redline | c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b

Analysis

max time kernel
151s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe
Size

957KB
MD5

399c70db942fdc350774c4350e08697f
SHA1

f6e9499be20257ffab465b1e9a65bffd9ab88165
SHA256

c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b
SHA512

b7a480acddaa39e5d471450a819059119d21c940174e396bcfc9dd6937815aa8bd3cb879efae43814acc90001aea9ea86ddb36efaa4a06397556f2c1942c02d6
SSDEEP

12288:Xbc1xo2dAKlpItf+BV3XHSlHYBPHJqXbmxoRj3cQpRnRu9cdTXb0:w1u2dAK4tf+BVHHkIoRj3cQDX

Score

10^/10

redline smokeloader grome kinza backdoor paypal infostealer persistence phishing trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1972.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\1972.exe	family_redline
behavioral1/memory/464-61-0x00000000007B0000-0x00000000007EE000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2tk741Kk.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2tk741Kk.exe	family_redline
behavioral1/memory/5692-199-0x0000000000910000-0x000000000094E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 9 IoCs

Processes:

1623.execg6KS6ql.exe1877.exeYh5fj2ug.exe1972.exetk0ss5CM.exevI8rM5LP.exe1Yy98cF7.exe2tk741Kk.exe

pid process

4368 1623.exe
2536 cg6KS6ql.exe
2280 1877.exe
4472 Yh5fj2ug.exe
464 1972.exe
2852 tk0ss5CM.exe
2616 vI8rM5LP.exe
4672 1Yy98cF7.exe
5692 2tk741Kk.exe

pid	process
4368	1623.exe
2536	cg6KS6ql.exe
2280	1877.exe
4472	Yh5fj2ug.exe
464	1972.exe
2852	tk0ss5CM.exe
2616	vI8rM5LP.exe
4672	1Yy98cF7.exe
5692	2tk741Kk.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cg6KS6ql.exeYh5fj2ug.exetk0ss5CM.exevI8rM5LP.exe1623.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	cg6KS6ql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Yh5fj2ug.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	tk0ss5CM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	vI8rM5LP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1623.exe

Detected potential entity reuse from brand paypal.
phishing paypal

Suspicious use of SetThreadContext 2 IoCs

Processes:

c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe1Yy98cF7.exe

description	pid	process	target process
PID 1800 set thread context of 4592	1800	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe	AppLaunch.exe
PID 4672 set thread context of 5852	4672	1Yy98cF7.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5108	1800	WerFault.exe	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe
6048	4672	WerFault.exe	1Yy98cF7.exe
6056	5852	WerFault.exe	AppLaunch.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exe

pid	process
4592	AppLaunch.exe
4592	AppLaunch.exe
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224
3224

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

4592 AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: SeShutdownPrivilege	3224
Token: SeCreatePagefilePrivilege	3224
Token: 33	3532	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3532	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe1623.execg6KS6ql.exeYh5fj2ug.exetk0ss5CM.execmd.exevI8rM5LP.exemsedge.exemsedge.exe

