risepro | hxxp://193[.]233[.]132[.]167/lend/win[.]exe

Analysis

max time kernel
120s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://193.233.132.167/lend/win.exe

Score

10^/10

risepro collection dave discovery spyware stealer

Malware Config

Extracted

Family

risepro

37.120.237.196:50500

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Spam.pif

description pid process target process

PID 4944 created 3584 4944 Spam.pif Explorer.EXE

description	pid	process	target process
PID 4944 created 3584	4944	Spam.pif	Explorer.EXE

Dave packer 3 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 820439.crdownload	dave
C:\Users\Admin\Downloads\win.exe	dave
C:\Users\Admin\Downloads\win.exe	dave

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

win.exe2BITscKeJvH_UqBrRF3s.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	win.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	2BITscKeJvH_UqBrRF3s.exe

Drops startup file 1 IoCs

Processes:

win.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS905.lnk win.exe
Executes dropped EXE 4 IoCs

Processes:

win.exe2BITscKeJvH_UqBrRF3s.exeSpam.pifSpam.pif

pid process

8 win.exe
5720 2BITscKeJvH_UqBrRF3s.exe
4944 Spam.pif
2592 Spam.pif
Loads dropped DLL 1 IoCs

Processes:

2BITscKeJvH_UqBrRF3s.exe

pid process

5720 2BITscKeJvH_UqBrRF3s.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS905.lnk	win.exe

pid	process
8	win.exe
5720	2BITscKeJvH_UqBrRF3s.exe
4944	Spam.pif
2592	Spam.pif

pid	process
5720	2BITscKeJvH_UqBrRF3s.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

win.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	win.exe
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	win.exe
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	win.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

95 ipinfo.io
96 ipinfo.io
Suspicious use of SetThreadContext 1 IoCs

Processes:

Spam.pif

description pid process target process

PID 4944 set thread context of 2592 4944 Spam.pif Spam.pif
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5088 2592 WerFault.exe Spam.pif

flow	ioc
95	ipinfo.io
96	ipinfo.io

description	pid	process	target process
PID 4944 set thread context of 2592	4944	Spam.pif	Spam.pif

pid	pid_target	process	target process
5088	2592	WerFault.exe	Spam.pif

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

win.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	win.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	win.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2764 tasklist.exe
4172 tasklist.exe

pid	process
2764	tasklist.exe
4172	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings msedge.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 820439.crdownload:SmartScreen msedge.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2140 PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 820439.crdownload:SmartScreen	msedge.exe

pid	process
2140	PING.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exewin.exeSpam.pif

pid	process
4456	msedge.exe
4456	msedge.exe
5116	msedge.exe
5116	msedge.exe
816	identity_helper.exe
816	identity_helper.exe
5316	msedge.exe
5316	msedge.exe
8	win.exe
8	win.exe
4944	Spam.pif
4944	Spam.pif
4944	Spam.pif
4944	Spam.pif
4944	Spam.pif
4944	Spam.pif
4944	Spam.pif
4944	Spam.pif

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

5116 msedge.exe
5116 msedge.exe
5116 msedge.exe
5116 msedge.exe
5116 msedge.exe
5116 msedge.exe
5116 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tasklist.exetasklist.exe

description pid process

Token: SeDebugPrivilege 2764 tasklist.exe
Token: SeDebugPrivilege 4172 tasklist.exe

description	pid	process
Token: SeDebugPrivilege	2764	tasklist.exe
Token: SeDebugPrivilege	4172	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

msedge.exeSpam.pif

pid	process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
4944	Spam.pif
4944	Spam.pif
4944	Spam.pif

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5116 wrote to memory of 3976	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3976	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 1788	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4456	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4456	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 5104	5116	msedge.exe	msedge.exe

outlook_office_path 1 IoCs

Processes:

win.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	win.exe

outlook_win_path 1 IoCs

Processes:

win.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	win.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://193.233.132.167/lend/win.exe
2⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef88f46f8,0x7ffef88f4708,0x7ffef88f4718
3⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
3⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
3⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
3⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
3⤵
PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
3⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
3⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
3⤵
PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
3⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
3⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5664 /prefetch:8
3⤵
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
3⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6116 /prefetch:8
3⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2180,14148439986578591147,17314984680016500073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5316

C:\Users\Admin\Downloads\win.exe
"C:\Users\Admin\Downloads\win.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:8

C:\Users\Admin\AppData\Local\Temp\heidiRpmAGRJFpL7R\2BITscKeJvH_UqBrRF3s.exe
"C:\Users\Admin\AppData\Local\Temp\heidiRpmAGRJFpL7R\2BITscKeJvH_UqBrRF3s.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5720

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k move Left Left.bat & Left.bat & exit
4⤵
PID:5108

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
5⤵
PID:6072

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
5⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
cmd /c md 7907
5⤵
PID:2068

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Moved + Promised + Relief + Bumper + Evaluate 7907\Spam.pif
5⤵
PID:712

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Post + Retired + Nv + Whose + Slovak + Detective + Festival + Christianity + Qualification 7907\o
5⤵
PID:5028

C:\Users\Admin\AppData\Local\Temp\7907\Spam.pif
7907\Spam.pif 7907\o
5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:4944

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
5⤵
- Runs ping.exe
PID:2140

C:\Users\Admin\AppData\Local\Temp\7907\Spam.pif
C:\Users\Admin\AppData\Local\Temp\7907\Spam.pif
2⤵
- Executes dropped EXE
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 440
3⤵
- Program crash
PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2592 -ip 2592
1⤵
PID:2960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Filesize
124KB

MD5
c5f4512c612cc7343bb50e7417d6ed53

SHA1
0119927fa369c784c57718f4ea8f87a732e26ef0

SHA256
d8374e3363a430c33b223788d5d676caa4f8d453be2609361aba02802ec8d097

SHA512
93d6c20f57066273ef93173203c4532316b1d723419a44377abbf22caae3acedc890c7fc408ddc8f4b6a3d89d1c06496190b784197f4195bff9ea81b97ffa16d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Filesize
124KB

MD5
e9e7f5dc48ea4431ad61a9132019d637

SHA1
5662c54ba7751f859b07b7839cfcba0b17557cf9

SHA256
e8a8f99d3aad8fb71247d2a3bf28da8e113b796b174bd697fe4a5ef13c209f99

SHA512
c25eb875b7fad70550e82d31022c69c977e2a8df6108739ddae5b51b47ba008fdc2c4d9636eef918826c91d0f5edd4f911c8990729b0b3ed55b300a66f0da66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
cc0bdfafb139f3012c1f485ea11c3202

SHA1
2d899440687e510a9d2cd09edde4dab6cf256991

SHA256
e59d4ed03170d06d154a1e90b95c1f7c8ed87f3ddda2940aecd5c75d9fd3641e

SHA512
c6c14a076930462020f1254f1820fc44380f07f1771fad28221edfcff81d8814a748312dfedfa33bb7a1af67c984db8afed23e0f7fe5d088fc08b3c6c37ac712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1fea49af4687ce67fed3cba2ac1293b2

SHA1
525bbd3c13728cf6b8865b5a76cbb0a08b73a6e5

SHA256
9bb6387cb389f09e5d27dda07effa025e9a6cdc7226b80d80d155003d6893792

SHA512
7e0289c9573ad04e1838a87f33bc3acb3c0479f63a3455e382907b33826954bdce1e2da9953421f73ae01502b3f18caf8b7c9f716f40e26629db733f3131af14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
59f2477c072f32a10db6fb9c64a6ed35

SHA1
33ee03f5bd5153a672027822b463dfae18568e9f

SHA256
3fafa1a2a1bc4b19980096aead936cd04d6cc2dc0b085eb4de0b6d2f8994f9d5

SHA512
2e626dc40a67445bf70e1a3d1494dbf0107cdf94fc5bb4ea979696af6a373f35775a9ac972207f3d64d74eb5371e49ae543ae81197e4ac730b3ca162186b13d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
15f363bb0ae9335a364a59c95a096aa6

SHA1
8a8131ae624a910c88d2fa0381e70e92758626bf

SHA256
2ceabc4ccd7b85cefeeb953ef1bb7174f8bd003cc095314d4eb2147264df6fb5

SHA512
e4e0fea6f5a52925e3940bcc987d2bb517a4b9bdcbc1d38fed54fe53e44823a610acdd3c7de15fce35b73751f963e44b44901f5aec4fd43e12a5b89e587a8fb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
5d225cb15fb88861116dcae4905cc678

SHA1
c639953e8ca5a750528a4955049325bd1d70f7a9

SHA256
a4dfd3245f093bc0b61c81875c460841ebb7f4f3ef0073d8a4f579dfc54ebfd0

SHA512
90dbc73b3460d418d9257069405f61be752f21aa2f91b1d67270610e1e1661982b0d83f4d44b783f585a220a09157fcacea8a189f00d80aca1a4bb6c8644c1bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
674f644b0ae454e3ee63bc340cd7b7d2

SHA1
2356b53f651bdabebfb093e998836b9e79f4cb2d

SHA256
0245c22635b398a82de48d9eba238a49f8d220dfc753f4a4834623694c71510e

SHA512
35fc77971ca3844a2b1f256fd3b0a5367e4305e40a816a7d7ae883f061eebe96856cc0e65d72658a22c435bb92af3cec138c8ddc0ffd2c9ada667710e9e6025f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
eb29f0a8d3240b421321fd15668bfb77

SHA1
1eb960492f48e0c17a8305dd3ed9093318a01507

SHA256
27bf1329e23989d03377d707dbb7a17b4c2fa2616f93417fb28dbc3ec8dd4459

SHA512
0d2a490337f945128b018b50de1ebbd850f72100bb4d73c0b8b9584f294fe2d2007c5a14a8c91559e4699225728b4a1560f15b7f93c8292a36e791c03eec236f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7907\Spam.pif
Filesize
924KB

MD5
848164d084384c49937f99d5b894253e

SHA1
3055ef803eeec4f175ebf120f94125717ee12444

SHA256
f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

SHA512
aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7907\o
Filesize
2.2MB

MD5
419668cd07c465b03d15a998ea0eef5c

SHA1
b04b834426d2652169369aaae212278639144291

SHA256
5e2799089096a3878d61a42a4ff62c60f2139f7df94535b8ebd0b34d75066a6b

SHA512
d6430945a5c2e6f95b29113b92cee5b3bfd5188aed3341c7f6b4969854e0cedbd3f853ab353f82d144a5636228307aad27065a0e7125631bf13a2d85954da253

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bumper
Filesize
134KB

MD5
154491f13ce990c77215dbfb6849dd06

SHA1
f82d91acda467c95abce20c0bb7a556bde66d335

SHA256
7d0b66dc5019dd830de74e011e4485e12c461ba026dc906a05f1a9d732594132

SHA512
43235b36710e37336593109b54534cf19d9342f6a2c47f25d4e653ecbb4bcec258fe46bacdce9d714b13eff893722bc445bdb14d5acaeeb96d35a357cb21582c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Christianity
Filesize
14KB

MD5
02c3f31039c0dfbbc720f9f913d9a55f

SHA1
d1fb52472fb995bbce96018c5c2c97d521b37550

SHA256
6a9a87db20709ce551d161fa7507321ce2b421ca4667fd11b4e81287bd1fed6c

SHA512
67d696ff4014033c84ba2441e9f381fca4dadb2c5265a20a9a4f0f8a096175bbbf3d49dd10288e15bbc611be1bf16a31ec5288ffe203b729d65b4023f14bc146

Download Submit
C:\Users\Admin\AppData\Local\Temp\Detective
Filesize
218KB

MD5
e87ca2b05a0eb3e95d2523dd82a392ac

SHA1
5ed9391e9fb453500d32909f2e21ace6b44e61d1

SHA256
558c081e93b9b86252f1cd2f9632b5a2ea6a9c472c2764c2c7e353239d06d8ad

SHA512
9bac8cdbf064f6616d8dbe766c2cf76cf7ac14b1bc3c1790219b67af92a2e32703c51261fcbccd6091ece58a25c5d2d0d6c75af03e2e79143ee2998b95baed0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Evaluate
Filesize
231KB

MD5
eb7601bfd381ee69439aa828e4f0c67c

SHA1
53ee192c4d3f9bd52e7ff438d70694d1c23a2f25

SHA256
c311ac3c2646b8ba878087d422e70de22aba04b8141dd5e1e29085ee74b892d7

SHA512
70e5f250046b3ef2c94c19cfba6eaa50f9d4560c55e35701a587b2e8bb9cbc6bda876cace4bebf983e8f34604801a1dc4a60c092b1a43915acd653a9c6f7fe84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Festival
Filesize
285KB

MD5
d8784ed8c4149195991ea9a4194b4db7

SHA1
8dcc20d9e39a3949bb5b171799e96c187f2b42fc

SHA256
db42872cf15da2b48bcd06150763bfde37235a56ab0ff916a9b411e35b4da4c9

SHA512
f9fc051b63ecc23d2452d3f9f249cc8c4e22abc0d1ad26d957d0cfe797382f5149de04c16cb7b0332de7fd1c5848340db59f155e42934ded27f9830028379941

Download Submit
C:\Users\Admin\AppData\Local\Temp\Left
Filesize
13KB

MD5
021711fcc70bdf0ca078411075e32a17

SHA1
ff70f1c694ffb686ed0ac50f0bc72b86cce24536

SHA256
4f416c396293017ee17ca23852ccc6e27b94dbe62961b8c49d1fb1305c870862

SHA512
ffbfb4ac63907f7b7c482e41c9804d4f0207907d4309b1e977db943134e709fdcfff218668977b6af0839e960ec55ee425e2c582346f0b4f32e87ed785814178

Download Submit
C:\Users\Admin\AppData\Local\Temp\Moved
Filesize
147KB

MD5
67385bc1cd90a374a2da0bc52ff74d66

SHA1
89793792148e91c155cfb828272291f6db2d2d87

SHA256
6597c4deda0a57475b098b7a0e48d2e40dc699cdcae927115a6788ff38911be7

SHA512
a9b893a6484af8a266e3dc0aec408ec1da6597248b779e811ce7190f687955ad9114d597894b67c9aa8f6161e4cfff5bb23be532c09618e0085777b79fbfac25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nv
Filesize
249KB

MD5
b16d99d5ebd8c7ecee12e451f0d46fcf

SHA1
40fc682a3b0eee64cebdb57960c9014ecd9eb7e5

SHA256
52fd269c181b08103dcd01115e926d391394c699c18bd2d51affd8a3fa3ec7ad

SHA512
6c2f565aff04cea2320aa108c5a624e9f41df27879aae5ff82439251568acca65841b5655cd78e9b5c025b6eb3932b68a18c9fc987bca147baa5aab1d934d692

Download Submit
C:\Users\Admin\AppData\Local\Temp\Post
Filesize
207KB

MD5
25ec45f80bcba1a7f582d7b8db0bcd3c

SHA1
870df7ab0fa8265f30db5ca2d178558975033224

SHA256
0ad3d730d21cc5178f67414dd6509e83a6876c41abc926f6325b64674c54a62a

SHA512
8671318daaf168c248cf1294564c8b05a440f39034ce8aeef8b53a4d96040e673d1104ba8695e8ce32e821aa12b96b994c92896664832a48d5363e82add3d4de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Promised
Filesize
213KB

MD5
bc974f378c247e31d48c7f764c006221

SHA1
b66c86c59b4b3fde799a37d10d48b4385aae0b21

SHA256
f8ef33e21909ba93fc08db70d5c5698a20dc8aef678b9b1e81fdf029e8704de4

SHA512
1cc7054fb7b88b44ad143fb30116a39b21c20a961a96b827aa1687de50b37986601830f362cb52f0b062223d6fe74157e70d9ba376fecdeaa2b66259fe741e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qualification
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Relief
Filesize
199KB

MD5
a4168a8e7e9c8ad22ab368444574c25e

SHA1
e9e0cb0d1ead4a69df897f9363c25f493be81566

SHA256
5da2a3c2587bf4296ee89ad10c4a6e435358420558af7a97a205f88f17ff7e2b

SHA512
656abf6c81a62e78c3848893d51344403d5eece234c2e5e43cdb1fbfa0da6e7936c72ccd947fc61043ab8e0e80598f26ae5e8c05fb6ce8e7fb679dda5d9ecd61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retired
Filesize
234KB

MD5
3a7da0f9bf184618827466672c58f9a8

SHA1
ae5d8481be71e9d359db4b76f292157058f15c06

SHA256
cebb2954fd69cbe2ff998692d98ee8b1a893c5003311d67b039959d6ce317e7b

SHA512
5b95901195691769c327f1f092884acf9cd16f64a8064a6da38cb45b57fac2ce05e7d72edc895ee792e7cf1a738c4d80cacebe9e799832824d464f72f2b2e7ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Slovak
Filesize
270KB

MD5
68eddfe78c76a2507e917dfcc6de6d48

SHA1
045bef7d0b93a0a0c650afbcf64acf46efa1690b

SHA256
c0c42e2cb63d59f681b72ca66a2f2a62827a95dad9cb5a67d0d2c44844e7a81f

SHA512
3dc13bc5de378007f1eb75fab043747b6533945b77b662599b7ee67360a16357f96b433334497377abddd7e4f85ce366f69fee5c3aa35df16ecba476633469dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Whose
Filesize
270KB

MD5
63e45b75b0775b07fa4f41584e78b989

SHA1
ba0e039c90958e7ea9da722f9ce1f9f6d2ab6abf

SHA256
83a147a0f76c7a9bd0d9def09ac331f987ee55b96bd0d9b32248ba2bff26ac60

SHA512
106e35a611aab043d8009ff78f66853e1b813410a42185fe117ab9a53d7bddf18e01263a6b3a7c6de87b6bdb966047265ca349fc7fa1e2084d44520d9ff3c9f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\adobeRpmAGRJFpL7R\Browsers\Vault_IE\Passwords.txt
Filesize
5KB

MD5
cb415a199ac4c0a1c769510adcbade19

SHA1
6820fbc138ddae7291e529ab29d7050eaa9a91d9

SHA256
bae990e500fc3bbc98eddec0d4dd0b55c648cc74affc57f0ed06efa4bde79fee

SHA512
a4c967e7ba5293970450fc873bf203bf12763b9915a2f4acd9e6fa287f8e5f74887f24320ddac4769f591d7ef206f34ce041e7f7aaca615757801eb3664ba9a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\adobeRpmAGRJFpL7R\information.txt
Filesize
4KB

MD5
69dd458687b0f5a6b988143b6a925911

SHA1
6044e1d8668b2c07ef7b4d6b11b97c20676139c8

SHA256
f28a11d3623335de868df0d61aeac6ee114ecf35e9bcd9b272879a57bf5224bd

SHA512
a62da1b556a7cf4ccb6bd2c84af336d6402f46d9650c0497ca21ccc09d6a22f7290766565daa26e0835a1d9a4c139f9a9ddd05520da96e0867d46aa78d43e16b

Download Submit
C:\Users\Admin\AppData\Local\Temp\heidiRpmAGRJFpL7R\2BITscKeJvH_UqBrRF3s.exe
Filesize
1.5MB

MD5
4aec8fc0de556e4b0f1e7eb8b9c8d677

SHA1
390d9ed11702fe6447cde6bfaf99d02df73d1988

SHA256
c621f56dc277c729e8db5134047c7a91205e8a8990d97a74a82eb389cdc8428c

SHA512
ea618b11cabb46b9d0a457db93a05b08d7e15813a4acad1e64eaa8603b30f5570d0a8f73267b191d24e35698c6835704fdc7ec3515a9e9ae746ba515049fc9f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\heidiRpmAGRJFpL7R\QdX9ITDLyCRBWeb Data
Filesize
92KB

MD5
202f2ef53f2db2c911585e9fc250d7b8

SHA1
eb88b73f2fbeb0994b21c08aa71d467ef12c1546

SHA256
c6f58d159d4de36d38a1b6c4ebdc89f68ee371086da8f478478d3f581ccedfee

SHA512
ec980b528288e9169862b6a7c058bf7794ec8ac68ef10a262d34aecd63d47c41874b23fed43ea85d21d3dfc707b97a549523afbb6aff1ad36ee74a25bc2a0407

Download Submit
C:\Users\Admin\AppData\Local\Temp\heidiRpmAGRJFpL7R\ZunTSaNJLBVfWeb Data
Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf5252.tmp\System.dll
Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 820439.crdownload
Filesize
4.3MB

MD5
a263a25d204194fa5e17f07330b9a411

SHA1
a1d4f97dd06f2e3bb343a564601a6055e12ebcec

SHA256
faea4ccd802391bf9a6d71bc6052f269b6ca370c124bfe4d2faae55b43a5c0c8

SHA512
003d70099729511e04ca0104a5315aba1495112bcdd64e3f07d2286a9f0e61b1fa6a8ca78d296220bd835b9c2a741813fa5a57dc9f86650492dc3b228d6e3ac5

Download Submit
C:\Users\Admin\Downloads\win.exe
Filesize
2.5MB

MD5
5000bc568695720bec435bf44a993164

SHA1
95ce7284b800c5579f7dfa7473c90afe842114e7

SHA256
41f1a8378439c4cc27f5ca7b20a8f58fc93749987afddc12bc727a8da7c42567

SHA512
fe46268985987df20e49ba07c1586b6fc7674edb498615e6d68e06f301371875e742fb0878a46fdb50770deac4bbd76ab40cd46059c02df2bca7e27b2d52d6a8

Download Submit
C:\Users\Admin\Downloads\win.exe
Filesize
4.2MB

MD5
26653a8e2b5cae12604dfea2c4e10b14

SHA1
421ba90684c94773e6e61ba84b2c98f18f87d4cd

SHA256
c0013ce7ebaf9c19973869ae29863d3007d28da7eef072390a3951cee1bc6e8a

SHA512
2b86ca0922301c68398679c66c3b9f339a13a007877af91a16d515626cf4a5c8d7b5671a4e24f5d47d65c7a88f38f3676729f3bec2852a770a31f64a8af66830

Download Submit
memory/8-163-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-101-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-165-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-166-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-124-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-103-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-102-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-164-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-180-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-188-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-193-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-382-0x0000000004050000-0x00000000040C8000-memory.dmp

Filesize
480KB

Download
memory/8-365-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-380-0x0000000002CD0000-0x0000000002E14000-memory.dmp

Filesize
1.3MB

Download
memory/8-377-0x0000000004050000-0x00000000040C8000-memory.dmp

Filesize
480KB

Download
memory/8-376-0x0000000003C40000-0x0000000003C41000-memory.dmp

Filesize
4KB

Download
memory/2592-372-0x0000000001400000-0x0000000001531000-memory.dmp

Filesize
1.2MB

Download
memory/2592-373-0x0000000001400000-0x0000000001531000-memory.dmp

Filesize
1.2MB

Download
memory/2592-375-0x0000000001400000-0x0000000001531000-memory.dmp

Filesize
1.2MB

Download
memory/2592-370-0x0000000001400000-0x0000000001531000-memory.dmp

Filesize
1.2MB

Download
memory/2592-369-0x0000000001400000-0x0000000001531000-memory.dmp

Filesize
1.2MB

Download
memory/4944-368-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Filesize
4KB

Download
memory/4944-364-0x0000000077781000-0x00000000778A1000-memory.dmp

Filesize
1.1MB

Download