Malware Analysis Report

2024-11-30 18:54

Sample ID 240316-z6yeesce31
Target cf19dbb358ec397d463c7273e8994f51
SHA256 13dd85a2f11b7520e7b3dc22628517890277cd1811989db6fcf79376c2286aa7
Tags
redline sectoprat build2_mastif agilenet infostealer persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

13dd85a2f11b7520e7b3dc22628517890277cd1811989db6fcf79376c2286aa7

Threat Level: Known bad

The file cf19dbb358ec397d463c7273e8994f51 was found to be: Known bad.

Malicious Activity Summary

redline sectoprat build2_mastif agilenet infostealer persistence rat trojan

RedLine

SectopRAT payload

RedLine payload

SectopRAT

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Executes dropped EXE

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-16 21:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-16 21:20

Reported

2024-03-16 21:22

Platform

win7-20240221-en

Max time kernel

147s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2776 set thread context of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05df8d7e777da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000004fb758e8005c0d1235464267cee64f3500aff82075ce05a76117698aa18d5091000000000e8000000002000020000000c8fa4c930fcc07c0c61e35076244e53c8484bbdb503e707830db7b98ae7cd197900000000f23f616ef95543844b8236c4abfe5e89f7eed362dcb86c031d6ec1acb0224fd45c58f392623de039dfa2b503a307f0e37630f70f8ad138be0498cd6a7dc8694eaeeb0dd5cad41eae8c6707239df09fb60dc4daeedf2aebbb04a34a3733006ef30582cea6098624f9582445ed4a1636dbbfa7508161df8ad401ef0eb1e7d542c73e44cebcacf34a6aed700f06f0478e540000000d736fca1a271c28edf47774caa0253131c029f5abd76a8b1c1272b8e0d1d0775ce46d74b8f05a5ec5da7104e17945079ccc605d52b203e0ba0e8a8af40941d15 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416785912" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0203F1E1-E3DB-11EE-92E0-EA483E0BCDAF} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e62f9f73b629c5c678daf938ffb585ccafc769e97d3f45a37aab58d8bd4313be000000000e800000000200002000000025a63420390e8aa59fb8682d463440473614cb337d3e52059741ab82f76aa39120000000fe7085b2dbc24e5aa8a370bde0338ab5fd70a7ffc9a3696d205f426f76ed1ded40000000bb0ddf04ff8df68a16b92bd94fece02acdf1f27e525d057d70ef29488de638e8ea46a0c88ed5d70868912aebe711a920003b51ec664a01f4a8a88364ea9cece1 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1740 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
PID 1740 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
PID 1740 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
PID 1740 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
PID 1740 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
PID 1740 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
PID 1740 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
PID 2416 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe C:\Windows\SysWOW64\cmd.exe
PID 2116 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2116 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2116 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2116 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1740 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 1740 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 1740 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 1740 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 1740 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 1740 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 1740 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2652 wrote to memory of 2688 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2652 wrote to memory of 2688 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2652 wrote to memory of 2688 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2652 wrote to memory of 2688 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 2776 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe

"C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\7zS12C6.tmp\Install.cmd" "

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1XQju7

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE"

Network

Country Destination Domain Proto
US 8.8.8.8:53 iplogger.org udp
US 104.21.4.208:443 iplogger.org tcp
US 104.21.4.208:443 iplogger.org tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
GB 96.17.179.184:80 apps.identrust.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
GB 173.222.13.40:80 x2.c.lencr.org tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe

MD5 3973c47bf5f334ea720a9d603d2c6510
SHA1 bf2b72dc12d4d41e08b452e465c40d010b2aba4e
SHA256 4e9a1202844e30f1d62d837cdb440764c851740ab8ee2bd4a8a31475bd449eea
SHA512 cafc322ba71bafad2b15b82553a2a0749d0b6cb8349fe7fd24de25f7dca48c5aa0c9e7d170571c87a55381ec21d33045d7ba9a17891aabee187358da9b406861

C:\Users\Admin\AppData\Local\Temp\7zS12C6.tmp\Install.cmd

MD5 21661026606353f423078c883708787d
SHA1 338e288b851e0e5bee26f887e50bfcd8150e8257
SHA256 6a77796213adbc0eb764c070a3fdfcb5bfa3ad9b6215c1be43f09bfd32014782
SHA512 61760ab64e2c38d9bd5102ab0106e451a5c91e1598906f92e1285b7ae1ca1c6e02480d4157d0f350d2dc816088b5b0838a5d7c7b9d80444ecbf9d62b9ca5b65b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

MD5 0c6ef320b361f01d63147dec80c3f34c
SHA1 c04adc3da100118f72e41c1c4645cbf8fa813cee
SHA256 bf89a45619528967430c483c01da54306e4f1b200a8c062697218fdd60bac93f
SHA512 f204ea35dffab3bd703ccf3a52e8ce26be5cde8f24b485b8a0c34a7dc9948bfcae3c7d2d268d5e4fd736dd55245ee995a4bfe0726e2b7fbb379095c69e9ddb69

memory/2776-48-0x0000000001040000-0x000000000114A000-memory.dmp

memory/2776-49-0x0000000074530000-0x0000000074C1E000-memory.dmp

memory/2776-50-0x0000000004A60000-0x0000000004AA0000-memory.dmp

memory/2776-51-0x00000000004D0000-0x00000000004E8000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\Tar1961.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fd046c5e237bedbe67ebb14b7aa12030
SHA1 c844ffff07be54bc9ad46d3ab8b13c9205bad99a
SHA256 2f2339bcccc88e17e2bbc91f3a963ff8e4f3c5d51ef7c701297f6b5c899db423
SHA512 c576c9736c9c00ab48d5b0c110ec24b4f4d4d59bd2c4c0787071dee11d157e24dcefaa97f9429421f6f71ecb6570d55902d11af33deaaca5baaeb5204b212714

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sxsuh4u\imagestore.dat

MD5 2270774eb7de00cfed27d6f4683f6e9d
SHA1 ef747d41d88a0033466af454779803ad7516aa92
SHA256 22cffbc9c5ead8e1e717af95dc134e2e117492152281bc1b2e255603e2288066
SHA512 7be9549ea0720759b8ff2f3e4a4ef37e84a557e2a6ea780500e2e05640bed9c0c6e26237410dcb3fdef2b5ce0521af15ef09a31239132f85709b00830c873ff6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\favicon[1].png

MD5 18c023bc439b446f91bf942270882422
SHA1 768d59e3085976dba252232a65a4af562675f782
SHA256 e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482
SHA512 a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a6df1c09aaeb58ab74642f5b6f92a586
SHA1 c1214ac58133156283e6b0f1fecd434ec827cc87
SHA256 4957fb70d3709fde753812fca3d20d01a3c2c62a26ba876000512424c72b886d
SHA512 a75958cce62e6b21d3aed5e03af01049b0674f6ea628d40f289e4926e7bdf3698db09d86c566866805bfae598c84e4b6b9ac080e856c487d0a6076db3e550e63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87074fbe7618fb6c6dd449cc4506ab85
SHA1 8d0ab83996044b8d2b9f07908ab7dc8357dab556
SHA256 48e65d7ec46e690e72e57cbd787d6158f0706554ace3cfe3d528ab7744966a9f
SHA512 f10ed42611aa0b61596f3568b6f6d99abab5a7c3d2add2485eca66ada0fc3861a6df09a67a6fdd7a3903ad9a67881ed84a6a55ca6451be68d6000c9dd345488f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b42d58e842a93badc321144b74ebd84
SHA1 3cc9cb2fb0709192cb61e666f283289e93d83e3a
SHA256 b92f7854d93b17776ed151effa496b42ba54e31afe274b4ebc2e09f91a0227ea
SHA512 b6068d09f07b28b95917db3ac4268959442fabb52e89b29e7a51e9fa881b52a42278d40fba3fa660e13b05a14f70f63d507f553f015b921568b01be4bfb8b214

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9a20d9849fa4fd8fbfa5617c81b0619
SHA1 e1a32407e8a49096efd88e0eee4d1fd10d4b5cd7
SHA256 2848283935a8ff9cc2a3c7e8a2e6296517d92787c42e386376d29ce3aee8cb3a
SHA512 8560a8f1984d55910b1917159b9aa8144391d11ae64fb3a0e57b0d8872bf93bac9966bb8a426ac315d0c0206a14217a4a35fc4b03965e8ed402461c98a872c3d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9d6579ddfe93349519cdfe9d583eee38
SHA1 158920351d85d6386a2f51ba5e448a9aff1da046
SHA256 fec0eb464945f08ae32eb6cfb5f9fd3c93969b2e7dc33d32fe8036225a6be79e
SHA512 ad12ec17b61a7aedb6c70e0e21394bf1d60712341c527a557a06713af9b1366509d2186d59dedacf2fbc8e4e10fd3447378a9c034ab403463cb30dcfa8cb98e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2108f8d629b7ae5971628276e9a9cf71
SHA1 c53d42ff152a178c950f3f225f76d300f22941f8
SHA256 38ee974d2ea4a95a5de31b9de4e3fa519ce5cd7d8f15a64277942c6e8dd5dff6
SHA512 1179eacd3d6acd69cf2491daf5faada22a097c14bf1b64e46e2d36845c6506208d8f673e9515a5c929b3054e2d60e4f6c3d67f941aa38fed1a95dd71fe03ebcb

memory/2776-593-0x0000000074530000-0x0000000074C1E000-memory.dmp

memory/2776-594-0x0000000004A60000-0x0000000004AA0000-memory.dmp

memory/2776-595-0x0000000005E10000-0x0000000005E9A000-memory.dmp

memory/2776-596-0x00000000005B0000-0x00000000005CE000-memory.dmp

memory/2616-598-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2616-600-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2616-602-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2616-604-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2616-606-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2616-608-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2616-611-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2616-613-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2776-614-0x0000000074530000-0x0000000074C1E000-memory.dmp

memory/2616-615-0x0000000074530000-0x0000000074C1E000-memory.dmp

memory/2616-616-0x0000000004BF0000-0x0000000004C30000-memory.dmp

memory/2616-617-0x0000000074530000-0x0000000074C1E000-memory.dmp

memory/2616-618-0x0000000004BF0000-0x0000000004C30000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a79d5aa245e30e26119fd7aa3c1a828d
SHA1 21097487ffb8560128e022938ab50476af39d619
SHA256 0c76b964cc6ffbc9c754073e18e393faababf3797fda2b067d8350fe6722c89d
SHA512 c8b714caf24b69f4f14eb6b6f9146539bae694b1666043175fe7cbda5f8536ef5cad09018c87a0ef0c2044338aed377966c3a2443be7e755a0a721249148abf3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46bf36aaa26c6b73f4c4450a84296c7c
SHA1 97ceca264f00afe6bbe75c387234bdfe5358e050
SHA256 ac011bdfb13c67ec0d4f84ddc97adadb3e96e0da30114933a36a21956aa7d5aa
SHA512 bd0d36a93586e18ef0918d47cdb18eed6414ec7bbf970736fe9bc64f439efa5e577bd6d0bd6f255eca3cced02c47982ced46f9612ecb33b74f8f355e9f022d79

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-16 21:20

Reported

2024-03-16 21:23

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2188 set thread context of 5692 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4476 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
PID 4476 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
PID 4476 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
PID 2840 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 3780 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3956 wrote to memory of 3780 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4596 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4596 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4476 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 4476 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 4476 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 4428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe

"C:\Users\Admin\AppData\Local\Temp\cf19dbb358ec397d463c7273e8994f51.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS3CCA.tmp\Install.cmd" "

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1XQju7

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed2a646f8,0x7ffed2a64708,0x7ffed2a64718

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,9276475405620114192,149430284061707898,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 iplogger.org udp
US 104.21.4.208:443 iplogger.org tcp
US 104.21.4.208:443 iplogger.org tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
US 8.8.8.8:53 54.242.123.52.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 208.4.21.104.in-addr.arpa udp
US 8.8.8.8:53 205.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 195.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 40.134.221.88.in-addr.arpa udp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
RU 95.181.157.69:8552 tcp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
RU 95.181.157.69:8552 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp
RU 95.181.157.69:8552 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe

MD5 3973c47bf5f334ea720a9d603d2c6510
SHA1 bf2b72dc12d4d41e08b452e465c40d010b2aba4e
SHA256 4e9a1202844e30f1d62d837cdb440764c851740ab8ee2bd4a8a31475bd449eea
SHA512 cafc322ba71bafad2b15b82553a2a0749d0b6cb8349fe7fd24de25f7dca48c5aa0c9e7d170571c87a55381ec21d33045d7ba9a17891aabee187358da9b406861

C:\Users\Admin\AppData\Local\Temp\7zS3CCA.tmp\Install.cmd

MD5 21661026606353f423078c883708787d
SHA1 338e288b851e0e5bee26f887e50bfcd8150e8257
SHA256 6a77796213adbc0eb764c070a3fdfcb5bfa3ad9b6215c1be43f09bfd32014782
SHA512 61760ab64e2c38d9bd5102ab0106e451a5c91e1598906f92e1285b7ae1ca1c6e02480d4157d0f350d2dc816088b5b0838a5d7c7b9d80444ecbf9d62b9ca5b65b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

MD5 0c6ef320b361f01d63147dec80c3f34c
SHA1 c04adc3da100118f72e41c1c4645cbf8fa813cee
SHA256 bf89a45619528967430c483c01da54306e4f1b200a8c062697218fdd60bac93f
SHA512 f204ea35dffab3bd703ccf3a52e8ce26be5cde8f24b485b8a0c34a7dc9948bfcae3c7d2d268d5e4fd736dd55245ee995a4bfe0726e2b7fbb379095c69e9ddb69

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

memory/2188-21-0x0000000074940000-0x00000000750F0000-memory.dmp

memory/2188-22-0x0000000000E50000-0x0000000000F5A000-memory.dmp

memory/2188-23-0x00000000057F0000-0x000000000588C000-memory.dmp

memory/2188-30-0x0000000005950000-0x00000000059E2000-memory.dmp

\??\pipe\LOCAL\crashpad_3780_ZBCWDUSRQPQEEFVW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

memory/2188-24-0x0000000005E60000-0x0000000006404000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 882380d8b29e8e333952f7eed379db25
SHA1 8c70fe54ee1c25c0cd88c6b20c6615de5555796c
SHA256 d7927d0f6e557d2640c11380ccc0bf05da31b315e1ac6cc391bf1a0f9ea17a0c
SHA512 47c177da55c110ec50c6a1ab88bb32946110a7b9568afacc00d0e3ee7d8be58a5305acef674ef20596348f137f43b717f321f65bdcd3a46fee41d5d86427f05b

memory/2188-42-0x0000000005B60000-0x0000000005B70000-memory.dmp

memory/2188-43-0x0000000005890000-0x000000000589A000-memory.dmp

memory/2188-44-0x0000000005AE0000-0x0000000005B36000-memory.dmp

memory/2188-49-0x0000000005CA0000-0x0000000005CB8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\63af217b-9336-4256-b8f0-d73522ce6dbc.tmp

MD5 0d4a480b00dfecda83c2bae993fdf126
SHA1 24798f892df2aba12844097976e80cc4692dac0f
SHA256 c374bc6fcb9f0dfdc9fdbd9fb7b90520250f8c8b2c04a883b9563db8705e4599
SHA512 c8f6696ccceea2ba9e9704fa80f62d7bdcb239e64da167f3491a8fd4d0b455441c813ef4e9349fd358a38e2566697b896d7b5f9f65b6b704826226630b3923c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a32599cad1e1bcffb58c84dc29e51590
SHA1 4d7866c69e09cb62266813115dc1696d08143a07
SHA256 72d84261e654e5060544043c5c68cc2ca8e3f46dff530b650d0df7eed79b3232
SHA512 fcb269b5d8d210a3b103c70d2bc967ac19554d895493a2c988c4de037c79547cf9ce0a9c2b0195c4f9a663c6952a071b024d324530a386612dda7618aed9ee85

memory/2188-82-0x0000000074940000-0x00000000750F0000-memory.dmp

memory/2188-83-0x0000000005B60000-0x0000000005B70000-memory.dmp

memory/2188-93-0x0000000008740000-0x00000000087CA000-memory.dmp

memory/2188-94-0x000000000AE70000-0x000000000AE8E000-memory.dmp

memory/5692-95-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RUNTIM~1.EXE.log

MD5 17573558c4e714f606f997e5157afaac
SHA1 13e16e9415ceef429aaf124139671ebeca09ed23
SHA256 c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512 f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

memory/5692-99-0x0000000074940000-0x00000000750F0000-memory.dmp

memory/2188-100-0x0000000074940000-0x00000000750F0000-memory.dmp

memory/5692-101-0x0000000005900000-0x0000000005F18000-memory.dmp

memory/5692-102-0x00000000053A0000-0x00000000053B2000-memory.dmp

memory/5692-103-0x0000000005400000-0x000000000543C000-memory.dmp

memory/5692-104-0x0000000005540000-0x0000000005550000-memory.dmp

memory/5692-105-0x0000000005440000-0x000000000548C000-memory.dmp

memory/5692-106-0x00000000056B0000-0x00000000057BA000-memory.dmp

memory/5692-120-0x0000000074940000-0x00000000750F0000-memory.dmp

memory/5692-139-0x0000000005540000-0x0000000005550000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 4bc8a3540a546cfe044e0ed1a0a22a95
SHA1 5387f78f1816dee5393bfca1fffe49cede5f59c1
SHA256 f90fcadf34fbec9cabd9bcfdea0a63a1938aef5ea4c1f7b313e77f5d3f5bbdca
SHA512 e75437d833a3073132beed8280d30e4bb99b32e94d8671528aec53f39231c30476afb9067791e4eb9f1258611c167bfe98b09986d1877ca3ed96ea37b8bceecf