crimsonrat | hxxps://github[.]com/SparkScratch-P/batch-virus/blob/main/viruses/virus27[.]bat

Analysis

max time kernel
314s
max time network
315s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 19:59

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/SparkScratch-P/batch-virus/blob/main/viruses/virus27.bat

Score

10^/10

crimsonrat discovery evasion persistence rat trojan

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Signatures

CrimsonRAT main payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0006000000023394-1043.dat	family_crimsonrat
behavioral1/files/0x0006000000023394-1051.dat	family_crimsonrat
behavioral1/files/0x0006000000023394-1050.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	FreeYoutubeDownloader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe

Executes dropped EXE 8 IoCs

pid	Process
1520	CrimsonRAT.exe
1480	dlrarhsiva.exe
1364	WinNuke.98.exe
1340	Mabezat.exe
3008	FreeYoutubeDownloader.exe
4064	Free YouTube Downloader.exe
4844	7ev3n.exe
1168	system.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tbibra_dreb = "C:\\ProgramData\\Hdlharas\\dlrarhsiva.exe"	dlrarhsiva.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
50	raw.githubusercontent.com
51	raw.githubusercontent.com
74	camo.githubusercontent.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4628	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "231"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-910440534-423636034-2318342392-1000\{4AC70C14-7154-4616-936B-2ED17CB6B9D1}	msedge.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 611942.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 23805.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 858213.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 269179.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 97097.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\system.exe\:SmartScreen:$DATA	7ev3n.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 45570.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 438950.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4920	msedge.exe
4920	msedge.exe
4520	identity_helper.exe
4520	identity_helper.exe
1656	msedge.exe
1656	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
4388	msedge.exe
4388	msedge.exe
3736	msedge.exe
3736	msedge.exe
5020	msedge.exe
5020	msedge.exe
1048	msedge.exe
1048	msedge.exe
1412	msedge.exe
1412	msedge.exe
4132	msedge.exe
4132	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1788	shutdown.exe
Token: SeRemoteShutdownPrivilege	1788	shutdown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4064	Free YouTube Downloader.exe
4064	Free YouTube Downloader.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4920	msedge.exe
3008	FreeYoutubeDownloader.exe
4780	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4260	4920	msedge.exe	84
PID 4920 wrote to memory of 4260	4920	msedge.exe	84
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4328	4920	msedge.exe	86
PID 4920 wrote to memory of 4564	4920	msedge.exe	85
PID 4920 wrote to memory of 4564	4920	msedge.exe	85
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87
PID 4920 wrote to memory of 4444	4920	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/SparkScratch-P/batch-virus/blob/main/viruses/virus27.bat
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9b3a46f8,0x7ffc9b3a4708,0x7ffc9b3a4718
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\virus27.bat" "
  2⤵
  PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\virus27.bat" "
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4628 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2224 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1520
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1748 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Users\Admin\Downloads\Mabezat.exe
  "C:\Users\Admin\Downloads\Mabezat.exe"
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
  "C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:3008
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SendNotifyMessage
    PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8966054670095197390,8241781130911929472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Users\Admin\Downloads\7ev3n.exe
  "C:\Users\Admin\Downloads\7ev3n.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  PID:4844
- - C:\Users\Admin\AppData\Local\system.exe
    "C:\Users\Admin\AppData\Local\system.exe"
    3⤵
    - Executes dropped EXE
    PID:1168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
      4⤵
      PID:584
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4628
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      PID:1840
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
        5⤵
        Modifies WinLogon for persistence
        
        PID:3084
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      PID:3624
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
        5⤵
        Adds Run key to start application
        
        PID:5016
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
      4⤵
      PID:4732
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
        5⤵
        
        PID:1076
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:4864
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
        5⤵
        UAC bypass
        
        PID:4536
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
      4⤵
      PID:2504
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
        5⤵
        
