8c95c98f859a710df269e341e65ccc2b4adbb1c46de3a0f73ed973f041d2d556

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

netcut [PeskTop.com].exe
Size

4.7MB
MD5

45d5a5663020b63ec3558b4100b89346
SHA1

5b4eb6745d19573a607166b2202ef064cce768f4
SHA256

8c95c98f859a710df269e341e65ccc2b4adbb1c46de3a0f73ed973f041d2d556
SHA512

7f14bee157e3332861246d20f59d77376ed72b319d3471db7108aa6b2df0c1819e846655d84a5c52a0a91930aa105cfd5afcb31baa999e68d0811204943f9e96
SSDEEP

98304:N1QTocUSA8tqF6jM7E6E9L/ZhoI5Y2U1zVRQyWI4hK:bGUSVjM7E60L/ZKI5Y2UVRZ9kK

Score

8^/10

discovery evasion

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\npf.sys	WinPcap_4_1_3.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Downloads MZ/PE file

Drops file in System32 directory 40 IoCs

description	ioc	Process
File created	C:\Windows\system32\wpcap.dll	WinPcap_4_1_3.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6bb5d77c586966a36877820fc3fb9aa3e	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6931ee80379dec9628bce0d1e826dcad3	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6dbb8630c5b10f9ff89da03ea52813e8f	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea60ce63b5cf66b3df90c3afae21cf010cc	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6046eadd977f10f932beb8acb6c9c89ab	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6d2bce69a5642d722003628dd448eb370	netcut_windows.exe
File created	C:\Windows\SysWOW64\Packet.dll	WinPcap_4_1_3.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6add9435a630284647865a24123d8115f	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea68bd97e7839767694a007145aa9958b36	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6d1e3a9b87b0cbb589fd731360262faec	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea630d6f81050ce425283e5761c8a27cffd	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea60e020214b540b6545dab43e6ec545d95	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea62d39066544fd08083e75166665e4b1b7	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea61a850dd382949764c8ba6c18866a349c	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6a27beb8b4ae709a49e7f5d6d6c10c355	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea61c2421735e4b58decb3d4aa31f5e7e87	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6413e93ba36acba1fefc51f278b8e4ed3	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea61b2ba9f8be0922e299d098bb1cf368b4	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6e92c7c8fea72080c46f6f60c78a7759f	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6f5b979911ce0da9a953e309b2fa2a453	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6b8207202753c09a34b97f789f0cfe09e	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6e41ef2a7db539b83e4a556b763506168	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea612862572778e4d30e5660ff35513e947	netcut_windows.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	WinPcap_4_1_3.exe
File created	C:\Windows\system32\Packet.dll	WinPcap_4_1_3.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6b606d5c2a53663dcd8e374efa3780780	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6550dcecad151e65e7a081754048e48df	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea67f9b1dd4795dcd0b1386c4e55db64133	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea60eb8fa1280c96e4bd1ff2ab153c4031f	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6485aaeddad69ba71003bd8e902ba2f4a	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea67fa75124811301e7c714ebf47429e316	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6313ae3aea62c9470f45f08455302fbb7	netcut_windows.exe
File created	C:\Windows\SysWOW64\wpcap.dll	WinPcap_4_1_3.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea6a60a0c154cf9b846b196ab49a83ad560	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea637e3bba22362346e0d1ba2f647091f41	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea60ec6ce6825d62d558d7a2b62d47456b5	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea68e3d741b4bd1bdca5b5ff26369a9822c	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea62087aa260c17c397692d669dd690862b	netcut_windows.exe
File created	C:\Windows\SysWOW64\7156cd604d1d8fa0367acd8a32b1aea67de5b4fac766b43e3b748abc822f3826	netcut_windows.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\arcai.com\WinPcap_4_1_3.exe	netcut [PeskTop.com].tmp
File opened for modification	C:\Program Files (x86)\arcai.com\account	netcut_windows.exe
File opened for modification	C:\Program Files (x86)\arcai.com\schedule	netcut_windows.exe
File opened for modification	C:\Program Files (x86)\arcai.com\mtu	netcut_windows.exe
File opened for modification	C:\Program Files (x86)\arcai.com\netcut_windows.exe	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\WinPcap\WinPcapInstall.dll	WinPcap_4_1_3.exe
File opened for modification	C:\Program Files (x86)\WinPcap\WinPcapInstall.dll	WinPcap_4_1_3.exe
File opened for modification	C:\Program Files (x86)\arcai.com\lag	netcut_windows.exe
File created	C:\Program Files (x86)\arcai.com\is-6M0MJ.tmp	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\arcai.com\mac2nodename2	netcut_windows.exe
File opened for modification	C:\Program Files (x86)\arcai.com\realmtu	netcut_windows.exe
File created	C:\Program Files (x86)\arcai.com\is-ED94O.tmp	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\WinPcap\install.log	WinPcap_4_1_3.exe
File created	C:\Program Files (x86)\arcai.com\ac2	netcut_windows.exe
File created	C:\Program Files (x86)\arcai.com\blacklist	netcut_windows.exe
File opened for modification	C:\Program Files (x86)\arcai.com\aips.exe	netcut [PeskTop.com].tmp
File opened for modification	C:\Program Files (x86)\arcai.com\msvcp120.dll	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\arcai.com\unins000.dat	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\arcai.com\is-O61Q4.tmp	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\arcai.com\schedule	netcut_windows.exe
File opened for modification	C:\Program Files (x86)\arcai.com\macdata	netcut_windows.exe
File created	C:\Program Files (x86)\arcai.com\lag	netcut_windows.exe
File created	C:\Program Files (x86)\arcai.com\account	netcut_windows.exe
File created	C:\Program Files (x86)\arcai.com\is-NPSMM.tmp	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\arcai.com\is-IOTT3.tmp	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\arcai.com\is-075MU.tmp	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\arcai.com\is-IKUAN.tmp	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\arcai.com\mtu	netcut_windows.exe
File created	C:\Program Files (x86)\arcai.com\netcut_windows.exe.dat	netcut_windows.exe
File opened for modification	C:\Program Files (x86)\arcai.com\mac2nodename2	netcut_windows.exe
File opened for modification	C:\Program Files (x86)\arcai.com\account	netcut_windows.exe
File opened for modification	C:\Program Files (x86)\arcai.com\blacklist	netcut_windows.exe
File created	C:\Program Files (x86)\arcai.com\is-RE1MB.tmp	netcut [PeskTop.com].tmp
File opened for modification	C:\Program Files (x86)\arcai.com\unins000.dat	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\WinPcap\Uninstall.exe	WinPcap_4_1_3.exe
File created	C:\Program Files (x86)\arcai.com\realmtu	netcut_windows.exe
File opened for modification	C:\Program Files (x86)\arcai.com\msvcr120.dll	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\arcai.com\unins000.msg	netcut [PeskTop.com].tmp
File created	C:\Program Files (x86)\WinPcap\rpcapd.exe	WinPcap_4_1_3.exe
File opened for modification	C:\Program Files (x86)\arcai.com\ac2	netcut_windows.exe

Executes dropped EXE 7 IoCs

pid	Process
2324	netcut [PeskTop.com].tmp
4640	WinPcap_4_1_3.exe
4052	aips.exe
1380	aips.exe
860	netcut_windows.exe
2392	netcut_windows.exe
1404	netcut_windows.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1784	sc.exe

Loads dropped DLL 29 IoCs

pid	Process
4640	WinPcap_4_1_3.exe
4640	WinPcap_4_1_3.exe
4640	WinPcap_4_1_3.exe
4640	WinPcap_4_1_3.exe
4640	WinPcap_4_1_3.exe
4640	WinPcap_4_1_3.exe
4640	WinPcap_4_1_3.exe
4640	WinPcap_4_1_3.exe
4640	WinPcap_4_1_3.exe
4640	WinPcap_4_1_3.exe
4640	WinPcap_4_1_3.exe
860	netcut_windows.exe
860	netcut_windows.exe
860	netcut_windows.exe
860	netcut_windows.exe
860	netcut_windows.exe
860	netcut_windows.exe
860	netcut_windows.exe
2392	netcut_windows.exe
2392	netcut_windows.exe
2392	netcut_windows.exe
2392	netcut_windows.exe
2392	netcut_windows.exe
1404	netcut_windows.exe
1404	netcut_windows.exe
1404	netcut_windows.exe
1404	netcut_windows.exe
1404	netcut_windows.exe
1404	netcut_windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0009000000023150-34.dat	nsis_installer_1
behavioral1/files/0x0009000000023150-34.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	aips.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	aips.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	aips.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	aips.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	aips.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2324	netcut [PeskTop.com].tmp
2324	netcut [PeskTop.com].tmp
2392	netcut_windows.exe
2392	netcut_windows.exe
2392	netcut_windows.exe
2392	netcut_windows.exe
3032	msedge.exe
3032	msedge.exe
3568	msedge.exe
3568	msedge.exe
2392	netcut_windows.exe
2392	netcut_windows.exe
5008	identity_helper.exe
5008	identity_helper.exe
1404	netcut_windows.exe
1404	netcut_windows.exe
1404	netcut_windows.exe
1404	netcut_windows.exe
1404	netcut_windows.exe
1404	netcut_windows.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2324	netcut [PeskTop.com].tmp
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2324	1892	netcut [PeskTop.com].exe	89
PID 1892 wrote to memory of 2324	1892	netcut [PeskTop.com].exe	89
PID 1892 wrote to memory of 2324	1892	netcut [PeskTop.com].exe	89
PID 2324 wrote to memory of 1784	2324	netcut [PeskTop.com].tmp	97
PID 2324 wrote to memory of 1784	2324	netcut [PeskTop.com].tmp	97
PID 2324 wrote to memory of 1784	2324	netcut [PeskTop.com].tmp	97
PID 2324 wrote to memory of 4640	2324	netcut [PeskTop.com].tmp	99
PID 2324 wrote to memory of 4640	2324	netcut [PeskTop.com].tmp	99
PID 2324 wrote to memory of 4640	2324	netcut [PeskTop.com].tmp	99
PID 4640 wrote to memory of 4508	4640	WinPcap_4_1_3.exe	103
PID 4640 wrote to memory of 4508	4640	WinPcap_4_1_3.exe	103
PID 4640 wrote to memory of 4508	4640	WinPcap_4_1_3.exe	103
PID 4508 wrote to memory of 4540	4508	net.exe	105
PID 4508 wrote to memory of 4540	4508	net.exe	105
PID 4508 wrote to memory of 4540	4508	net.exe	105
PID 2324 wrote to memory of 4052	2324	netcut [PeskTop.com].tmp	106
PID 2324 wrote to memory of 4052	2324	netcut [PeskTop.com].tmp	106
PID 2324 wrote to memory of 4052	2324	netcut [PeskTop.com].tmp	106
PID 1380 wrote to memory of 3972	1380	aips.exe	109
PID 1380 wrote to memory of 3972	1380	aips.exe	109
PID 1380 wrote to memory of 3972	1380	aips.exe	109
PID 3972 wrote to memory of 860	3972	cmd.exe	111
PID 3972 wrote to memory of 860	3972	cmd.exe	111
PID 3972 wrote to memory of 860	3972	cmd.exe	111
PID 1380 wrote to memory of 2392	1380	aips.exe	112
PID 1380 wrote to memory of 2392	1380	aips.exe	112
PID 1380 wrote to memory of 2392	1380	aips.exe	112
PID 2324 wrote to memory of 3568	2324	netcut [PeskTop.com].tmp	116
PID 2324 wrote to memory of 3568	2324	netcut [PeskTop.com].tmp	116
PID 3568 wrote to memory of 8	3568	msedge.exe	117
PID 3568 wrote to memory of 8	3568	msedge.exe	117
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118
PID 3568 wrote to memory of 2580	3568	msedge.exe	118

C:\Users\Admin\AppData\Local\Temp\netcut [PeskTop.com].exe
"C:\Users\Admin\AppData\Local\Temp\netcut [PeskTop.com].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\is-QR4HE.tmp\netcut [PeskTop.com].tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QR4HE.tmp\netcut [PeskTop.com].tmp" /SL5="$70092,4187543,816640,C:\Users\Admin\AppData\Local\Temp\netcut [PeskTop.com].exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\system32\sc.exe" stop aips
    3⤵
    - Launches sc.exe
    PID:1784
- - C:\Program Files (x86)\arcai.com\WinPcap_4_1_3.exe
    "C:\Program Files (x86)\arcai.com\WinPcap_4_1_3.exe"
    3⤵
    - Drops file in Drivers directory
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:4540
- - C:\Program Files (x86)\arcai.com\aips.exe
    "C:\Program Files (x86)\arcai.com\aips.exe" install
    3⤵
    - Executes dropped EXE
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.arcai.com/netCut/s
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda4b446f8,0x7ffda4b44708,0x7ffda4b44718
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6433644133595397465,7957005520316611626,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5984

C:\Program Files (x86)\arcai.com\aips.exe
"C:\Program Files (x86)\arcai.com\aips.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\arcai.com\netcut_windows.exe" -v
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Program Files (x86)\arcai.com\netcut_windows.exe
    "C:\Program Files (x86)\arcai.com\netcut_windows.exe" -v
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:860
- C:\Program Files (x86)\arcai.com\netcut_windows.exe
  netcut_windows.exe
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -d
  2⤵
  PID:5856
- - C:\Windows\SysWOW64\ARP.EXE
    arp -d
    3⤵
    PID:5592
- C:\Program Files (x86)\arcai.com\netcut_windows.exe
  netcut_windows.exe
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WinPcap\WinPcapInstall.dll

Filesize
91KB

MD5
e78291558cb803dfd091ad8fb56feecc

SHA1
4bde2f87e903fe8d3bd80179c5584cec7a8cbdc4

SHA256
d9f4cd9f0e1bc9a138fb4da6f83c92c3e86eb3de4f988d5943d75c9b1dc6bb9d

SHA512
042b96bc2c0e6d8b6e2730426938eb7400fd833be8a108a4942f559fedefabc35fd5dcb7ea1898d377b4382c0a9af8eeeebd663a4c852c706e3bd168c1f1f62f

Download Submit
C:\Program Files (x86)\arcai.com\WinPcap_4_1_3.exe

Filesize
893KB

MD5
a11a2f0cfe6d0b4c50945989db6360cd

SHA1
e2516fcd1573e70334c8f50bee5241cdfdf48a00

SHA256
fc4623b113a1f603c0d9ad5f83130bd6de1c62b973be9892305132389c8588de

SHA512
2652d84eb91ca7957b4fb3ff77313e5dae978960492669242df4f246296f1bedaa48c0d33ffb286b2859a1b86ef5460060b551edca597b4ec60ee08676877c70

Download Submit
C:\Program Files (x86)\arcai.com\account

Filesize
1KB

MD5
91a16571ed40e30e4bdea2a4b31bab16

SHA1
68980afd2b381bfa541a1138a76d1a72ea89a5d7

SHA256
97342e537a4b51bdfc4f23c2cefff6f4fca6869423d9fbc15e656f330bdc3c50

SHA512
aa0afb59149e8b2d980a38082df03ae6efb7b1cfb50707e959f24505b0246a8489328ca6062ce5a84e564de7a8d1005ffb598c0b681b195f83775f3682fe2951

Download Submit
C:\Program Files (x86)\arcai.com\aips.exe

Filesize
1.8MB

MD5
a0360a3f8aa74aa5408bf4e105316311

SHA1
e1072ce99107747fc9654535d809fc6e1f9d9bda

SHA256
8c00ca171af3318b7845dbdcecc0fbeb7fcdca50d2c83f4055cce0c01820cd79

SHA512
72fd81c510539ba9d79eb7f18498eb89b116e3aa3c00f4498687c95d924cca65a47e1595a80d71b279d5fd64ed16ed468b700bf4508568f94dbdd9f0a6b603c6

Download Submit
C:\Program Files (x86)\arcai.com\macdata

Filesize
605KB

MD5
bff4d2ab64370d2c7c3395614e78d148

SHA1
fbd55d9118e07e1893eff56bcf28187bb19590fc

SHA256
e2410b2b245a82dea976f4ebe93d091c4f3dee8ae7d6d5e4d614437c60c54ac3

SHA512
16e42e86c1a2306560cfd17902b776b58eaf294e25f3ee783dcdd9e78fbdd4a7b667b8f5deab0643f5ac87ffd9c31e30b59c8a4068b5286348157bd1c17d8709

Download Submit
C:\Program Files (x86)\arcai.com\msvcp120.dll

Filesize
444KB

MD5
fd5cabbe52272bd76007b68186ebaf00

SHA1
efd1e306c1092c17f6944cc6bf9a1bfad4d14613

SHA256
87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

SHA512
1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

Download Submit
C:\Program Files (x86)\arcai.com\msvcp120.dll

Filesize
384KB

MD5
e844ecfd5b946ab576f9224280784066

SHA1
400db3bbaab43ad765683ebb222261444ca49e5e

SHA256
34c7eb191ccb21e5e313bc07b22b00019afadcf8f2b4786bb1c5dd6d86c8aea4

SHA512
df50c899938a1192355e259739d6e9175b2db34842c0bdc5dbdd7da93816dbc44f7dc25b4a396015325c8cc16d926d5f9ae721d04b5c620e0ab26b85a77936e0

Download Submit
C:\Program Files (x86)\arcai.com\msvcr120.dll

Filesize
948KB

MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
C:\Program Files (x86)\arcai.com\msvcr120.dll

Filesize
256KB

MD5
8d88cc245e67ae6945dc5e12ed7e4929

SHA1
f7445157bdef29d9caf8abcff25a3e9fd2ddeae0

SHA256
1067675c8549d6af3bd92b20208bc36f7b77f5abe0a0eb99f88c5c480a4ebc28

SHA512
1047c326b2ba8d930baadd5ee5ff96e69f89f6b09bc0d9b8b9407f67dabc0a3cf45cb385e24293ce2b52e0106c36151f47efe9f55010f118ddb78415bc4c2564

Download Submit
C:\Program Files (x86)\arcai.com\netcut_windows.exe

Filesize
4.1MB

MD5
7156cd604d1d8fa0367acd8a32b1aea6

SHA1
cb88d0abc2a74a041f494dfcac92a7807875d3ce

SHA256
73f05d2c830a3935b6f9a523e1f47b5cecfd4c26c4c4366f9a8b3a24a70197cc

SHA512
a54c02ad85dfd40600fbf79983157053e0609869820ac32aa7293d116fd1dc927daff89d58124cd5847a86af466065e6e5cc0cd8a73b53b584b3f3e4eba30c62

Download Submit
C:\Program Files (x86)\arcai.com\netcut_windows.exe

Filesize
3.8MB

MD5
cac963825fcb92132434e389b575f8af

SHA1
926ae8914c5b4933dc91531755fde3e683d43fb0

SHA256
da012e11533575a7a260995ce3751a3fbef11b5c764428c7f730b88c93d07709

SHA512
4192481dc5378e7cd59ccac811d63b45bc9b3e7b316c6d9ce66946435ee619430309e75059839ef91d3c46f7b7e0695d5268f4e9390462e079f4edc00c1bf682

Download Submit
C:\Program Files (x86)\arcai.com\netcut_windows.exe

Filesize
1024KB

MD5
1f4f69988f9260438ba15975aae35fad

SHA1
218780db5e0baa3e2bb505d02c4b95d589d4f8ca

SHA256
c321ad78f64c5eda56d9671060f40b1f0fa5f881ed20a41b559f67cdc62af647

SHA512
02ecff23f1ca27797397874f5613df61b5ec390d024abba674af14cba50da4e85908a20b7213677874a6d3bb98d58faf5efbbe89dbea455121ce21a665aac732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
49KB

MD5
36302b4c3e6d91a5bd43946cfb3fda7a

SHA1
8d78d32b02107a918df55b51ca551b8595d3c6e9

SHA256
ffb6a743549e5182a4e3322fd91704c2779cdabe6af39ce04e741f050a251674

SHA512
ebd4afcf07124f27424a19d3d744b2ef7018e886a80d9bb6a728e4b52f5e92a6027676b3b90e8d2a59ea9489eb6580a1974b98ea02df99398292b52e449abc1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
16f40daff60db781d61a02fdd9a577da

SHA1
57e07b786ecdaf92d561937db3f28ec52502319a

SHA256
fc4d2dec4979ef0f8b0ae5e47582d145bc0daca30cb7d45d7111b9285828450c

SHA512
88207d760c734e37fc0eb9022d07dc1681436e1feec0eaaa676d9ccadff2dcd666de4401c7cadce1dfaeff50550affdf8061775c515174d1317b9a2a98ae75c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0aba01426e29df186de4a35eaa00ab21

SHA1
b663f4bed8de7753e370d3d1fd00c5c397057aaf

SHA256
69179838d6555d1494f107b7dc61d0a065acf5ea78c0ad244293824e53008afe

SHA512
7a33fae755fe1fc4ca36ed1f583b77cfa2fe3fd855f6265c44a45a5311350497f33ade04421ccf5e11477e30541c0483a0cf7afe03a07dd8668014cdcd91f9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9fe439ba41fd2c22b5cc142fca593803

SHA1
f55af831bb9003014c731983c00b0225cf5f426c

SHA256
60b5a21a5c963d039c5388d6e2a82c4af50d71570b04b457aff66fe198ccd60f

SHA512
7a159ee59b8192697bd361b98895e1660a089ca011371df9f3d2f3f6131336e2ea22bf681b4693c1d6e0493e9ee11da1b1c9ffbd728071d6eaa8861878dd16f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0bc0e303c717717812da5e5e4447bbbc

SHA1
96a1af71e60dd19062f5aa3ee9e24d8f6ef3251d

SHA256
8f392fc2839b1756eb59caf82f6d94d74711e27d07e19b081f714db39ba987d1

SHA512
3511021994cec97b03c3aa0d1fd52c573c793758d3d9f01dca1790fc5bd61312013ff51725eef4bfcec1943475e6387d1eb2409051c0dff4ce18b0c16402c0da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a441d11c786edb0ce0102afabb3e7fe

SHA1
c0fe11e94f97aa69ce5ada19e3c708513e333883

SHA256
84750961a983d1bfbe84237f3084d030214ebd3c65524de4129d27e4771bd1fc

SHA512
c4fb3065884c3252300da570c0bf7fc379a72e83222e81a6fe9c4e6b8cbb60ffe7f62706ef68948187b42b73f7ea49c2dc082b915e603ec2041f9ee3ac2c14e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
09a118fca8cadf5ac7e178b1ba978156

SHA1
811e64121c61bd857e9fcd54f4294fe3a60af324

SHA256
847c408df6b3f4c01d0e64be10d9bcb2b9fafdefc1133d6a809c9af2042b5eb3

SHA512
14095e283cbe0ac62218c2d3cbd6dc01b33ffafbb88e2240bc4b22e9e55f2abf82227f48a57003058997516e7b6063a0e416b1170af10afeed76ac410ea849f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580eb1.TMP

Filesize
1KB

MD5
8957813088a4e3e819b8f7e4b2708619

SHA1
3def6e09009747d852f6b547f287eb4728fbebca

SHA256
ec28f16605a07ccb6bc813c0c00bd2376649fe4e7e60be0a6f97d7d70cb4c1f3

SHA512
d4b45e8ce1b13b615cbbf09e42883c73c7e525d75cb0c507144a5c8a5453129697648d1026ed69124802a6c9d7c1ebc4da77df001db1c4bb4f50209b89be9e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
502ba0cbd04d16aa6dc06f0b021d6edb

SHA1
98543c37c41945688a3d95b87c941a59607d12a9

SHA256
7b43bad5df50fe85b225abdfaa2ec2754b875df6b635d552760ad8d5bd9fbec6

SHA512
abbcc704a15550539588e66765b359ad9dfd22a483fe33dfcf9eeb1113096965a6481fcdb902c7dc63ab549c8c8fb8eaa5afd57f97a799e92a4c950c1c5a9eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QR4HE.tmp\netcut [PeskTop.com].tmp

Filesize
2.5MB

MD5
17406d0282707b68694cad19d69bdfa3

SHA1
4b22d8129eb983b8d3a27c539c1f4127d0ee16e7

SHA256
fd10603e47dd71896f88c9c4927455440366b7b2c83bbc49aae07afb2e9b723c

SHA512
abaf1e80902ea37bd46a0630fb649f97e70041eaf6a968a10ac9d1e879cd89ca6b27aecc62ed4d328cb1dd5b0463d737761c2f9ff5f6e85c256134f42c51ca37

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6B3E.tmp\ExecDos.dll

Filesize
5KB

MD5
a7cd6206240484c8436c66afb12bdfbf

SHA1
0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919

SHA256
69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926

SHA512
b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6B3E.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6B3E.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6B3E.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6B3E.tmp\bootOptions.ini

Filesize
349B

MD5
73461ff69941beefb0f5630b29b5ae2e

SHA1
f8f33b309db03f1bc5a9fd452150245474c000f1

SHA256
81a27757de2fa404014be9a73f502537628f82a3da3f809b1ff5584a828910b8

SHA512
38b3a21683bb30cc301406e2f12d0cf916299a4618af552f9e01b1b0fecddf22c79e37f7aaf3f2a85706a263049d10c17ccc417fa9c07f8b74c28284a02da460

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6B3E.tmp\bootOptions.ini

Filesize
370B

MD5
1750944f2b66cf15f41b101ccb9763b1

SHA1
b278d15dc8c2ce188977adcd5d6b704c2767dabf

SHA256
9f52f44cb588c97328586398973a68475573b9a3edeb68806a86bd9362d024dc

SHA512
020d5e35155fcad3d57b53ecd96dc3631590e295802684e1dfac61ea2c24ccb7586d1deefa783dc7351c260fd718145f08ddcad8c4749d8037c3742a607ee575

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6B3E.tmp\ioSpecial.ini

Filesize
553B

MD5
6d4fd658df07faae7d36c82c5dc99080

SHA1
bf3f00fc0ceb0023c25c5967bc511c1d8719de63

SHA256
0461fc25a12699a8046deb45d4542ad17cdcf9276fbc626c6d1b1e87c9585080

SHA512
551c2d368f9097b6c4b181f36b7e65f1b722fea79aea9e38c9aad8b67f2e696564a023aebefc5cab5366965821267a34862e658e7faffa53ace7b81c6c71a947

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6B3E.tmp\ioSpecial.ini

Filesize
578B

MD5
5763ee106e9fa60f04a0502de45982b4

SHA1
eacf660629fd9aae1d1f05d7b76d9213cb756046

SHA256
af821f5924c9b4db2004b12d6d7e825f9fd86f64d8941d0f2a4fd4729b0617ac

SHA512
a8e238d0b77f2ea370c557a682dd6d91e940daba4139bfc255b008bc84fe2a32b2688929a058dc9815a529440397face38ff87894436d7fd6545c4943a77a254

Download Submit
C:\Windows\SysWOW64\packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
memory/860-301-0x0000000001790000-0x00000000017A8000-memory.dmp

Filesize
96KB

Download
memory/1404-434-0x00000000016D0000-0x00000000016E8000-memory.dmp

Filesize
96KB

Download
memory/1892-303-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/1892-449-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/1892-0-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2324-392-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/2324-448-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/2324-419-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/2324-304-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/2324-5-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/2392-424-0x0000000000EE0000-0x00000000012B4000-memory.dmp

Filesize
3.8MB

Download
memory/2392-311-0x00000000008A0000-0x00000000008B8000-memory.dmp

Filesize
96KB

Download
memory/4640-177-0x00000000049F0000-0x0000000004A06000-memory.dmp

Filesize
88KB

Download