fe03de480a720b24fcb4f5768ce3b35765065f061594ac389dd4f672fa8fa2c1

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba.exe
Size 1.9MB
Sample240108-d9jvjsaeck
SHA256 47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba
MD5 ceecb22e867b8c31bfda1cbcb7ab8874
SHA1 8ac5bb4c6ca1a4e408d350ab8d0b954f87c955fe
SHA512 6cb13f9c200efc5e127ed36e04a2701d73c33228799f2b6ec469549ab9e7a11a06ea4bb45bdb81c237279eb1b19f3ff8ad0ec8cbdd161ef01d769017160df813
SSDEEP 49152:8Q5z1o02R2cFNGLoygKtsbEMZV1rvX50VeV4mhQ:vE03yNFRbEMR5cea
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	5up4SW7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	5up4SW7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	5up4SW7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	5up4SW7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	5up4SW7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	5up4SW7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	5up4SW7.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	5up4SW7.exe

Executes dropped EXE 2 IoCs

pid	Process
2312	3Eb73mM.exe
1772	5up4SW7.exe

Loads dropped DLL 1 IoCs

pid	Process
1772	5up4SW7.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	5up4SW7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	5up4SW7.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	5up4SW7.exe
Key opened	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	5up4SW7.exe
Key opened	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	5up4SW7.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	5up4SW7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
102	ipinfo.io
104	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023209-5.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1772	5up4SW7.exe
1772	5up4SW7.exe
1772	5up4SW7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6004	1772	WerFault.exe	97

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5664	schtasks.exe
2312	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
4580	msedge.exe
4580	msedge.exe
1816	msedge.exe
1816	msedge.exe
2272	msedge.exe
2272	msedge.exe
5400	powershell.exe
5400	powershell.exe
5400	powershell.exe
6040	identity_helper.exe
6040	identity_helper.exe
1772	5up4SW7.exe
1772	5up4SW7.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	5up4SW7.exe
Token: SeDebugPrivilege	5400	powershell.exe
Token: 33	2348	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2348	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2312	3Eb73mM.exe
2312	3Eb73mM.exe
2312	3Eb73mM.exe
2312	3Eb73mM.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2312	3Eb73mM.exe
2312	3Eb73mM.exe
2312	3Eb73mM.exe
2312	3Eb73mM.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1772	5up4SW7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2312	2280	47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba.exe	86
PID 2280 wrote to memory of 2312	2280	47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba.exe	86
PID 2280 wrote to memory of 2312	2280	47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba.exe	86
PID 2312 wrote to memory of 1816	2312	3Eb73mM.exe	90
PID 2312 wrote to memory of 1816	2312	3Eb73mM.exe	90
PID 2312 wrote to memory of 4800	2312	3Eb73mM.exe	92
PID 2312 wrote to memory of 4800	2312	3Eb73mM.exe	92
PID 4800 wrote to memory of 1248	4800	msedge.exe	94
PID 4800 wrote to memory of 1248	4800	msedge.exe	94
PID 1816 wrote to memory of 1920	1816	msedge.exe	93
PID 1816 wrote to memory of 1920	1816	msedge.exe	93
PID 2312 wrote to memory of 4824	2312	3Eb73mM.exe	95
PID 2312 wrote to memory of 4824	2312	3Eb73mM.exe	95
PID 4824 wrote to memory of 3800	4824	msedge.exe	96
PID 4824 wrote to memory of 3800	4824	msedge.exe	96
PID 2280 wrote to memory of 1772	2280	47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba.exe	97
PID 2280 wrote to memory of 1772	2280	47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba.exe	97
PID 2280 wrote to memory of 1772	2280	47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba.exe	97
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 1212	1816	msedge.exe	104
PID 1816 wrote to memory of 2912	1816	msedge.exe	98
PID 1816 wrote to memory of 2912	1816	msedge.exe	98
PID 1816 wrote to memory of 2288	1816	msedge.exe	99
PID 1816 wrote to memory of 2288	1816	msedge.exe	99
PID 1816 wrote to memory of 2288	1816	msedge.exe	99
PID 1816 wrote to memory of 2288	1816	msedge.exe	99