        PID:2156
  - - C:\windows\SysWOW64\cmd.exe
      C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
      4⤵
      PID:3468
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
        5⤵
        
        PID:4824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
      4⤵
      PID:468
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
        5⤵
        
        PID:4132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c shutdown -r -t 10 -f
      4⤵
      PID:4944
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -r -t 10 -f
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2076

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa391e855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
2.2MB

MD5
979b381165ef2a42282da6f15a0f8a49

SHA1
520195e97f314758a9daa18adcb8a712144b49a2

SHA256
5a23e6bb2c1eee984da595a587397cffcaba79f2d917f47d9ea76bc059520579

SHA512
b1d533953e24d4a840f1c475dde6415d98c9cea0c215cbcb077cb14425dca6db0b66226f95a7165f998730e18e034a3e57cf2f266550972705de382d585739fe

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
2.8MB

MD5
f34f127acb7741b9de8bc511c8658002

SHA1
9441e3cadf69854bc1243701764e05deefb3a4ec

SHA256
6e2cf82e81088b8476270fcf1fca844fe8e35e89ab92fed942a705121de51552

SHA512
6cf63e63472790c7238ed2819493c595a670f600ff1b032077db78525c12a3aaa9f8c4f813c2b4b3caa5cab8cd2d7a7af596816fd6a2d6e671205ff0a6d51ae2

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
2.3MB

MD5
862a5cfdebd89bea05af5b42caf70eab

SHA1
179b17cab6f9680136c8a00fe8ffb74a99585ff0

SHA256
dec74800d42eb3a1680530a3812950eda5023e03b8897a8511a4f65ce9b778e5

SHA512
7a1b44680aa9917ec40d2c44b5a7fee259501eb5960cfcb8722bf2abd61fa79b0a244affcb23fb9fdb934b14f9f6f83941ead30942d1002acaf8110ed6ee12ac

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38627ea0-ac36-431c-9992-a2d96f33bca3.tmp

Filesize
11KB

MD5
f1a213c574686bedd8ed8642434a35a5

SHA1
3793bbaa024ebb5d43abbd264bf7c2e515e7b4c1

SHA256
487c2de4918511456532315b414e71f68ebfd6c5e943dfea0c68dcb797dacb6e

SHA512
a9c7d67bca6a887db49583c6f5468cc9919a5b1dd3ac4912f929fa15a6f1a19a6da5efd7ca36f487d96ad5916eee856313eff39eaa63a5eeda9396528d936542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a65ab4f620efd5ba6c5e3cba8713e711

SHA1
f79ff4397a980106300bb447ab9cd764af47db08

SHA256
3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76

SHA512
90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
854f73d7b3f85bf181d2f2002afd17db

SHA1
53e5e04c78d1b81b5e6c400ce226e6be25e0dea8

SHA256
54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4

SHA512
de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
18KB

MD5
d07f175cbd2c52604838bcbd34bf7386

SHA1
1e32ac6ef3b42b664a681867b8243ac04a1d07fa

SHA256
0e733fc8c782ac8a05936c392d72e3079f49dc348019a84103184efd011d8f45

SHA512
8ccd985d4100190e76e1443a1bb4a5b1783d1318200ad51a0ed7ef675ba0e8a4e7f6ba16268240ab86d6e38b9d8b26136ab297672889f6a415fbf11132819973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
06e8d9312613453e9f61e795b36470c5

SHA1
d34d9c8bd53c3f1ebd41841c3f5d1ddcbe69a75c

SHA256
2d870054065cce7e2b952d362be3c90228fd60b3ec8bcc1131a44a2e89e837b1

SHA512
f82440ccdb8111ba632952f880802493f1194da7519b096dad0f03c1f233dc06c328e50350ef6d2c6405c35d531d7f6298c24a6a14e03288db06d076e2a9b50c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5770fede26d6e4a5d0de9ce180d101f5

SHA1
7372187d48deee3f6cf1644582d685c2e444989e

SHA256
4bf9309a4b4fa60f9278d1c0b47910d1399e3ae40cea6b00313a282b8c6af95d

SHA512
be2e4901bf87c4a6de990824c61d097fbca4ee966c56a59e2f63e2f2f597e50e53bbd679221ad085e1153c14e86f6620f3d4db0cc81c09306f800ade234b3605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fce7981b1bc4ca673bb0d3c375875e89

SHA1
b6d7646c86f06ac1e3b764c4077b53caa0c15439

SHA256
d56f9a7c5d44a016c4691d1b59c6917347bf06aecb56fbcafe0651ee93806e0b

SHA512
29033de6d2a68732b77dd4d57b53ba2e4c6696b6cf16cbab4f285a849b7a6c18edd867b42757548bad758a048a4f9f1aacd017f68bb38e0035b5a63c302f6e45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bd01215c97ff62ab1dbba5cb74b928fc

SHA1
f08e0676e3973cb208583e82ca2f4b48c954d7eb

SHA256
493a202325fb4ade26f85647835a7e8a2615821b83311770dee5a161c8295cf4

SHA512
0f472c4657f1490263174773575437b2a1d510472389cc9a2da497c0c28e9451ae435d5d0b8e57be4d87df8b350bf54c90feb5c845866a301fb9eefcc6d1e56f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
936B

MD5
efe1fb8cc226d2a916cc0374b04c2d92

SHA1
743b2918aacc4d00f5d3f4a0f507bfe353b1f84b

SHA256
41849571a559ad3d7bf28d13467808f9f1d40e39e74271b5c91b35956141eaa4

SHA512
cf009afdec5028d7685be68e923233da1414103d2a3dcd76320a567b618934a441c76b2ad0e02d78af842cb26381b331007f722a470e7c1491b581c2a369f39e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
c7240a352a6bbd47d64180008b5e8558

SHA1
7e9c44bbc635a1d658e6d5fa98c48f199e536c3a

SHA256
199b6132741680250e09f4a027cb67e9d993f924ac7a1a724ae859a4c82e3a3c

SHA512
fa4e49a48fadef02603565394804c8ec567862a3bf5652f4c95e7c2d38cb7313abf113020198596b226d27e3f2cf88d554589a8c16e9ffa5f74bf4b90cb16cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
72d66d4188bfea996bc7a2ef20b766ec

SHA1
2cb970d79e0f89d611d51d708d33496015169196

SHA256
4fb0b641271773731eabf66011acb01af46650e270ae09e14625b3999d672e52

SHA512
b38f56b6a2c2e679a6c4dafbd340fbd708e2a946834a7a3f988cc88cc9a9a8fbd339207e384db93e45256c9feb6479bc8025a2beacdba5b505db0dcc837c0074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7ff34a2cfd59be78903959983eeb678

SHA1
2168c83997484d322e079a3dd975bc6460dcb704

SHA256
dd3a360709344fe83408e2a8e0f1ce015e689948fc5f468f33f4af089d7dcdd4

SHA512
fcb23b3a11ad8d3c3db75cf04c8fca4528d60dbd006890a1de7e9154c59415d8306a0b9306bcb4d32f19371b30bf212742d24d2050fe003bf52c20a225c0ab5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9927ceb3a84ca948a106ba8794fa5f48

SHA1
322714d66490e17bd2d5830607d85a5a3aa9b185

SHA256
d1bf57865ce22a16fb749bd2d24e5fc647ea60f81fa08f3912f368192fb00f3b

SHA512
f8c72a5a3702cb44f4f154ce4d46c01648ce5543414e6aa24a51773a2c97e742e0b82114e9cf0de6adb1fdc1a2675a8d388b7e3e46a166b12b124a7e585412ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ace7155315f5de789358af28cd17aad4

SHA1
3e4c4c355c949449ca4fbf130241e9397a5c7bdc

SHA256
f6a9bdd068341c78712ff454a0f0dab1e3449a62792cc4a06275429dad9174d0

SHA512
70949e0a1d1357982f751758245915a46c0e6a8d8acf54b353c49b602f8d1b75565d8354f2c6d7295db3583dda542e757124f5523f0c8f65daf14e4500e10753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bde6cee88c919be2d2489f1d53c57d03

SHA1
8c808ad3d2764421b8c2a7f095c82ae8b371102d

SHA256
9eb887b627b6893de1e2eb57a4dddcc13aa465bf9bbba9b0580334fa12f31c7d

SHA512
9a40b7f10473e00d832994b2564cff889cb0f4d82fac65ee1754515e12be2dcf72a7fd285f5ca2389e17c2a4ee1161b1610bd6f4466e076df25c617f1cd64a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a4282097feafa2905f421115a001461

SHA1
11ab78c8669e3adebd214824a0dab66bacfa349f

SHA256
697691bb408ffc1c4a2efa4e7691600cb8607099ddfc229b120de583786ed52b

SHA512
637e1a2b4d95a22b8e26aa5e4f07c5ca7eb8b5422007f11683ef9eb76e66b870b846e195c30ce0e12f9858e23206fa4cc16c1268e83abc8fc59a7476a454f6c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a6553e37f29848c6e383b0d39fc2146b

SHA1
ed870680319d4bef4cb3476aea4e4acddcc7a5a2

SHA256
6bc1e4ebcae509fd7c1de0ef27776656f72890de81f5ba3ceecbbf55d26fe6e2

SHA512
0cdacc6debaab7b1fd8d205951602d9b77f6a1ad8363de83a677aa61eb9ea87d1d7d55089fb3e2f6357b8622219801e564212ad3d4a901194ec270b58b0e0c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
baed4729986a49e84b17b728efb7b459

SHA1
a86ea64d32e09f3c3f3f4f8e4e28a7398300085b

SHA256
c46b482bcc86585bd13c769c24e7a55e7f3b3f63da4dce75b72e4861a894f913

SHA512
356185e774a5a548826d13766a963927256cd5b7bdff24353e16224c466a224dfd5af7b422064c9d94ae4da4b0ed0bd24160e2e61a0a28cfc58afcf92ecbc986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4776fea25236edf7fec3c18408b2d1ea

SHA1
6107dec051a4f57a23d37fb80b040f3de46d60e8

SHA256
1e4ddf81381a17048bbd65f87938d909f5dc4021be0af86743be3b359ac8411a

SHA512
f1d0b264ea25180c648534e7cd5f5767e605f8e5c8c231ef0384e5ba0bd9da121449254cb1586f018e76f3bd0805257423a1ce66d7668860346696c6f28958ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6724cba709ee551df8a9b36019c064f3

SHA1
ff46114ea2225ffbd339455255b5b039bf397f55

SHA256
201d3e3afd11fb1173aef5ab17dfa58bbdcab1a6f7e910f15ee90948f4079e3b

SHA512
6f5488c6739299131968ac8e53c9b4b62ffedf5399409352ff2e76f9e7b0179f8e6b6caffd99317342780a2572d7db90c38aa78f59e36081872218a3b41a6493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9a700f61f1ffa661e3deb46c014d4dd4

SHA1
6bb913debd2e8635ba2caabef7e7373f3ab0ec49

SHA256
d3351e31be13a158601e28ae483a1bffe4e62f0c571f0c4465d8eab8304a779b

SHA512
924dd41d379e0ecc3230b5e2a8d12570489485f49ea36bebef72eb6faafd37cb14550b2217eaed914d431bbe2202804b929e3ba7fc1ee00ac2a24fbd42e2ce68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b518c239d11131a191db7662a7c7dbd

SHA1
3ab30a7598969c42950848d6bd6cfa496d9d5a95

SHA256
d54f7b069dc7063371a3013a645713453c27f5028b2bb759fca539fa283f6aa7

SHA512
b8f83d9d20c5bb510569aa16402fefa87b36d279380a61fbdf42ddf14acfafefa892d85e946e5371eaed498773bc5afb62780b682a6590c9728468bc5c75711d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e9998882bddf36492fe96051ec8523c4

SHA1
af5bbef3b097289b6c343714abf8df6caecb77df

SHA256
a040932521613d93ac0c2bd06425796bd350e4533f3d88942b3f42c83be457d5

SHA512
abf656460d12b7cc200fa6568131528777a1c0956def42b58f16ad8058a7dbb9667525fe8629418e1f94368911847102b97dae15c90c329eb3c892ab81c8e0a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cbc8f71aff0353f9ab1803bf159e653f

SHA1
270874260455e05ce6f65630a943424902857347

SHA256
fd7ffb623df51632c900d7cfeaab5403c44c970b0eccea2b2e460be9a0cdfe83

SHA512
ba79369c491584237fe13e70d69119f8502a21975bc9aba539f8d6beec5d59d32563f2864284c688599ade1001be1116f457e5406f83c9426a58a70c9b09d6ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fe772bb86f85cdd4b0ca389af5e1ac1e

SHA1
f11cab8b12f16df3b86c95ea955c3d35650cb26c

SHA256
3d1addbf86c923684c2941611a4eeeaced431c2f9a2ff9e4ef3656daf0b1706c

SHA512
7c3bee0ce42cde4c8a0f84f67d552e201c78394b24c1068a2fa13f054abe4ab4d15f5065db33e21f03f183b895fef2e76417de5632d533ed61e70ea16601669a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a4cb896d2c07b5195b0597f8c5373988

SHA1
9c42117b82cea7a68598ffa314eca0eb31c51988

SHA256
1be1eb336709b20d8eebaa030f95c1460fffa62513cf6e7688799639bdfbf4ab

SHA512
8f3d1da14504019bbd23beefaa5c717fe4bea87c769e1f5163f0a8f7808415e7542238c5a7a21cbf507cd7354a0540a6e4e74a4120abd4cc77dbcbf90b58b170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2a48bb596efc74dca7382b16a99aa062

SHA1
0e0ca795fe6adb8432faf2edb834c43053e4ea0e

SHA256
6833a374ad3c2727e553d5ca5154a2b26af35379506f23a5532940be0f730506

SHA512
221e1575e67e23b85c812197a2eb97014c8e157185c57bb73ff3e55edab94fd2ccd5940f3d210939c4e913382543094d774483f834d5194a239a835a599fb11f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c823c3b1fdb590f03e7065e43cd12e55

SHA1
38295871d938c85376cb9015ba6c26d49963e2d1

SHA256
7fb1bfde6296db0f3b279334375e655dd631074a8da7cbde267f4d85fc3391c4

SHA512
81127f4a038a0339b0016c310403a87cbaae400731331abfb9d238cf009a2481e23408aa932599b5c48c894b00cf9f2ee92ab1f4d8f9314cb6726a530a760652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e0fb2cfe2e9bf20d88e871a8bca01fd

SHA1
0138fe44057881dac7787b3d06dfc30387a9174d

SHA256
5a60f1fd1c090023e1a9ace1b166120ebfd4445ee3a57c328206db09f34229bc

SHA512
6a9731111aefc8813b44e4266ea53bf302db4be777898ff8feb037321ee01f489f74eed7073f468168733661e310e7d8df79e649dcdd58de55cd428211b12c65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
189b6f4f86e4d848880ff87059fd95b9

SHA1
c3c890f21a623e3bfb9c4a0c4da596581bd4bbc1

SHA256
e305cf6c158e9d2a33d60c9d2b70adabb4647921137f7fd164de79e21a04fe41

SHA512
70bd193c2bfe23680a74a2844601cc524900d26f7b4be811a9c1e68b65883a7634ecb9b726db6e68c3868f20b0dd49c245c468404a072b5b2309fdb0d99417a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
864B

MD5
1529dc9f5af0315308297835cb368afe

SHA1
43bff330d2134220ae9310cb480929e60e54a74d

SHA256
f41746d03ef3217dc8414f35b739115f4006fa75806cf2f3bed220e8dbb02bdb

SHA512
d027d72d81fbe0dd85cf1039cbf141c946a78eb81a636bcc969389397385c648e211122250a190d3c72a95f42ca1538e4b56490558bf53a07c6efecdd4f43782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
397c7c15dcc9fe521a4a223347679256

SHA1
6e3be45f4f1ce42f49bfa208fb80969fd29573df

SHA256
6137f6fddea7107a82d2f48b2c899f64e9e4e44d82145a0c46c9276dd01d4acd

SHA512
023a3a63b7770267c616aa267722fe4e90ae6f4d410600ede300947cde9aefb45bba9d220afd45e106d6e31b16895af4a1f6121ab2768a5cda9f986cfa79c810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
52875ff7b87abd8e23f135d3844592ea

SHA1
1f6854428cea8c3a0a61ed1aeb1c4ecdceea4e42

SHA256
2e24b28e5bcba350d93925c91f8673a57ede0c21cd1c6f204114ff0a261dfc08

SHA512
996950df7254536f243e65b4950c0efddfbed40639c3501e8d7765d4a73e752a22c65d2ef94c1f533a156493d6ed01611b68d0c4dd2bead74d3a64ab73475c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
886de278293af1a1099b390c2a276d35

SHA1
f7f6ce5009495404366e4146522dc158ead5d731

SHA256
00df6d9f05257f4d8b17a1f810056d8ca6f8cd908a49cf28d86091c8b8aba4ce

SHA512
0d21623ac3690e89018f039c57b8c03aa518547c396fc200a1041e69720b1e37da4c8580e71632de68e9e5038121eb8eb49746e98047fcca68d75e5480fbf608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a62e503c922f0091606431489da4dc57

SHA1
69741a977325d51cf90434b3d92b2d06fb61cd5d

SHA256
9ee2036e2d3dbf01175a948a4c2fe8529a385421a83fc3a2faa6c569d6989311

SHA512
db7d4de9386d1562f206b88515acd97909f38af1e07206a9419c6016e44bbf0daa0c085da94f81608705d4d5eb508cc8ac56924dbe3e628563de9d8d3d476a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7052aec9e53d0685f815f3f11d42e771

SHA1
3f38a75dba607135e1972c2f587cccec401ea24e

SHA256
04ef447239579de975946d96cec104ab81b98362057a47e00bbd9d0636da496b

SHA512
e9f087207251646ef863df8ca83664b24557e81485d823061e38b476b24d0d956b18d915ffeffb88717f5f61c0f57e05e0d5d586cd4de7db2f34ba0e28df4f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d60dcdf7d750fe191975521fbe5dce39

SHA1
2430ef829413a42dbe7e929b34574be18f388ffa

SHA256
6eb1a2763604c6960b8f8e06716b71086a381ad746de79948a177fad17e50ead

SHA512
55cc145396e1f55d180732e43a4cfa50aff0590b2871e1bcfb0793b7a606fa6bfdc788baaef7462a068976777e049b72e4fcbe670b22f7061370df4f757b47c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579395.TMP

Filesize
864B

MD5
3072486265dcf27efcda9bebdbfedc9e

SHA1
1df8b5338cd41586cd110c96d7c9151b9f402e15

SHA256
76182d54968811559eb22cb342d9f5ede3d4859a4997ba86c622f4fdf72fa586

SHA512
2cb3c9504dff44a583ad589a017e7282954c33b557faf1e4403102c2dd39265d0a33d880961604f1c3a4a2546daeed012471bb36eb16f56c80c67656fbcf7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fcfcd5474ceb736654178eb161146cfb

SHA1
46710fbc55bf1cdc630dcfb908a4f3be9e8c0ff2

SHA256
cd394068ab709778cd1649631b440763211cb8b30ee369008937129cd8434bca

SHA512
c376153a65d08a06a85d3d992483f0f5c8bb9658dba6c51ce260dba41fcf8597606cfc95aa9c1076ecbb85bde541803e6e23b84d5ed7bedfee17f94411209cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2c049110dc76dd1ab24965867bad8c9e

SHA1
e82e247dd2102b13b233af8200080a66b2bdc05e

SHA256
b536757749436a5efe4eabeaac47e80ea443a684e2f17578b566b49761c17f37

SHA512
392c18dcf5a21c1083a167b182a41a47cd8d4c740b4dee95ef1d99c2dcdb1c97886efaadb7ea1736819e37534077671f7014e4b87e58f8e26ab5c77d5716685e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
54de2444dfb33b4f49cf6ba5dba4790a

SHA1
59ded55fe1e0ad27c8f52e94ad733e684c028603

SHA256
3e3efd1a66e5089b0276d94476ebc908e3a87bb7978f86dc96b98693349bfb75

SHA512
e7c0481fbd2cd28d07c0252c505ca9acb5e8ba252ae9299bcaed618ab97171d43be5d7fb112f99eb17d07ae6e95efc8f5c28bf5ae9e596b5820dfec0b216fc73

Download Submit
C:\Users\Admin\AppData\Local\del.bat

Filesize
56B

MD5
f62904abb27a3574e2e6121349ab4955

SHA1
35b3504f1d6bc88638a0721cf3d898eb0f95092a

SHA256
d31225722321313554e736bcd9debc4cb4c5ed6dce3921fa7839162fede832b6

SHA512
e8d1cf4c6a745790b2eaf4b3618703337313e3f561ba88982bc1a139aa4b5b29fd5f78f925e5bd12669eed74ca78510f6d6b1ce091bc55299057d2b2e867fb4e

Download Submit
C:\Users\Admin\AppData\Local\system.exe

Filesize
315KB

MD5
8825333afdf37171254bdeb14beb5139

SHA1
3bfd7d00aaef98944d07c05b946b0319c7c77829

SHA256
82578e40fedade1636d3ab4dd8bfde3f6d60118fbeb8f228455c0666cd27df19

SHA512
f191fd36de4e0ca7936145af1aae69c5a12ab99e36bab9bb71174ed1509007a77eb084af7ca797e08befa6be14adc4365c88de5656d0173d07a6dd52fd520072

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
8KB

MD5
1bc98ec6e27bb497df1aa9fea151839f

SHA1
f511cda34d5042479edd78bfcb1f35678d8af37b

SHA256
4f80eb99bbaf9c6016b7d9a135ccef4638d1e45cc6a68ac3cb2b7b5379ca8fc7

SHA512
735a24cd60ce85e5ccdcfdd2dd950b624b23d2189dcfd6a6730654268c67db7907f4a55926328c0fce118d8c153555e446e6d7e884372899facf4c8f99a99bcf

Download Submit
C:\Users\Admin\Downloads\CrimsonRAT.exe

Filesize
62KB

MD5
e935fd50972bcdbe0d592465e094618e

SHA1
f1f68f2e2c3bf405dd7bb368265948fdc47b6ecb

SHA256
733869da8a675170b308065c4454e3d424e214ee5b76bd866344d7e8ac734ce8

SHA512
e55249e379a2de67230f8df8c4d4961108342e892a512ae3578de7308acf315181c7a5bd3719da7424d36843d4be3ef4faa01b541144ffc590e8263150ac87bf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 23805.crdownload

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 269179.crdownload

Filesize
396KB

MD5
13f4b868603cf0dd6c32702d1bd858c9

SHA1
a595ab75e134f5616679be5f11deefdfaae1de15

SHA256
cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7

SHA512
e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 438950.crdownload

Filesize
5KB

MD5
fe537a3346590c04d81d357e3c4be6e8

SHA1
b1285f1d8618292e17e490857d1bdf0a79104837

SHA256
bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a

SHA512
50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 45570.crdownload

Filesize
1KB

MD5
dc635e7655d5830e9c0c82e1e1d4fc75

SHA1
ef2c7b40ee950aa88fc7a81d5496e03c1ff3bb9f

SHA256
4e6cfe80de249ffd28981228be838349c8fff904560d4afbff3c7a1b1cfbc144

SHA512
802fab46148debd7b962c652a37695aba395104b8ca097f34e6151323eb4560261653b8543e7a5ca89f798bd125a8cc1cee2eab08384c780826031997632a274

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 611942.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 858213.crdownload

Filesize
141KB

MD5
de8d08a3018dfe8fd04ed525d30bb612

SHA1
a65d97c20e777d04fb4f3c465b82e8c456edba24

SHA256
2ae0c4a5f1fedf964e2f8a486bf0ee5d1816aac30c889458a9ac113d13b50ceb

SHA512
cc4bbf71024732addda3a30a511ce33ce41cbed2d507dfc7391e8367ddf9a5c4906a57bf8310e3f6535646f6d365835c7e49b95584d1114faf2738dcb1eb451a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 858213.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 97097.crdownload

Filesize
315KB

MD5
9f8bc96c96d43ecb69f883388d228754

SHA1
61ed25a706afa2f6684bb4d64f69c5fb29d20953

SHA256
7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5

SHA512
550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
memory/1340-1253-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download
memory/1340-1255-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download
memory/1480-1052-0x00007FFC89850000-0x00007FFC8A311000-memory.dmp

Filesize
10.8MB

Download
memory/1480-1107-0x00007FFC89850000-0x00007FFC8A311000-memory.dmp

Filesize
10.8MB

Download
memory/1480-1108-0x000002117B690000-0x000002117B6A0000-memory.dmp

Filesize
64KB

Download
memory/1480-1509-0x00007FFC89850000-0x00007FFC8A311000-memory.dmp

Filesize
10.8MB

Download
memory/1480-1054-0x000002117B690000-0x000002117B6A0000-memory.dmp

Filesize
64KB

Download
memory/1480-1053-0x00000211788E0000-0x00000211791F4000-memory.dmp

Filesize
9.1MB

Download
memory/1520-1056-0x00007FFC89850000-0x00007FFC8A311000-memory.dmp

Filesize
10.8MB

Download
memory/1520-1018-0x000001F8B6520000-0x000001F8B653E000-memory.dmp

Filesize
120KB

Download
memory/1520-1020-0x000001F8D0A60000-0x000001F8D0A70000-memory.dmp

Filesize
64KB

Download
memory/1520-1019-0x00007FFC89850000-0x00007FFC8A311000-memory.dmp

Filesize
10.8MB

Download
memory/3008-1299-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4064-1300-0x000001E93D240000-0x000001E93D26E000-memory.dmp

Filesize
184KB

Download
memory/4064-1359-0x000001E957A10000-0x000001E957A20000-memory.dmp

Filesize
64KB

Download
memory/4064-1344-0x00007FFC89850000-0x00007FFC8A311000-memory.dmp

Filesize
10.8MB

Download
memory/4064-1372-0x000001E957A10000-0x000001E957A20000-memory.dmp

Filesize
64KB

Download
memory/4064-1312-0x000001E957A10000-0x000001E957A20000-memory.dmp

Filesize
64KB

Download
memory/4064-1311-0x000001E957A10000-0x000001E957A20000-memory.dmp

Filesize
64KB

Download
memory/4064-1508-0x00007FFC89850000-0x00007FFC8A311000-memory.dmp

Filesize
10.8MB

Download
memory/4064-1301-0x00007FFC89850000-0x00007FFC8A311000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads