No 47302.bat"
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
295B

MD5
fae30c81fadd15a3eec575ada7c6e665

SHA1
327c8e6d1fbec613a7ba9a195c3e366c7a4b6279

SHA256
44073da61d6a65b02aada63c502a2cb8eed70d4aa24af60defd835b944db9b24

SHA512
3d24feaea9d51409d382ee1c115e4a1cbb28851cb8d058bb5ecd56fca1c977ed0ba7025c8f114c45846185b6c2e51bbf9edd12372f6eba363e1a5e74cfe08a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
fb1952c4096d130a64522ea616eb12bc

SHA1
2388f26bec2262d22921be3913986522d218b490

SHA256
77a8e8ae131688f05dfa564737888cc20e4159dd85c073f04b2280c349e2dab9

SHA512
f5859693d0f1d8718184af4eea58feae56d8ccc4d0bfb11fb1ae4d8d528f2b523da5e55ae9933d88e7ee64e78e0982b08afd1689756cb50310d1fabdb186f4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ca5297c4be61b665e7fcd2166e21dc25

SHA1
4323a10630ad4b02c304bb08c25fbf150d0abe19

SHA256
ed704f4e2a7fe010768bbc734274c58af0b747975ae1e8b03c85bc49dfb2aff2

SHA512
6fb1e57548c7558f94b20df374b023d55649fff0ed85ceb837ea36486aee773acf74d60caf9035aa30a6fd02a932d5e544b803010b5bae33d443979b2f6facdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
4KB

MD5
fc8cbb3c94673433825bc2c2b5832ff5

SHA1
3fa4e041b1a9b540b0054373c46afadb680c5123

SHA256
b053df9cbf50b93a8b819cd014f1b24c74d90857b5cce42e460374efb7298431

SHA512
1c532339ea3cfeeb29e92c133fa656da9a6ed10b837e767c85f6ffaf72c7d914e320cecbc6e7e65dee2593b4e6db37a000a9c48ce4185bfa455ce5661313cdda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
4KB

MD5
59c77ab9f09653aed0de523fd503030a

SHA1
23f62d4c808dd058055a4cf55d889ca376f42499

SHA256
3ea3d00502af607d5be5b8b69c4b111203b58d1415f5dcc5843d9be94b8edb18

SHA512
6242b92715c0d14960ec10bb8019997489e185b3817711f32a1031007ba18c9f4d57323f0c90fcb53e61a6903ef962d720af1a2875275563f09a7a62d0a91ad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
5KB

MD5
291f8227afc3c819e75a5a409a71375d

SHA1
84025dd0b483bd955d1a70239825451a3dd2eb9d

SHA256
0837263ed040b18db64d6f72026eb46dbc1218843646d5a7db98290bce792a24

SHA512
fd2968bba7cd2102237e3a996ef21dcb841cbca17db918ea23f9c120ef6021aec82fa3070e85f0542ef7c0632c75a1179e2b0ad5fc99f4d4e5699496b95b7db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
4KB

MD5
2fc4db04487e3c1bc7ef091221f73b21

SHA1
dba6a9446e00fa92f48f0a06cd00de499008f9cd

SHA256
a77bc93ba7be67fb797a98955e9cfacbb0207c701b64ccb571a886fa1745ce07

SHA512
d4a70b6f6aa85c3cfc2ee8a5e0011b4630751a41de06bc26f83ea0e49634f86ecdf0d53ac558658e4472ac59a4b7eb0a11a7193d2100d98ffc2125475d41b896

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qxbyyafk.exe
Filesize
2.3MB

MD5
f9678cfee8af60c33d0eaa8255f88a30

SHA1
c99cd87bb5cdd3d0f421cd39d994219490831489

SHA256
986ba2daea2ba5a4db9d9115aeeea049ce4debd4f44214df1433dd7ce5753116

SHA512
6ad4d78a70ada8ba61b6b64689378d57d9db658cbf955c1b9cc12ca4984ff9b02cd69c78fb5399b92859e46306fe018c6f7dee068375f99af63bb24d8c923682

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qxbyyafk.exe
Filesize
2.3MB

MD5
f9678cfee8af60c33d0eaa8255f88a30

SHA1
c99cd87bb5cdd3d0f421cd39d994219490831489

SHA256
986ba2daea2ba5a4db9d9115aeeea049ce4debd4f44214df1433dd7ce5753116

SHA512
6ad4d78a70ada8ba61b6b64689378d57d9db658cbf955c1b9cc12ca4984ff9b02cd69c78fb5399b92859e46306fe018c6f7dee068375f99af63bb24d8c923682

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\silyglfk.exe
Filesize
2.3MB

MD5
f9678cfee8af60c33d0eaa8255f88a30

SHA1
c99cd87bb5cdd3d0f421cd39d994219490831489

SHA256
986ba2daea2ba5a4db9d9115aeeea049ce4debd4f44214df1433dd7ce5753116

SHA512
6ad4d78a70ada8ba61b6b64689378d57d9db658cbf955c1b9cc12ca4984ff9b02cd69c78fb5399b92859e46306fe018c6f7dee068375f99af63bb24d8c923682

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\silyglfk.exe
Filesize
2.3MB

MD5
f9678cfee8af60c33d0eaa8255f88a30

SHA1
c99cd87bb5cdd3d0f421cd39d994219490831489

SHA256
986ba2daea2ba5a4db9d9115aeeea049ce4debd4f44214df1433dd7ce5753116

SHA512
6ad4d78a70ada8ba61b6b64689378d57d9db658cbf955c1b9cc12ca4984ff9b02cd69c78fb5399b92859e46306fe018c6f7dee068375f99af63bb24d8c923682

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\silyglfk.exe
Filesize
2.3MB

MD5
f9678cfee8af60c33d0eaa8255f88a30

SHA1
c99cd87bb5cdd3d0f421cd39d994219490831489

SHA256
986ba2daea2ba5a4db9d9115aeeea049ce4debd4f44214df1433dd7ce5753116

SHA512
6ad4d78a70ada8ba61b6b64689378d57d9db658cbf955c1b9cc12ca4984ff9b02cd69c78fb5399b92859e46306fe018c6f7dee068375f99af63bb24d8c923682

Download Submit
C:\Users\Admin\Downloads\Invoice No 47302.zip
Filesize
2.1MB

MD5
629944cf6e363cf2f8779f3fd5fdbb7e

SHA1
20a6021e73c1609208870489a082446a83f3ec90

SHA256
d1fc13fbc2dad20a7eb9aac7d8d39c810aa52d7bab6b59371357f55cb38047d7

SHA512
b0c7bbcc1269b7953fafc7314bf565aa978bc1213417e18cd5a8f7652433e11fd6fcb74a5192bc10bb0763581d06e00839849c78cc3ea2f7679720132d82e8b5

Download Submit
\??\pipe\LOCAL\crashpad_220_WQTDDUCLUEAOTAVP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit