amadey | eeee6bc6727089fe7e35810e1b293978aa2f0df98a8f1d6cfa55493de0c5e1fe

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c56936ed9bcb76fe8ee2069618cf3b509fe6cf4c73c1fb53723596077ab1f5fa.exe
Size

1.6MB
MD5

d7ac39bafca00876be0923660c93e691
SHA1

3c9ef605a454e34dd9a9fd62e9b6708264845bd4
SHA256

c56936ed9bcb76fe8ee2069618cf3b509fe6cf4c73c1fb53723596077ab1f5fa
SHA512

a975964dfb6185d16cf41ad750d085bfe7073c22b0109c475e0e9df2e16cfca504e5dc1a7eff787a05d1b3f8b0175a93315d3c164629128bf492f13c4916ecba
SSDEEP

49152:CVxCYUkZjoWq8qAE7Gqp+LsIwq5C5SEaJ7:oA1YjV2F7pq5CdaJ7

Score

10^/10

amadey dcrat mystic redline smokeloader grome backdoor evasion infostealer persistence rat stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Mystic stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4632-47-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/4632-51-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/4632-49-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/4632-48-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6nj8Bd1.exe	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4136-65-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5cd3ke9.exeexplothe.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	5cd3ke9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	explothe.exe

Executes dropped EXE 15 IoCs

Processes:

iZ5KL58.exeAx5HT65.exeeU0eg95.exeQT1eA51.exeGI9Ju35.exe1Ee74lL7.exe2eJ5051.exe3DC11De.exe4bo585QP.exe5cd3ke9.exeexplothe.exe6nj8Bd1.exe7wD3zy47.exeexplothe.exeexplothe.exe

pid	process
1348	iZ5KL58.exe
1504	Ax5HT65.exe
3548	eU0eg95.exe
4432	QT1eA51.exe
4936	GI9Ju35.exe
3912	1Ee74lL7.exe
1172	2eJ5051.exe
1672	3DC11De.exe
3088	4bo585QP.exe
3292	5cd3ke9.exe
2756	explothe.exe
740	6nj8Bd1.exe
2892	7wD3zy47.exe
4000	explothe.exe
828	explothe.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

QT1eA51.exeGI9Ju35.exec56936ed9bcb76fe8ee2069618cf3b509fe6cf4c73c1fb53723596077ab1f5fa.exeiZ5KL58.exeAx5HT65.exeeU0eg95.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	QT1eA51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	GI9Ju35.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c56936ed9bcb76fe8ee2069618cf3b509fe6cf4c73c1fb53723596077ab1f5fa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	iZ5KL58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Ax5HT65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	eU0eg95.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

1Ee74lL7.exe2eJ5051.exe4bo585QP.exe

description	pid	process	target process
PID 3912 set thread context of 2396	3912	1Ee74lL7.exe	AppLaunch.exe
PID 1172 set thread context of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 3088 set thread context of 4136	3088	4bo585QP.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4560 4632 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
4560	4632	WerFault.exe	AppLaunch.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3DC11De.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3DC11De.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3DC11De.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3DC11De.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1524 schtasks.exe

pid	process
1524	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exe3DC11De.exe

pid	process
2396	AppLaunch.exe
2396	AppLaunch.exe
1672	3DC11De.exe
1672	3DC11De.exe
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508
3508

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3DC11De.exe

pid process

1672 3DC11De.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1444 msedge.exe
1444 msedge.exe
1444 msedge.exe
1444 msedge.exe
1444 msedge.exe
1444 msedge.exe
1444 msedge.exe
1444 msedge.exe
1444 msedge.exe

pid	process
1672	3DC11De.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2396	AppLaunch.exe
Token: SeShutdownPrivilege	3508
Token: SeCreatePagefilePrivilege	3508
Token: SeShutdownPrivilege	3508
Token: SeCreatePagefilePrivilege	3508
Token: SeShutdownPrivilege	3508
Token: SeCreatePagefilePrivilege	3508
Token: SeShutdownPrivilege	3508
Token: SeCreatePagefilePrivilege	3508
Token: SeShutdownPrivilege	3508
Token: SeCreatePagefilePrivilege	3508
Token: SeShutdownPrivilege	3508
Token: SeCreatePagefilePrivilege	3508
Token: SeShutdownPrivilege	3508
Token: SeCreatePagefilePrivilege	3508
Token: SeShutdownPrivilege	3508
Token: SeCreatePagefilePrivilege	3508
Token: SeShutdownPrivilege	3508
Token: SeCreatePagefilePrivilege	3508

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3508

pid	process
3508

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c56936ed9bcb76fe8ee2069618cf3b509fe6cf4c73c1fb53723596077ab1f5fa.exeiZ5KL58.exeAx5HT65.exeeU0eg95.exeQT1eA51.exeGI9Ju35.exe1Ee74lL7.exe2eJ5051.exe4bo585QP.exe5cd3ke9.exeexplothe.exe

description	pid	process	target process
PID 4020 wrote to memory of 1348	4020	c56936ed9bcb76fe8ee2069618cf3b509fe6cf4c73c1fb53723596077ab1f5fa.exe	iZ5KL58.exe
PID 4020 wrote to memory of 1348	4020	c56936ed9bcb76fe8ee2069618cf3b509fe6cf4c73c1fb53723596077ab1f5fa.exe	iZ5KL58.exe
PID 4020 wrote to memory of 1348	4020	c56936ed9bcb76fe8ee2069618cf3b509fe6cf4c73c1fb53723596077ab1f5fa.exe	iZ5KL58.exe
PID 1348 wrote to memory of 1504	1348	iZ5KL58.exe	Ax5HT65.exe
PID 1348 wrote to memory of 1504	1348	iZ5KL58.exe	Ax5HT65.exe
PID 1348 wrote to memory of 1504	1348	iZ5KL58.exe	Ax5HT65.exe
PID 1504 wrote to memory of 3548	1504	Ax5HT65.exe	eU0eg95.exe
PID 1504 wrote to memory of 3548	1504	Ax5HT65.exe	eU0eg95.exe
PID 1504 wrote to memory of 3548	1504	Ax5HT65.exe	eU0eg95.exe
PID 3548 wrote to memory of 4432	3548	eU0eg95.exe	QT1eA51.exe
PID 3548 wrote to memory of 4432	3548	eU0eg95.exe	QT1eA51.exe
PID 3548 wrote to memory of 4432	3548	eU0eg95.exe	QT1eA51.exe
PID 4432 wrote to memory of 4936	4432	QT1eA51.exe	GI9Ju35.exe
PID 4432 wrote to memory of 4936	4432	QT1eA51.exe	GI9Ju35.exe
PID 4432 wrote to memory of 4936	4432	QT1eA51.exe	GI9Ju35.exe
PID 4936 wrote to memory of 3912	4936	GI9Ju35.exe	1Ee74lL7.exe
PID 4936 wrote to memory of 3912	4936	GI9Ju35.exe	1Ee74lL7.exe
PID 4936 wrote to memory of 3912	4936	GI9Ju35.exe	1Ee74lL7.exe
PID 3912 wrote to memory of 2396	3912	1Ee74lL7.exe	AppLaunch.exe
PID 3912 wrote to memory of 2396	3912	1Ee74lL7.exe	AppLaunch.exe
PID 3912 wrote to memory of 2396	3912	1Ee74lL7.exe	AppLaunch.exe
PID 3912 wrote to memory of 2396	3912	1Ee74lL7.exe	AppLaunch.exe
PID 3912 wrote to memory of 2396	3912	1Ee74lL7.exe	AppLaunch.exe
PID 3912 wrote to memory of 2396	3912	1Ee74lL7.exe	AppLaunch.exe
PID 3912 wrote to memory of 2396	3912	1Ee74lL7.exe	AppLaunch.exe
PID 3912 wrote to memory of 2396	3912	1Ee74lL7.exe	AppLaunch.exe
PID 4936 wrote to memory of 1172	4936	GI9Ju35.exe	2eJ5051.exe
PID 4936 wrote to memory of 1172	4936	GI9Ju35.exe	2eJ5051.exe
PID 4936 wrote to memory of 1172	4936	GI9Ju35.exe	2eJ5051.exe
PID 1172 wrote to memory of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 1172 wrote to memory of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 1172 wrote to memory of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 1172 wrote to memory of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 1172 wrote to memory of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 1172 wrote to memory of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 1172 wrote to memory of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 1172 wrote to memory of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 1172 wrote to memory of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 1172 wrote to memory of 4632	1172	2eJ5051.exe	AppLaunch.exe
PID 4432 wrote to memory of 1672	4432	QT1eA51.exe	3DC11De.exe
PID 4432 wrote to memory of 1672	4432	QT1eA51.exe	3DC11De.exe
PID 4432 wrote to memory of 1672	4432	QT1eA51.exe	3DC11De.exe
PID 3548 wrote to memory of 3088	3548	eU0eg95.exe	4bo585QP.exe
PID 3548 wrote to memory of 3088	3548	eU0eg95.exe	4bo585QP.exe
PID 3548 wrote to memory of 3088	3548	eU0eg95.exe	4bo585QP.exe
PID 3088 wrote to memory of 4136	3088	4bo585QP.exe	AppLaunch.exe
PID 3088 wrote to memory of 4136	3088	4bo585QP.exe	AppLaunch.exe
PID 3088 wrote to memory of 4136	3088	4bo585QP.exe	AppLaunch.exe
PID 3088 wrote to memory of 4136	3088	4bo585QP.exe	AppLaunch.exe
PID 3088 wrote to memory of 4136	3088	4bo585QP.exe	AppLaunch.exe
PID 3088 wrote to memory of 4136	3088	4bo585QP.exe	AppLaunch.exe
PID 3088 wrote to memory of 4136	3088	4bo585QP.exe	AppLaunch.exe
PID 3088 wrote to memory of 4136	3088	4bo585QP.exe	AppLaunch.exe
PID 1504 wrote to memory of 3292	1504	Ax5HT65.exe	5cd3ke9.exe
PID 1504 wrote to memory of 3292	1504	Ax5HT65.exe	5cd3ke9.exe
PID 1504 wrote to memory of 3292	1504	Ax5HT65.exe	5cd3ke9.exe
PID 3292 wrote to memory of 2756	3292	5cd3ke9.exe	explothe.exe
PID 3292 wrote to memory of 2756	3292	5cd3ke9.exe	explothe.exe
PID 3292 wrote to memory of 2756	3292	5cd3ke9.exe	explothe.exe
PID 1348 wrote to memory of 740	1348	iZ5KL58.exe	6nj8Bd1.exe
PID 1348 wrote to memory of 740	1348	iZ5KL58.exe	6nj8Bd1.exe
PID 1348 wrote to memory of 740	1348	iZ5KL58.exe	6nj8Bd1.exe
PID 2756 wrote to memory of 1524	2756	explothe.exe	schtasks.exe
PID 2756 wrote to memory of 1524	2756	explothe.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\c56936ed9bcb76fe8ee2069618cf3b509fe6cf4c73c1fb53723596077ab1f5fa.exe
"C:\Users\Admin\AppData\Local\Temp\c56936ed9bcb76fe8ee2069618cf3b509fe6cf4c73c1fb53723596077ab1f5fa.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4020

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iZ5KL58.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iZ5KL58.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1348

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ax5HT65.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ax5HT65.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\eU0eg95.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\eU0eg95.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3548

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\QT1eA51.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\QT1eA51.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4432

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\GI9Ju35.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\GI9Ju35.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4936

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Ee74lL7.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Ee74lL7.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2eJ5051.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2eJ5051.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 540
9⤵
- Program crash
PID:4560

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3DC11De.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3DC11De.exe
6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1672

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4bo585QP.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4bo585QP.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4136

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5cd3ke9.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5cd3ke9.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
6⤵
- Creates scheduled task(s)
PID:1524

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
6⤵
PID:3264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:3860

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
7⤵
PID:3680

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
7⤵
PID:3096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:1296

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
7⤵
PID:428

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
7⤵
PID:2212

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6nj8Bd1.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6nj8Bd1.exe
3⤵
- Executes dropped EXE
PID:740

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7wD3zy47.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7wD3zy47.exe
2⤵
- Executes dropped EXE
PID:2892

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\65DE.tmp\65DF.tmp\65E0.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7wD3zy47.exe"
3⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x100,0x170,0x7ffcf28646f8,0x7ffcf2864708,0x7ffcf2864718
5⤵
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,5400208522812395791,328336075517760836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
5⤵
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,5400208522812395791,328336075517760836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
5⤵
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcf28646f8,0x7ffcf2864708,0x7ffcf2864718
5⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
5⤵
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
5⤵
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
5⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
5⤵
PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
5⤵
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
5⤵
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
5⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
5⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5608 /prefetch:8
5⤵
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 /prefetch:8
5⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 /prefetch:8
5⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
5⤵
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
5⤵
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
5⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
5⤵
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12321840776179101778,978248634196459389,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
5⤵
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcf28646f8,0x7ffcf2864708,0x7ffcf2864718
5⤵
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,12381725437654537736,127324308745759166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
5⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4632 -ip 4632
1⤵
PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4000