description	pid	process	target process
PID 1800 wrote to memory of 4936	1800	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe	AppLaunch.exe
PID 1800 wrote to memory of 4936	1800	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe	AppLaunch.exe
PID 1800 wrote to memory of 4936	1800	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe	AppLaunch.exe
PID 1800 wrote to memory of 4592	1800	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe	AppLaunch.exe
PID 1800 wrote to memory of 4592	1800	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe	AppLaunch.exe
PID 1800 wrote to memory of 4592	1800	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe	AppLaunch.exe
PID 1800 wrote to memory of 4592	1800	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe	AppLaunch.exe
PID 1800 wrote to memory of 4592	1800	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe	AppLaunch.exe
PID 1800 wrote to memory of 4592	1800	c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe	AppLaunch.exe
PID 3224 wrote to memory of 4368	3224		1623.exe
PID 3224 wrote to memory of 4368	3224		1623.exe
PID 3224 wrote to memory of 4368	3224		1623.exe
PID 4368 wrote to memory of 2536	4368	1623.exe	cg6KS6ql.exe
PID 4368 wrote to memory of 2536	4368	1623.exe	cg6KS6ql.exe
PID 4368 wrote to memory of 2536	4368	1623.exe	cg6KS6ql.exe
PID 3224 wrote to memory of 1104	3224		cmd.exe
PID 3224 wrote to memory of 1104	3224		cmd.exe
PID 3224 wrote to memory of 2280	3224		1877.exe
PID 3224 wrote to memory of 2280	3224		1877.exe
PID 3224 wrote to memory of 2280	3224		1877.exe
PID 2536 wrote to memory of 4472	2536	cg6KS6ql.exe	Yh5fj2ug.exe
PID 2536 wrote to memory of 4472	2536	cg6KS6ql.exe	Yh5fj2ug.exe
PID 2536 wrote to memory of 4472	2536	cg6KS6ql.exe	Yh5fj2ug.exe
PID 3224 wrote to memory of 464	3224		1972.exe
PID 3224 wrote to memory of 464	3224		1972.exe
PID 3224 wrote to memory of 464	3224		1972.exe
PID 4472 wrote to memory of 2852	4472	Yh5fj2ug.exe	tk0ss5CM.exe
PID 4472 wrote to memory of 2852	4472	Yh5fj2ug.exe	tk0ss5CM.exe
PID 4472 wrote to memory of 2852	4472	Yh5fj2ug.exe	tk0ss5CM.exe
PID 2852 wrote to memory of 2616	2852	tk0ss5CM.exe	vI8rM5LP.exe
PID 2852 wrote to memory of 2616	2852	tk0ss5CM.exe	vI8rM5LP.exe
PID 2852 wrote to memory of 2616	2852	tk0ss5CM.exe	vI8rM5LP.exe
PID 1104 wrote to memory of 3860	1104	cmd.exe	msedge.exe
PID 1104 wrote to memory of 3860	1104	cmd.exe	msedge.exe
PID 2616 wrote to memory of 4672	2616	vI8rM5LP.exe	1Yy98cF7.exe
PID 2616 wrote to memory of 4672	2616	vI8rM5LP.exe	1Yy98cF7.exe
PID 2616 wrote to memory of 4672	2616	vI8rM5LP.exe	1Yy98cF7.exe
PID 3860 wrote to memory of 1456	3860	msedge.exe	msedge.exe
PID 3860 wrote to memory of 1456	3860	msedge.exe	msedge.exe
PID 1104 wrote to memory of 1340	1104	cmd.exe	msedge.exe
PID 1104 wrote to memory of 1340	1104	cmd.exe	msedge.exe
PID 1340 wrote to memory of 4328	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 4328	1340	msedge.exe	msedge.exe
PID 1104 wrote to memory of 3852	1104	cmd.exe	msedge.exe
PID 1104 wrote to memory of 3852	1104	cmd.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 3076	1340	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe
"C:\Users\Admin\AppData\Local\Temp\c38a33d08840e23aef88d6a9b5c00bed49aea5681c6cf29d293d2b2be2b7469b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:4936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 308
2⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1800 -ip 1800
1⤵
PID:4456

C:\Users\Admin\AppData\Local\Temp\1623.exe
C:\Users\Admin\AppData\Local\Temp\1623.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4368

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cg6KS6ql.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cg6KS6ql.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2536

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yh5fj2ug.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yh5fj2ug.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4472

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tk0ss5CM.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tk0ss5CM.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2852

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\vI8rM5LP.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\vI8rM5LP.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2616

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Yy98cF7.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Yy98cF7.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:5792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 176
8⤵
- Program crash
PID:6056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 604
7⤵
- Program crash
PID:6048

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2tk741Kk.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2tk741Kk.exe
6⤵
- Executes dropped EXE
PID:5692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\177C.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
2⤵
- Suspicious use of WriteProcessMemory
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb959046f8,0x7ffb95904708,0x7ffb95904718
3⤵
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,10647313924359738547,10448910609935622640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
3⤵
PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,10647313924359738547,10448910609935622640,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
3⤵
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb959046f8,0x7ffb95904708,0x7ffb95904718
3⤵
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
3⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
3⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
3⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
3⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
3⤵
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
3⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
3⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
3⤵
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
3⤵
PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
3⤵
PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
3⤵
PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
3⤵
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
3⤵
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
3⤵
PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
3⤵
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6684 /prefetch:8
3⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1904 /prefetch:8
3⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9192 /prefetch:1
3⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9208 /prefetch:1
3⤵
PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9348 /prefetch:1
3⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
3⤵
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9744 /prefetch:8
3⤵
PID:6652

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9744 /prefetch:8
3⤵
PID:6664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4654734198154512732,13866834373087709310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
3⤵
PID:6152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
2⤵
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
2⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffb959046f8,0x7ffb95904708,0x7ffb95904718
3⤵
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
2⤵
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb959046f8,0x7ffb95904708,0x7ffb95904718
3⤵
PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
2⤵
PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb959046f8,0x7ffb95904708,0x7ffb95904718
3⤵
PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
2⤵
PID:5592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb959046f8,0x7ffb95904708,0x7ffb95904718
3⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
2⤵
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb959046f8,0x7ffb95904708,0x7ffb95904718
3⤵
PID:5784

C:\Users\Admin\AppData\Local\Temp\1877.exe
C:\Users\Admin\AppData\Local\Temp\1877.exe
1⤵
- Executes dropped EXE
PID:2280

C:\Users\Admin\AppData\Local\Temp\1972.exe
C:\Users\Admin\AppData\Local\Temp\1972.exe
1⤵
- Executes dropped EXE
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb959046f8,0x7ffb95904708,0x7ffb95904718
1⤵
PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4672 -ip 4672
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5852 -ip 5852
1⤵
PID:5944

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f4 0x410
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
df4fb359f7b2fa8af30bf98045c57c44

SHA1
6d507359e1fd5be8f7c01fd4b291f81cf9561378

SHA256
5ff7efcd90db74ff5a6fa467ba741889306ce510b95db8ebd3d5d292dfe587cc

SHA512
92195f5fe36acb84ce5aeedf8654c2ec1d71ebde1e04a5dbce11df2831c3e085c0cd7132ed2c4bddcc3fd1e546c06021dbe5b7364e86054e6cbd6806e7be0463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
03771d3b4243000d00d0dda21128077e

SHA1
215febb82bf3949c12988e68ab93979a5f2dce05

SHA256
5b7b0c78f54909e18c908c4d45a8a2a8b0f56aa7dc7eac933de0f1a571d47070

SHA512
81f6800b1f746f6ea68947cc1f37474bfd25cd8410a4a45a980a6a392f9bac8d1b5f79be0aada46f7ba8a5c9049103f7deead9e7bbc2f0b78c76a35073ecd594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
576B

MD5
ba75b05e310a1b0b9559953f34a1c299

SHA1
14d6d71b2245197b3a47642c89cb40b844806503

SHA256
17d1b0b48a979e980535cdd63785be33d0af59cf6ed6b33bf54efe6b0fb50143

SHA512
35bf968da60e636fa72f9991f92d76126756d9ba7c457b0fd79b64a599f4f4f0fe15be52d6b176eaa54468587d85c4bb422e30a00f143ff93c0642063a70dc5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
098ed7a529ccd1b782b935e39fa0abaf

SHA1
02703801713e727785131fed114c9021ac3609ae

SHA256
aace98d164586386862504f16e45fdc063b9f1972b160f795528bf2529a60398

SHA512
a82768d35a574a71653bdfe0c685049771a7f2148d2e9a7857ea9ee08a24e20122806fadec825507ad9f3bda198464a6ab6f7e76667d45f51c68aa91bd34cd11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
689d8dcfca2c6b5d80111efa6152dd4d

SHA1
d5f9a0f5b114946d03ba0b8ac3322289929f7679

SHA256
2f47e55dd2aacf2a3d8bed5f830fde6b51b7d0d6e9580840ad14b04a475151c1

SHA512
aa656e29ddd643ea81bae126e7b0a35e983fa5d5f2fe7b465e7b21bfbad64f80459d4328527dcee98f9d2a41894547dfde59de55d2b360a21ea4908478cb554d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
564f4200d52674d36004df304fa55490

SHA1
8939f1cd026c618234aa839b730f2d285807d520

SHA256
cfc5ef76be9052f9e8d47d0ed633bdb30464333fc8f6327a5fb1b5e64fcfea7f

SHA512
d425bb0f836ee21e90bcf134c10e59d9071c4146a2ac2f885d80eb5f61438fbbc565b2558306a45b4b2db220a45fd7e0c4d5d0825510b2f0df9712679afac4ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
de0ffecb13d7253485efe1d1d6a1b586

SHA1
353779bfea1f8773d7cb855b605d1037f140e945

SHA256
547b755ba314ab6ed6fba8da55419461c091b92bc62a8bf5359fb8a7763a1760

SHA512
2c18f26cb50bba005c68a0eaceb16c4cee7f3eb28f4c66a843251033d32007b58b314642b15631c46cedc6f45cbaff0c9aa25b2e303b8674e6d2edc4b932d0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
7ee78aef18f91a51737deb9b9afcaabc

SHA1
a7674c1d50fe5b475d4e8d9302b2e5b87f4bdb53

SHA256
c6d76286f29d4c88b574dbe8ddee49c2a6ec64d1eaef1c48ba3713c2b8013bd8

SHA512
f2c37b546e2d70a8aff2ae0e4878fb6a2326ca45eab17098cb1a19794ab05fa22de342cb122f23d49e30b62fef194eec3abad13078de99e983cea8acdc4d6c94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
659dabd2916a202f1030f43ee081477e

SHA1
d317d5211f5d43d78f6ba2adbf4207493e524cce

SHA256
a69a707357ceee4a176c03f18c3f578bf22abe0d6e1a5ce33b3bb788799047eb

SHA512
766e36ae5bd063948feab776fb507d1c9993995767092a35c6b356e27cc5c5067bc2836c3bd517d804311d2b7b8d34b5a70727288e1be6d722ea5694e354df2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
139B

MD5
a186ed2a1d6403e0f4f90257093e5f0c

SHA1
e2e85ef32bb23ad0712ae721c9ccf95a844a30f6

SHA256
685ba5db0542579c3c3bed769d4f601d40c8d40d73d216ed3370f247b2c461be

SHA512
a4dc396f9553f270135d63e17f0812812ab9b36de9c2c2170350aca111f40cad77205f852f1afb38bc281181ffdcf120eab8c55f70b8858d3e5bd45d56d7fa3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
157B

MD5
40ceec5f1f6e1ec8a47898df0e32b4f2

SHA1
f35bd339dbe17510588a839e35412638c6717dd3

SHA256
a4fce515e207e9e876592ae27a94db2f553800b0ecb8102d5c8d57cc93a7b414

SHA512
1bc9eb6f41f500951586a0a67138079103bc965440f344b2fdae235b42e8c0b7c9391b7415a4ce2a5dfe82b39c26ebe7da3b4ec8b62567fbad2500848a38cbdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
dd98644b554566b722094ce4c6730ba5

SHA1
caa33515a1fa5236f5a514f7b9a2944a5b211c01

SHA256
7710b33d64ed1acdfd19d271e807becd9738a5ef7673ae153d4191560dd2095b

SHA512
38cc5183a994ae44ee80a270dfecf0d213605864755f690ba4e2651aa0696d0657c5e2f9d9e845db389cdb74765931903bc43b8b21a772521cb7f60ff80fa11e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5853a9.TMP
Filesize
89B

MD5
59e21d3a6b5e24b615c71b5977b4304b

SHA1
6d9fe8b73d2c436821bbc025356ed0669539874e

SHA256
901f944d4430a33285b88a94e16f12b258a6b98b8c30b3c41f431a069f379b1d

SHA512
aebe04fc4dc835d8b8471fbb68e92fdbe799208c3c3b96c9f1e89d71efad55182e5afc4be864880f4a54fb74508aec837b4bc6e3d9d509701d47ea8081488616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
7f160bac05ce9a538ae81cf1ca8935d7

SHA1
bc9f9f7756686634bc6096ea7df173803b598868

SHA256
76a810688d3ae571a53956c84fb604a7637c2e2d78e7ffac90173f9d878b301a

SHA512
72bfd95d2f24a9987d5afbe78ba9bde5b0bfcc29aa4f2cc95f3066c755921495aad00c757ec15ed17a726cfb971500a6ef9df211cfa3ff8aea06a38cac0f0ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe598cd5.TMP
Filesize
48B

MD5
5a68ab38fc60d0f7d26a75b06edce074

SHA1
a3794f36e511d527b4364ce083f07497794989fe

SHA256
759ee506d6f8f6242f4cb32a394d9787a57a13f40918636db7a4c912b8c6869c

SHA512
3ce62a6f1ea88fac82a9ae20316764d17ad9108ca09091f3a3ad2d807d8ea16771fca354f497013d1e607bef9a15eac44cdcc2b773193ad6a0c7b23904f0cfca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
bbceac7740eb5099b81a82b163a2c8aa

SHA1
2b286deb30c41e14e4c72367b1a31989cbb18e92

SHA256
2f19c45d55e97f2129342d3811da2a083fd6fbe27971f7eed5c3899549644500

SHA512
bb584f5c416327b5e56d3fd7cfa38dedac1f25cf132a509871bc8012cbee7e60ff1b9ff1fce2e6ec69fd9160426acc18c2c920a6b36298fd81788d994537c421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
298039b67db29b492a073c914654a7a6

SHA1
473e76d8945beae5331997533ebf37bbf0aca621

SHA256
1458a3899ac97c5aab902979c41e0c0d8295815b27f4d26be50715a287aba0cd

SHA512
eda9dcbc5bd3c500c09b2c3a5a32f347e1a7400ceda67c180c1d8b3c96021393113eb8e02b151f720f01b00ddf9331fd871024c0236e9d7b138097047ccfbe77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
3d589a1f53b8bbd4f8ac11ece90fbb4c

SHA1
f6e49c0b81a5a931049d365fb77dd50c4e59adcf

SHA256
c405da32cddc38abc20598f885e53c2a97b6435f7f1d6f13c01e8dd467c29874

SHA512
f5d237f404db627924940a617d828222789c1eb4112d47a37ae774a00b5a54d07586c392c8e03c0f7d8fb0eeb6431911fe9d667f5eacc8807bf9653e554e91eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58cdbb.TMP
Filesize
1KB

MD5
d5cbc2d86850242ac23dc7378e76d1b8

SHA1
c106b7f79b084a9666e0841e4b1717c5a9f3b858

SHA256
66d195814ea1a500b0ae050509751d1fb3910826a6feb4c45513119c20103751

SHA512
683c8fa7996214966379ea81576c2209ca1ddf50a50509210b3cc0f59fb76fba838558659a5df22092b84aa44acedaf8d94f99eb6139c1211cce6ba50d3d5724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
2df80131195b9d519168d74acb295185

SHA1
667820d8c9b1d81f89bbbe052f4375750eec4d4f

SHA256
b7f1f9eb74c3bfa8ef9a5ddffffe05987ffce0489fae12fe872556c9806681b1

SHA512
2407b603f882ab914c727fff8d8960d91242e9f35f3b21f393abe58e7534f2f68b85c5df87764cea3dbec244bbd188c94e8bdbd4359b3749df8b455d095a19ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
beab29c8656df75434d2f12411f566ee

SHA1
0140ef32a4a18b75a5092f8c5a5b6664fda7abb0

SHA256
4f2b0b58f7112e88389b52dbacb2a776d85fa1c589e6aa8abb15ebbabbb2b717

SHA512
da3ce6e713e292802b4de36606df7d437e68b8a1ab759f7096db23c1cff3d104b430d2e6b647c4eef65a6d6dc67f66b36779bc1fb31aa6ae188b42d1a3d815f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
2df80131195b9d519168d74acb295185