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	5up4SW7.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	5up4SW7.exe

C:\Users\Admin\AppData\Local\Temp\47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba.exe
"C:\Users\Admin\AppData\Local\Temp\47b406b0d74b00d8a971a1a19c5e8eb0fefda295f946c05dff9e19ba369edaba.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Eb73mM.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Eb73mM.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff9506d46f8,0x7ff9506d4708,0x7ff9506d4718
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5688 /prefetch:8
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5848 /prefetch:8
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6704 /prefetch:8
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6704 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17922032384946222405,10161908547070302370,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3064 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://facebook.com/login
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9506d46f8,0x7ff9506d4708,0x7ff9506d4718
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,214951426712670416,3441972862919338508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,214951426712670416,3441972862919338508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
      4⤵
      PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9506d46f8,0x7ff9506d4708,0x7ff9506d4718
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,10217161176616299837,8573389704235158438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2272
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5up4SW7.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5up4SW7.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1772
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5400
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
    3⤵
    PID:3056
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5664
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    PID:1820
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 3040
    3⤵
    - Program crash
    PID:6004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:888

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x2d4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1772 -ip 1772
1⤵
PID:5984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0
MD5 011193d03a2492ca44f9a78bdfb8caa5
SHA1 71c9ead344657b55b635898851385b5de45c7604
SHA512 239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 188d83fc73f8001fc0eac076d6859074000c57e1e33a65c83c73b4dab185f81e
MD5 576c26ee6b9afa995256adb0bf1921c9
SHA1 5409d75623f25059fe79a8e86139c854c834c6a0
SHA512 b9dbadb0f522eedb2bf28385f3ff41476caeedc048bc02988356b336e5cf526394a04b3bca5b3397af5dde4482e2851c18eca8aeaaf417a7536e7ea7718f9043
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 25c183fec1b7b089d0e57c926b8f57fb5a56de3ae35b060ced1cf6cacbf54f84
MD5 bda4c21f9581b34a86dd8dbd2a01d495
SHA1 51b8efeb89d10b1ac054e20f3e3800d8dc606fed
SHA512 b20011fa9f06a154c70a24f1fc13a4ce06a826ff6fd7bc31fef5c64827b497714ab24b6b909234568e72d6a286105429881f5b02f951fb549c5d8d9fb2676525
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 124KB
SHA256 821755f0ffb9ed658dba979076d47d51f7ca0d7946fc8e11dadc0cc69fc90057
MD5 8c4d1a51ebc88f44d882a25216f12183
SHA1 85006e7ffccf7134fc038babb483c2caa8c6ccba
SHA512 5a3d01382c8a18afc8996cc1147bcc232b3ea83d50657d9c354c1ab7d558fe843758acdef1696f5315f14dd09417dacb37ba87d57845c443b215b53d02706c8d
SSDEEP 192:xPs7DvzuwD62l+bDo3irhnyTpvVj3XBBE3u5vzGsJ:tszREU3iVyTpJBBE3uVGsJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 624B
SHA256 7e1a8c1c88c873292bb302f557f8e66327f84319fff863ef09e96faf3a69b5cb
MD5 ba6f3baee8d211ae8d724abd4342b22b
SHA1 3af1df629d6ab981a2f272881388a621e10ede9b
SHA512 79397e37e06cd219919dd311c4515cd6d5c12fb649c4dc32fd94781e424c056750c6d264c427cf38d281f15e59864452d86c25d013a93a0e0e966a2c566eba96
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 84d0c0eed5c7aa8f2053b19e3f6981367d40031a0acfc57762711ffc4422ba77
MD5 35f9154cbe708ee749a6a3bc7348a573
SHA1 4cbd4ec2efc6df5fd2032bf0f42e8816bacef2af
SHA512 f3f78f66b92a4de183bec7719842e85c4a9ea65d95b545172ae94236d39751a070fc411a9ebe1b639e2c2a2947f906d06429c0503bac904a64a5aad0dfaa26da
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 9e72615da322c5b09e1a5fbbdd3450a24d3fb0ba99675a3e8a23205f2f076709
MD5 b4631eed675957490ede18d957864d17
SHA1 e7595b6a6f682ef4b4a840981d962472c1a8883b
SHA512 f9b5eebd31149557fa1790256f69eb0f7f54dd8817c20eddd7ef5692ba856cc4617c03f678e88d7d8ea22e9d995b3a18d49651ba727c3af78451dec8a4628fac
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5f629f384887b2b3e6039ad4a3dfcb72921bac27a143ffc5510c354733e517e2
MD5 a8c87dc401e691a274e22f3b234018ac
SHA1 d124445ed312e648a5e80849008335bb3f3b1aba
SHA512 f25125af1eb58605e5703849b6abb022efa62df37c4d34c74b55f4c19a1af7552de60a3e4389e982516466c5856c20e48538f0ffc002f3b1cd31fce2c44ce82d
SSDEEP 96:nfkfr1H9wpvWMoiVmdeHEz9UWQyV+VDCzia:nfkjh9GWMXY9rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 aa18ef65514af6c1c12310e0ae479b34cbf5f34d8c0003a289411cf39e83ea05
MD5 ed043259c983f3a9cd8354f7d41f2713
SHA1 61d5de3028c829d11bef776d6244e05339b8b938
SHA512 cb526f093b8e37c6c4094ebbe37475cd4c7da5373e2a3d974ba1fa5b2438cbd76d96222f3849401dfc46645377ae22e5a7e7820fee48a171ea4ba99a855b8403
SSDEEP 96:n5kytr1H9wpVzWMoiVmdetue11u61+Kul1XxE19UWQyV+VDCAiEwb:n5k4h9UzWM9ueXu6/ul5xk9rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 40f6c4cf19bd67ef39025c6bcb580402276a6fd8e49695d9cea32bb04ba6e2bb
MD5 a14e8687d70d58b96c45ebc00e7932e8
SHA1 25b8d198e0b91ab5b08aef84482e9f8e1066e671
SHA512 eb5fc53e9f7f7ead2b1c43cba457b7761300746a8246cb24c4c0bd2a9e7e04a64b89ded6b948af47df6181dc0919160960a8831952cccbade26cb234bec9aaf2
SSDEEP 96:n5kyJr1H9wpVzWMoiVmdetue11u61+Kul1uYgE19UWQyV+VD7AiEwb:n5k0h9UzWM9ueXu6/ulYYgk9rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d
MD5 f5b764fa779a5880b1fbe26496fe2448
SHA1 aa46339e9208e7218fb66b15e62324eb1c0722e8
SHA512 5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745
SSDEEP 768:ntjWGu8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsLlVkrUufM:ntjWGuu1jaNLjoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a972d5d4-f879-4efc-8a8f-5552c91dbb26\index-dir\the-real-index
Size 2KB
SHA256 d1faaee91d73fb943c4e5a6dc71df774d391090cc852da78107f9ac948087668
MD5 a860ed93aa6150962faec7e999964ad2
SHA1 de1e438797d9a0793d42178d1e9313e597f18f7b
SHA512 62d6639b88a1a11c87708d9d6ff94402120981802d1989c2c0ec66ad31fd9743d651b2e58bb8ded8311658ad060d312ac21debc00159eacf8f11e9381fc17fcc
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57ff4f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a972d5d4-f879-4efc-8a8f-5552c91dbb26\index-dir\the-real-index~RFe57ff4f.TMP
Size 48B
SHA256 8de59a002671a9035920471f1eb3fdfadf2286b064f3ad36439c77f290ad8bd3
MD5 a8a7b80f8a136bcc77c48bb4ab1b7e45
SHA1 74eee24d29d9ade7973cad19b88a82b400701c65
SHA512 b1e7311d43723a5fa87d2b93e9a35bb689281caa25f68928228fd0e6f5e687e0aaf124e617fcd600bbb4d38755196eff4c558fc4fb0f841f06e8fabd27a55d50
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 b5465dbca52fbc66d53b38066d6f37f986ef9ba863aef6329264d34db01d569b
MD5 cab6092acf3e5641ca1c231b89a378e7
SHA1 810a80c613ab112f2be9f823e9914c898fb8a8ef
SHA512 4fcc4dded2a8e1ce10f545781a8ee1ed4f75df521a42856f47da4d6cd3c25b9746482ba046998fb38e2407930ab4958c803f18a434e7ea85f9b166c3832223b0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 74214ec16039b5996ae284c107e7b187efcee7f9d5ab684903f939c9fa82a05d
MD5 fa05ee099d8b1e5b0b389f809652c27b
SHA1 6f9a1a08d4f9e5778e536ebd9d162896afefc5d5
SHA512 05f55fdd3616615aa99cc2e172ae1d0e388e463153e3b02bdc0881a88d76615f97851ea98aaa5e041685a09e22dca70c347a96bc79624687608d433c4e4963cd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 84B
SHA256 ccb1c2e575bde39d1e2716b60acc3c60e66f2382aaf61c12d3eb25fdb924eaca
MD5 a8ccfdc1049305dcc02f77b5c6f422b5
SHA1 74e3bb17ab4639b76b4f2fd26f3ec30007ca7569
SHA512 777a410ba4d32bc88cb4ba5a034bc50ad38ac0bc945f45e4903111a691734e91a5e527aa706139ca5000a5d4213b6e74435253788718ea3be224bd464d5497c3
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 6bb149e0930f5cd115d0a08574574bfafd9d984b508a5f800ecd04e51e7d1589
MD5 2de41e1baab398a1ef7ab4dd16f25edd
SHA1 880f55d2a353b04dcf8a6547f5040140b2e7b284
SHA512 39b02533a04d04ef4b542eb734f2a5083ddea69a8e799bbd8e08354db3423c1de04d3d003b110001c301e298ae53b62d79c99ecbdbb70df1fe232a42c730a99a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ab4bf6cd30c290400a2031d8d0a67b6f74209ead5766cd7e81697f110df0cf3d
MD5 951daf294d4dc694c558cf178c188b91
SHA1 e3da1ef48c469911fedb23d252d41ee4e8da2cb7
SHA512 3ae8f0f268b5f1274dbde7b501a40dc428f99b66ae35c56e0cfef9379d368868b1fc1f6c3cdb760a8cadaf5ac900d468cf57f10afd0c480ce292821b6722caa7
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57f2cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f2cc.TMP
Size 48B
SHA256 a3905b9458b38aa9d09ecea7576009c9269a660de045dc0c1f60f34f4a9746d4
MD5 b0f27ff80f012fdd6d622d32a9e60f0c
SHA1 becce0498dd01a5fae07d07cac5474ae2d3a9415
SHA512 2736a38e1019451a9bfa98b72ab9411517d2e3317f0500994f6a29ef760d04fc6ac58fe8f129d712b5a7962543b09e6c41c802d68f938f03c01c3ef9421acc2b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 fd3c3902df8eccdf41e70b3288f72001acdfb5ec8ac2b34189382dcecafb3762
MD5 49da70655b77c583578248a97f53d67b
SHA1 18719a6eff485fb60ff4ea73ad85a36f1967ca74
SHA512 83de0901ae9456cb5a195c73e857835073b60dc7deb1067088298f1bee66d2b596122e35c28f451b7fdc89ec2f3adf2bb7f177d299a283f49bae4a6a2c51fb6b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 ea6caf2a8ac5776354d7285e8691fffcb45d9a72d834a6784ebaeed268b30345
MD5 f3286448f647afe81e4afbcb1aa7bf65
SHA1 b13b7cabb2d378aa7cc7ba62b861f9f5db8d60e1
SHA512 bd4eec62f2fbf395c40f120ae233325b0abb5ee668f702075bde2a9b16ebc5fb830b4849933aec7da3046067c35040ce2d62f1f72af50956aa01cba45bfb71a4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 2ff9b6aea83555a57e0ceff02eadd4073c2d7af8373e0b4d1ae21f5350c35653
MD5 c1966d1b67fc5a0a489720ed00a272aa
SHA1 23722d20948acf482b94c77ee143ef5aa87088de
SHA512 fdc7372e85a92dd49ee4661a5c3bd59e7960b4ce8e1bbf24b48a70bc72a3d6e7d417f9f9453e128c8ff089b5331dcc506d9112eeea54660f164b2021f8cd7963
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ddcd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ddcd.TMP
Size 1KB
SHA256 65ca158afaefdeefee98134472b7ebe1eb5855867de8ddac809b08426be0e0ee
MD5 baddf6c4ab05d1da2f16ddd15e659cfc
SHA1 b7f54c942092b2bbd3bd2a8b8ae0abca4022af7b
SHA512 c27d9f3cbcdb272cb3bfb7fc33f215e50e7de2033f7086c62a01291070fb82c4b129e823371ec2d572d120f9c795839e9d0470e6ddc56db32e0f6fcd9670e56a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 1f42621394197e317a32133d0de035bbde9eebfb08c2e6a643ea15b8d38f2fe0
MD5 ce59c1382db9ea0293f6a7902368c22f
SHA1 12169203670137f84feb8d1c4393c62cb9183db5
SHA512 bea8c28626fa7e7ce34421201e259722372c668cae13295c41719df8d24d2b82c9eb9f695892dfd0c4dd9cb77be3cceb2e04435fe35bcbcf534be12253a07cda
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 c2ab3a6dd58435b9d57fcb0698c44bab05ec46c9906d994e95ebe8d31f3bed90
MD5 cf2075ad70e85da9841facf1bc0f45d9
SHA1 a29df095a08f50394a0fb297993cff2bd678b182
SHA512 5dc14aa7ed11d03707a37b0b4f70c4d47f2a4d25cb701da01efc9b0c70ceca24543737f93cfb84c1548456d62fe1d8fdbbbacd2549d9861ecf2b566329ed9649
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f1f51afdb0df94bbc66ae225916597ceb8ba3cd101284ae9e7d2298c8d08dde6
MD5 ea262876dfdfdc83eb7b28bf13a82c31
SHA1 f56e57f2d5c2379b9378371e363ea68d53baf5a5
SHA512 0d94b8260c690999758f4bf55df52b6714b591da73c1cbf401177e5831d1618f3e25a2143ce9488e5b7319fee0d138166b6fde422a5d91db345f47c9aca281bd
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupie2RURNvIEqD38Lk0iwE3:N9iIxuERzA83h09RZxYcO9y38wg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

FANBooster131.exe

Path C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe
Size 1.1MB
SHA256 c0a793f54bdc86cb1712bae1a4c42be77c66eb8fda4ee341ded0d1251a3aa188
MD5 168547ab06bc179e47626b28812ee5be
SHA1 cc30045dfdbf89126a27cf6a64d317c3c0039c19
SHA512 fb41aa234d835290050b106c0560f97baedae295e0c91db86f5bc78abc1c49f25b7dddfeeab4ee885da91280b52c9c45234d20cda344e30bf6357cd8b098d645
SSDEEP 24576:Ga8+e4Zg1Y+58d5ryA/I4NTJ8ClIWVS64OVpmwMdC:qP4ZgK+OR/1T8CZ4FOKHC
MD5 SHA1 SHA512 SSDEEP

Submit Download

3Eb73mM.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Eb73mM.exe
Size 894KB
SHA256 0b343aceb8665dabb2f978310bc369bcac837bc19c7422d059fd485d50bb2c42
MD5 779db1fcaa2b01c67fa62fdcf541137c
SHA1 85aa8928790bc40c8dcfac0585e87526d285905b
SHA512 b657c28f2159a283214b8ad103492f467e79bbd6465385bde9f15e5c3712433e7d77bf08b5637c2d4dcd7c2fa85fe4704ce0cf4096af4097861762fe10f5a00f
SSDEEP 12288:5qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTT:5qDEvCTbMWu7rQYlBQcBiT6rprG8asT
MD5 SHA1 SHA512 SSDEEP

Submit Download

5up4SW7.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5up4SW7.exe
Size 497KB
SHA256 05762c28f690291e706b7d6ea5eb7390ba58161275d66f9d479ac4f4ce32688f
MD5 3de7e968063a6bb069f6b0a8fa64b434
SHA1 176d9633fa998ed6adc99ce1bb6142947f478582
SHA512 7d102e2751601cdeead418ed6e8a522c91c09759207c5e8c18ba6dee496e3f1b1e388669a8efaab690917b6f64d56eb0d7ca393cbf5b05ca65e879c61f064933
SSDEEP 12288:mOmrJY8hApcG7Zg1CDb+WW8ZS0FPrIR0/HVn/j0RHKbCw+:Ga8+e4Zg1Y+58d5ryA/I4N+
MD5 SHA1 SHA512 SSDEEP

Submit Download

5up4SW7.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5up4SW7.exe
Size 191KB
SHA256 dbcf0dcc45747656add6e7db1742724df9310248114dd18c50e8e490ba16ba39
MD5 ac36a35c003987915d6df2e40d64f275
SHA1 07aa1298c0d5038361327af2b893112c8200ed36
SHA512 5f95e76f799a65c11504e445d80e906c3005e461341e885dc7509359a5cdd8d642fcbff557d42d1d9df7f92c42238b81b1255c30cdf5eced505a4b622030072a
SSDEEP 3072:mwBkCLUa27VvTJYokkvhApRKjTTzjgyyNLbHn8FtFPPewuuHjqbHZgCafLdJCQxC:mOiRrJY8hApcsdXGmwJebHZgCAvCQsb9
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_h41qgfft.lxs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h41qgfft.lxs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

0wA2ChSVDR6MWeb Data

Path C:\Users\Admin\AppData\Local\Temp\tempAVSN51Hb0zyhjYP\0wA2ChSVDR6MWeb Data
Size 92KB
SHA256 5fc567b8258c2c7cd4432aa44b93b3a6c62cea31e97565e1d7742d0136a540de
MD5 c6c5ad70d4f8fc27c565aae65886d0bd
SHA1 a408150acc675f7b5060bcd273465637a206603f
SHA512 e2b895d46a761c6bdae176fb59b7a596e4368595420925de80d1fbb44f635e3cf168130386d9c4bb31c4e4b8085c8ed417371752448a5338376cfe8be979191a
SSDEEP 192:dtxbavrNdl9bH9CxbGsTjOnaVh6is63JVum3:/Ravrbl9D9pnaVh6lcJVum3
MD5 SHA1 SHA512 SSDEEP

Submit Download

sNtwhpa6eq8FWeb Data

Path C:\Users\Admin\AppData\Local\Temp\tempAVSN51Hb0zyhjYP\sNtwhpa6eq8FWeb Data
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\tempAVSN51Hb0zyhjYP\sqlite3.dll
Size 791KB
SHA256 0c7cd52abdb6eb3e556d81caac398a127495e4a251ef600e6505a81385a1982d
MD5 0fe0a178f711b623a8897e4b0bb040d1
SHA1 01ea412aeab3d331f825d93d7ee1f5fa6d3c46e6
SHA512 6c53c489c4464b9dc9a5dd31c48bb4afa65f7d6df9cc71e705cea2074ebd5e249cad4894eac6f6b308b3574633bc6e1706dfc5fda5f46c27f1e37d21e65fbc54
SSDEEP 24576:2/ZHet+kwxRLvxx/ccPA7leR+g/oU6xGmdRA7G4fRjqTr:eZ+t+v/nMleR+g/oUI/dmi4cT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1772-455-0x0000000009EA0000-0x0000000009EBE000-memory.dmp

Download

memory/1772-463-0x000000000A6A0000-0x000000000A9F4000-memory.dmp

Download

memory/1772-42-0x00000000006A0000-0x0000000000AFE000-memory.dmp

Download

memory/1772-229-0x00000000006A0000-0x0000000000AFE000-memory.dmp

Download

memory/1772-67-0x0000000008560000-0x00000000085D6000-memory.dmp

Download

memory/1772-25-0x00000000006A0000-0x0000000000AFE000-memory.dmp

Download

memory/1772-536-0x00000000006A0000-0x0000000000AFE000-memory.dmp

Download

memory/1772-543-0x00000000006A0000-0x0000000000AFE000-memory.dmp

Download

memory/5400-100-0x00000000053B0000-0x0000000005416000-memory.dmp

Download

memory/5400-207-0x0000000073570000-0x0000000073D20000-memory.dmp

Download

memory/5400-200-0x0000000007120000-0x0000000007128000-memory.dmp

Download

memory/5400-199-0x0000000007140000-0x000000000715A000-memory.dmp

Download

memory/5400-198-0x0000000007040000-0x0000000007054000-memory.dmp

Download

memory/5400-197-0x0000000007030000-0x000000000703E000-memory.dmp

Download

memory/5400-196-0x0000000007000000-0x0000000007011000-memory.dmp

Download

memory/5400-195-0x0000000007080000-0x0000000007116000-memory.dmp

Download

memory/5400-192-0x0000000006E70000-0x0000000006E7A000-memory.dmp

Download

memory/5400-186-0x0000000006E00000-0x0000000006E1A000-memory.dmp

Download

memory/5400-184-0x0000000007440000-0x0000000007ABA000-memory.dmp

Download

memory/5400-180-0x0000000006D10000-0x0000000006DB3000-memory.dmp

Download

memory/5400-177-0x00000000060F0000-0x000000000610E000-memory.dmp

Download

memory/5400-167-0x000000006FC00000-0x000000006FC4C000-memory.dmp

Download

memory/5400-166-0x0000000006090000-0x00000000060C2000-memory.dmp

Download

memory/5400-165-0x000000007FA70000-0x000000007FA80000-memory.dmp

Download

memory/5400-157-0x0000000004740000-0x0000000004750000-memory.dmp

Download

memory/5400-122-0x0000000005B10000-0x0000000005B5C000-memory.dmp

Download

memory/5400-121-0x0000000005AD0000-0x0000000005AEE000-memory.dmp

Download

memory/5400-120-0x0000000005600000-0x0000000005954000-memory.dmp

Download

memory/5400-101-0x0000000005490000-0x00000000054F6000-memory.dmp

Download

memory/5400-90-0x0000000004C00000-0x0000000004C22000-memory.dmp

Download

memory/5400-87-0x0000000004740000-0x0000000004750000-memory.dmp

Download

memory/5400-85-0x0000000004740000-0x0000000004750000-memory.dmp

Download

memory/5400-84-0x0000000004D80000-0x00000000053A8000-memory.dmp

Download

memory/5400-83-0x0000000073570000-0x0000000073D20000-memory.dmp

Download

memory/5400-82-0x00000000021B0000-0x00000000021E6000-memory.dmp

Download