SHA1
667820d8c9b1d81f89bbbe052f4375750eec4d4f

SHA256
b7f1f9eb74c3bfa8ef9a5ddffffe05987ffce0489fae12fe872556c9806681b1

SHA512
2407b603f882ab914c727fff8d8960d91242e9f35f3b21f393abe58e7534f2f68b85c5df87764cea3dbec244bbd188c94e8bdbd4359b3749df8b455d095a19ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\1623.exe
Filesize
1.5MB

MD5
529c2e1c7333063a26f473f2c146cf68

SHA1
69652e46ad640bf61e4d24f3fc3d64165c40fe54

SHA256
59af4e5b08fdac43de9348b13d142cd1487e7af8d0026d89ba173e9ba158e7e7

SHA512
50eb4f77d885933b2824b2780fef86e5681163f559a9aec51daa2c539b8e1308da60fb6de3b46dac8ed293cf683f719e44ecf303416faf421e3e9e372c84027b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1623.exe
Filesize
1.5MB

MD5
529c2e1c7333063a26f473f2c146cf68

SHA1
69652e46ad640bf61e4d24f3fc3d64165c40fe54

SHA256
59af4e5b08fdac43de9348b13d142cd1487e7af8d0026d89ba173e9ba158e7e7

SHA512
50eb4f77d885933b2824b2780fef86e5681163f559a9aec51daa2c539b8e1308da60fb6de3b46dac8ed293cf683f719e44ecf303416faf421e3e9e372c84027b

Download Submit
C:\Users\Admin\AppData\Local\Temp\177C.bat
Filesize
342B

MD5
e79bae3b03e1bff746f952a0366e73ba

SHA1
5f547786c869ce7abc049869182283fa09f38b1d

SHA256
900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63

SHA512
c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50

Download Submit
C:\Users\Admin\AppData\Local\Temp\1877.exe
Filesize
180KB

MD5
286aba392f51f92a8ed50499f25a03df

SHA1
ee11fb0150309ec2923ce3ab2faa4e118c960d46

SHA256
ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22

SHA512
84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1877.exe
Filesize
180KB

MD5
286aba392f51f92a8ed50499f25a03df

SHA1
ee11fb0150309ec2923ce3ab2faa4e118c960d46

SHA256
ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22

SHA512
84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1972.exe
Filesize
221KB

MD5
73089952a99d24a37d9219c4e30decde

SHA1
8dfa37723afc72f1728ec83f676ffeac9102f8bd

SHA256
9aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60

SHA512
7088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1972.exe
Filesize
221KB

MD5
73089952a99d24a37d9219c4e30decde

SHA1
8dfa37723afc72f1728ec83f676ffeac9102f8bd

SHA256
9aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60

SHA512
7088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cg6KS6ql.exe
Filesize
1.3MB

MD5
d6a625fffde3b39e94e19067ebc0ead7

SHA1
0b23e9504bb9d2faaa459d39c04885902a82b631

SHA256
d2d7bfed2ad30944dad67e90adcff3e9e3e461e2532c0ac3f9c254d098c5d42c

SHA512
15f5dc11460da90ef7809b6ee02b8031cbd6978ecc943c909674cd41a8d537703deaa921e6aeb20aeef3c202e635f9da8d612eefdd9d2791479c49697878f9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cg6KS6ql.exe
Filesize
1.3MB

MD5
d6a625fffde3b39e94e19067ebc0ead7

SHA1
0b23e9504bb9d2faaa459d39c04885902a82b631

SHA256
d2d7bfed2ad30944dad67e90adcff3e9e3e461e2532c0ac3f9c254d098c5d42c

SHA512
15f5dc11460da90ef7809b6ee02b8031cbd6978ecc943c909674cd41a8d537703deaa921e6aeb20aeef3c202e635f9da8d612eefdd9d2791479c49697878f9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yh5fj2ug.exe
Filesize
1.2MB

MD5
5296114233ab44b4482e4e465aaf0779

SHA1
dac623b9ec603ded2692d3176201c11de581ad26

SHA256
dc5cdae69488f42e54aee4c812e7a95aa97ea90a4cf994d1d938624bac0f1077

SHA512
e06fd8d1a38b7ea7b8cfd8551d8260fd13e16b2e11b02cad20d25ab6015de55fd6b4c52df8bef41c0faa525f65887fd3b644595671fa6647be92ab26ac692e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yh5fj2ug.exe
Filesize
1.2MB

MD5
5296114233ab44b4482e4e465aaf0779

SHA1
dac623b9ec603ded2692d3176201c11de581ad26

SHA256
dc5cdae69488f42e54aee4c812e7a95aa97ea90a4cf994d1d938624bac0f1077

SHA512
e06fd8d1a38b7ea7b8cfd8551d8260fd13e16b2e11b02cad20d25ab6015de55fd6b4c52df8bef41c0faa525f65887fd3b644595671fa6647be92ab26ac692e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tk0ss5CM.exe
Filesize
768KB

MD5
9d5a2ea1a9c71b80f559b8f89f7b1a55

SHA1
de831fc0002d02a151dc7f06fbf8fde2cb12ff75

SHA256
fd1c6a0e8890d06f5e06537be876ef193977d970ea24f61bce79bb137685ef1b

SHA512
a45bcfcd403e00e520fa470c204dbbbe4d6879ebca6ac81dadaa37907810aca1d6cb5ce1f6487c37e1c883df0a5fc3ca9671e23baa9b4a225ae28dddc37febf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tk0ss5CM.exe
Filesize
768KB

MD5
9d5a2ea1a9c71b80f559b8f89f7b1a55

SHA1
de831fc0002d02a151dc7f06fbf8fde2cb12ff75

SHA256
fd1c6a0e8890d06f5e06537be876ef193977d970ea24f61bce79bb137685ef1b

SHA512
a45bcfcd403e00e520fa470c204dbbbe4d6879ebca6ac81dadaa37907810aca1d6cb5ce1f6487c37e1c883df0a5fc3ca9671e23baa9b4a225ae28dddc37febf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\vI8rM5LP.exe
Filesize
573KB

MD5
592e020b63b4020490061d6d3d5fd8e4

SHA1
3ae239ca94e9ca8195cbcd4efb0a42ec7393477d

SHA256
de88868d974b674365cecd6b819ff3b797e3ba1464eb8edc9269edfa05af961b

SHA512
4ea8a5ea65b678b1c0e9c8e3954c199d53f0b8fa31f4bac978f6a1ada70723ec44777f36f989158121e63051c547add5da9babc3ae6aaf8023d10bc5d2a09e23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\vI8rM5LP.exe
Filesize
573KB

MD5
592e020b63b4020490061d6d3d5fd8e4

SHA1
3ae239ca94e9ca8195cbcd4efb0a42ec7393477d

SHA256
de88868d974b674365cecd6b819ff3b797e3ba1464eb8edc9269edfa05af961b

SHA512
4ea8a5ea65b678b1c0e9c8e3954c199d53f0b8fa31f4bac978f6a1ada70723ec44777f36f989158121e63051c547add5da9babc3ae6aaf8023d10bc5d2a09e23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Yy98cF7.exe
Filesize
1.1MB

MD5
735f69a4d038fc71c0841e1c4835861c

SHA1
4f2a2244201f5540119a931fe5777f636126cfc0

SHA256
e9da0a7339181454cacbe0995f3998cfd1917adbf99325e2096fc47af31f064e

SHA512
5374881c996ca8413b03f309d9f973bf15e06d5bf004abecdb9ee21b4ed3e17c872900390068dc0a1c7ec407aae96161834af868d82aa7dfdc5f11296b399ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Yy98cF7.exe
Filesize
1.1MB

MD5
735f69a4d038fc71c0841e1c4835861c

SHA1
4f2a2244201f5540119a931fe5777f636126cfc0

SHA256
e9da0a7339181454cacbe0995f3998cfd1917adbf99325e2096fc47af31f064e

SHA512
5374881c996ca8413b03f309d9f973bf15e06d5bf004abecdb9ee21b4ed3e17c872900390068dc0a1c7ec407aae96161834af868d82aa7dfdc5f11296b399ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2tk741Kk.exe
Filesize
223KB

MD5
5c0a0d95a94f7b03aa9e6c2b8cd5e0e6

SHA1
f286988f03521ed3477c6f915c5d3b67601795e0

SHA256
b62b0c1f112c6d33e32816e029b5d453357f80bb4b2d48c50ca5e994fcfe7e39

SHA512
13b42c9f40a426ac078d74076e8d559f37484afcf96e05cf0f19c20ad2a66317b30498cd2fc05a5ae53a6d808651f0505b0e4552d1ddce0814285133046deaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2tk741Kk.exe
Filesize
223KB

MD5
5c0a0d95a94f7b03aa9e6c2b8cd5e0e6

SHA1
f286988f03521ed3477c6f915c5d3b67601795e0

SHA256
b62b0c1f112c6d33e32816e029b5d453357f80bb4b2d48c50ca5e994fcfe7e39

SHA512
13b42c9f40a426ac078d74076e8d559f37484afcf96e05cf0f19c20ad2a66317b30498cd2fc05a5ae53a6d808651f0505b0e4552d1ddce0814285133046deaca

Download Submit
\??\pipe\LOCAL\crashpad_1340_NRTQZFPVLBUUIVEJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_3860_YGQDYLCOYSXIZLXC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/464-60-0x0000000072BA0000-0x0000000073350000-memory.dmp

Filesize
7.7MB

Download
memory/464-76-0x00000000076B0000-0x0000000007742000-memory.dmp

Filesize
584KB

Download
memory/464-61-0x00000000007B0000-0x00000000007EE000-memory.dmp

Filesize
248KB

Download
memory/464-63-0x0000000007BC0000-0x0000000008164000-memory.dmp

Filesize
5.6MB

Download
memory/464-217-0x0000000007800000-0x0000000007810000-memory.dmp

Filesize
64KB

Download
memory/464-200-0x0000000072BA0000-0x0000000073350000-memory.dmp

Filesize
7.7MB

Download
memory/464-77-0x0000000007800000-0x0000000007810000-memory.dmp

Filesize
64KB

Download
memory/464-78-0x0000000007680000-0x000000000768A000-memory.dmp

Filesize
40KB

Download
memory/464-138-0x0000000008790000-0x0000000008DA8000-memory.dmp

Filesize
6.1MB

Download
memory/464-140-0x0000000008170000-0x000000000827A000-memory.dmp

Filesize
1.0MB

Download
memory/464-144-0x0000000007900000-0x0000000007912000-memory.dmp

Filesize
72KB

Download
memory/464-149-0x0000000007960000-0x000000000799C000-memory.dmp

Filesize
240KB

Download
memory/464-154-0x00000000079B0000-0x00000000079FC000-memory.dmp

Filesize
304KB

Download
memory/3224-2-0x0000000002910000-0x0000000002926000-memory.dmp

Filesize
88KB

Download
memory/4592-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4592-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4592-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5692-240-0x0000000007860000-0x0000000007870000-memory.dmp

Filesize
64KB

Download
memory/5692-199-0x0000000000910000-0x000000000094E000-memory.dmp

Filesize
248KB

Download
memory/5692-239-0x0000000072BA0000-0x0000000073350000-memory.dmp

Filesize
7.7MB

Download
memory/5692-201-0x0000000007860000-0x0000000007870000-memory.dmp

Filesize
64KB

Download
memory/5692-198-0x0000000072BA0000-0x0000000073350000-memory.dmp

Filesize
7.7MB

Download
memory/5852-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5852-175-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5852-172-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5852-171-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download