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:828

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\205c825a-9d30-43f2-8e73-59884ff8cc00.tmp
Filesize
11KB

MD5
9894e076b6be08916ac2ad68feb23b19

SHA1
b27051ce012bc29950b6e049b3d9342814bbd9b6

SHA256
0be1fc079c7ea34df7b7fbb28a80a7b0762c5f488fc948a885ad10aae7f922b0

SHA512
e228120e4c507b6ecf39b2ef073d34adbebaaeb761cb9d9c5679bc285f0bae96329dd15197c20a311def9367f97bfbca978909f89d0ebc2fb829c764a205c1ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
def32aaef99188b84871d2819070a89f

SHA1
b22296fb44eb76d0768b06e634849984d97a6a8e

SHA256
2725ca690ddcf31b68ed3f388e383cfde2d231fcc2aa8c9e9b6576e973ff10ac

SHA512
de5f4d380904b6b80e0ae2545c33d7405f830200e5a415d1a1fa09028c554b16715c292ec09f8a09f486531334489c8fea9a4b3df0d98d3f5033049b7e29ad72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
6d72e491adb3309f21e8d2276bd574dc

SHA1
235d36d316a2fe59df33671f123ac716c0129f92

SHA256
420b44d78d0b4eade48538fe20b3eefff204a12be3a3827463c6d403e3b47d3d

SHA512
f2106af625924d91215f488073a506a83f6728ee3ecc5da172060c7c30c821ea7cffc97c7df5e3488fa85eddd6465c5f4fb7dae39dd478a5514a1d306efcf39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
502a381d3ff45cb03458f62741bcff2b

SHA1
f905c23ddef218d94bf961fba180370875f942cd

SHA256
4ff1c5da5fdfa68cef274f5411da62cd2978171e91c86b434578e989d3e1cd6f

SHA512
6730642bb229a8afb64931b7183e52fffba1f3eadd926683acff74fa9acc08e793712757a88e15373f86b9fae83604f1914df75a549934d0715fb94307e8e67a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
3694d325ced90881c1f645180d4ee74f

SHA1
c088b01999d708a47c5f7a957cabd48b43169d49

SHA256
764c73c42996005e4a8b6ee1e58691e39513bf807319209aac5c330d3f014dd6

SHA512
b249ff8391975903642e9a4606c0e915c7e54f2c7c36ab9f67417750c4a49e5b52566d641d1b1cc78d1ca5336264b50eaaee0fdb6d5990d8a7ce4232bfeb030a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
f896b8e5e7b2e8feb40d1c00b26f1b3f

SHA1
ec8495b192c93a106cf59a46c12383a2aa61c8bc

SHA256
845033d7c867f3ce33fe616d0b640b1189f8eb900e21a89edff2ed590f4e7c16

SHA512
ef1d38b70098b457e7f7caa3e3958a3c830309242b3879e4f5d305bea609fe42cfc56b7686ec43695781742bae1882aee229b3e305a429d33d4d68c632df7305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
b7429af9c94241e85f0dc214c00a6a4e

SHA1
fe109f33e212c3f15431ea3d1fd4216061b70ad7

SHA256
c2d357a64b61efbc4bea8116adaa9549cdaa27d779151210502729d67e8f5b49

SHA512
eeb20ea243eef9f953c498a1fef196f063a10c527a9463c545cd940fc47d9f453eca7cf5f04164396c29c09051f1699142d51db747a417149a63233b22853f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
b6ee410c1f9cadb1ddfa12b1fb82625f

SHA1
26725424692e93465412a52325f10f240b8341f4

SHA256
e7106b8904347a75eec90e4ab9c144c57cd40ef46327e3c58d4a7ac133b7295c

SHA512
537735cec17fcf700dd11914add70937d769946b27c28cdbdaf23db3d1ac2ef5b182cc40043a506d9fabeba638ae4198bd966d4e3fd64b220052886469e1a531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
574ef8b70579743456d914dd8c7af1ca

SHA1
51022000d566e4090d574a359062f6e1f6d7272e

SHA256
10fe3ccd34546fd0b6ced31e926ba677b7d0058999bdda3b900fd2939ecfbc44

SHA512
a3f2c51d4da4737138997a15aa2b526edb93964c3d141fbda917449cffad8ccff44be898ad97ee50e23cc80724149f3208885a7b95e512214a46fc1fc575d05f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57cd43.TMP
Filesize
48B

MD5
7efe6ac100aa5ba7007b503861ed5f11

SHA1
250d2ff1355dd3a301a9610464cf817e2cfe6d23

SHA256
69b98f34e8c8c2deb9ad90122505bfa77391c12fd026b1ca69e0a28f58414f54

SHA512
ca13082845115fd2f7fcdae01451f757eea84718c4516d3924484d80f243a18a56bc218e36ffb5daacca03bf076bc1b38fb9751a7d5468ced0d710095ecacf71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
3ff6c874a1583fbbf62782f66a536c3f

SHA1
5f07942cb572ebcce0887b97da074372e14224de

SHA256
aaeee8a9705b96572f10395b8029596521d950306c4682043f664f450c490031

SHA512
a7e668e340cd0340953db06a29e17bd6f0d31f02cb15c93cec32ec7345345da668ad3cd7ba0ed6ea4148dbbfa239f47c76c52bfa5a3fb099b26e71c55d7b96e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
10f8e2c3f6ea13f6e5f03308d70a4a5b

SHA1
8dba534310279d8035a653354721dff9c6d68292

SHA256
fb819040cabb22324a584382c162d20d5cbf9e1de21ecf6536a8e9d41921273f

SHA512
418d5023b5379d20c85dd2f3e08ad9c3f31c17581fdfc30bf987635ebef599727fffb9d3542808b78cd15c4336fb3551683228f566270d92331071fcb32e3a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
dcaa6df8b2ce5032565e26d09549ed02

SHA1
ef6d57c84c71d32fd5c2375cff541f3f2c724a3b

SHA256
cf247411d40f7dd518f31633bed1205c429dc22ce4a64a104e2c525eae724970

SHA512
71616d7998ad2d725e995ab0a28db82b24b78d6223125ca24387dcca7526c5cc23e87fe4fe133438bde466b7f36cc4438bbe1d23d7fcfa5ead5f5dbf6f65ead3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cd23.TMP
Filesize
1KB

MD5
06a388cb06e803f5dc4c03c262eb5912

SHA1
d0b347c329c07f0f7f6a87b8a7c3705dca04324a

SHA256
d74046c31f04b8fb306f8a42b41310e6bb2445817a6b22369f87b0fa795e9f23

SHA512
9c56095e5357d001ee587d65b2249f72c369c9b4450cbd0392e015a900a64339a8015ec5af19d3dfaac3f0edd439d96c0bf77ebe169640b0914993b4f196f1ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
7d0d297cfaa190c8d5106be8231357ef

SHA1
13f44fad3276d33b2389f44a6796d47911c3a563

SHA256
ffdeaf9b22020cb3d2f476ea55211db6565dff7dfb1279c5742504cd0daee14f

SHA512
fd960012830fd7b22e5eb08223050dacd3ddc2724824e95e09c81e88745b927753b84e13e5277d43a49b16ccac1a7a17987a8bb240575820f735514946f3c8b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
f269060e56b2d476b191e9de31337054

SHA1
430a28ec7673ade1fb831c958752a1e7401dc193

SHA256
8052893e9e2a44b9271efd502274577984b3dfb6176947a52086e3e04d426d3b

SHA512
23b2af952ad309f5d9ea16514d4f911947b9efbde5900dc02b2321fc2e029ee4fd9f00a8804607d61a21fd17ced0574488f91d66727b2711954553a9a50aeecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\65DE.tmp\65DF.tmp\65E0.bat
Filesize
645B

MD5
376a9f688d0224a448db8acbf154f0dc

SHA1
4b36f19dc23654c9333289c37e454fe09ea28ab5

SHA256
7bdbf8bb79af152874b51f1a3c724d24070d0631d6c4c59102b60da022f4a31a

SHA512
a5aea84abd1271c92538f9262c7ca38ce5e52ef3edf697dc1442db68565751d9401da9bb9f78a52e7330451d55ed6ad4ea9b1a5835bdff7f2afab15362bf694b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7wD3zy47.exe
Filesize
89KB

MD5
4c63d8b4f91718de2669b1eb9cbc22cd

SHA1
9cc4cecc28662aed6504caa05f722a95eda5a424

SHA256
211163b0fa2acab48cdcb0dccd6c008bf5d81b92718fc90fbf16f0693ebaec11

SHA512
50437fcb42d1d5ae2985cc39fa114e84fbde5e99956c859c475b123fe041958cceaf18bca8fdaf8ac92597380a7e2da1e889b2bc5dc7a18cb9748fbaed5f97be

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iZ5KL58.exe
Filesize
1.4MB

MD5
76cd536d472bee848058b455b479e432

SHA1
9c742fa03a057039ed4311ec6f3a50b142458f98

SHA256
ebdb3e356837ed476380ec6645eeb91fc639209c50cc81b668601bac9013a370

SHA512
8feb743d70a9ebf1884f450994788a3159ccd2d3ae37c8205ed4f60f571b569203aaef0bb1bf5c7dd008fb9823ff105327c8b064a8763179b696b1ef759eabe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6nj8Bd1.exe
Filesize
182KB

MD5
47fb2a8040b1de651ead55ae87690449

SHA1
90bbf82526aa1f7d87f444296003cb1b37860b8f

SHA256
b09d4c825e850c2c5d6f9a900f5ad5f035e3102ac5e713dcc3ce6a3ec6661376

SHA512
0c29613442c972032284d007d3ff4276ecc433d23a34d0e6cbfac71ea2f0f07dcce1a2aa8e1512bbe2c31bbfd37d3b31688c3a0c28106d2679bb6d5c1c781353

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ax5HT65.exe
Filesize
1.2MB

MD5
47c13b767e6ca5c30e47bc6a97ac15d0

SHA1
4cb620ba23fc9f2bcf123814d3cd644bd3880d4b

SHA256
e8a4afa2dd0d1625e8a5b9e6ce8cd78770661923cca06c7dabc9df5bb9ef882b

SHA512
e220759f31c84e478b2a45cfd95a427becd755a9bbd641988576257656616fc4a84012575985ef353fc1d73c5f76ebecb69496c5ba76af95a5607f4f6e3317c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5cd3ke9.exe
Filesize
219KB

MD5
0d51ca6c86f1be63b52fab49f4f3d04e

SHA1
860e11ebd1da88bb20ff835b4c26e1707d9a853e

SHA256
da3382a454e110c3bdcab8d18825ca8e84135d4b06fead5e8035649aa0db28c4

SHA512
5a9ab6e0f7510ce45de48c533c51457068e8496ff1ee3bd4f397150399a105006a6ec4cd8a7e1b58b4ec3db39f3038c0dcf5e6aae1e8be5a8e8e950d8b6a1ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\eU0eg95.exe
Filesize
1.1MB

MD5
7c841f04d0db30fca527e6241f2f55f6

SHA1
d013030f21af549de8e9893551d36c94e5b0ba17

SHA256
1c5ecdf1fc0af89882117af3e7bafe72a1565723ef6702277938e56b4bfd6c93

SHA512
21cbc717ab24e7491bcade7e49c2208c2dc6b854ff9cfa51e17a9919107f953a37b7f23f9a8deb6a9740d07d20c8db047601f3db357014326757828a7e54de2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4bo585QP.exe
Filesize
1.1MB

MD5
1f531de869b40ec6f169c33476e27746

SHA1
aea5afac149cefd8e6ebdd4164c4e91ab5d3fd8b

SHA256
42ae85b4dc788dd33b90608aa722a53d5e6714af8b768b7047cc7bf925d10d96

SHA512
0bbcfc55db6e9db12f0df5cce666076a8e680cfbe633f4882da911b586a444a31da59f2b3da8585728fe61fc9c1370f08fe82ab1254587aa7695f26400757ee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\QT1eA51.exe
Filesize
656KB

MD5
f3e7de2a57075e4ddc74136c69a1de74

SHA1
7fef0487c75a3f4b0588b69ec984d2a7b7b441d5

SHA256
732d5795b19ba2a75a1430d4a69be6a11367bd8ec633643af1cb97f6c5983c65

SHA512
4bca4bf5ae5a35235c05b4bd87909e95b9d3fd9678ad9f933984a68033495eb269b85499c8270fb4e3856bb943752c9e7c65753f057e361e3dea48d591c98cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3DC11De.exe
Filesize
30KB

MD5
a150cb7612547ffa842cfa3cb818815d

SHA1
ca27d884715f5085fdbedf7b6b2e8c9b2570234a

SHA256
4538e03c71f2ce91bb716d756cceb3a281279dbb788ec79983061f57a3bc3108

SHA512
883aa4ad973e5078834d4b417d547f871521dbd7bef29d1bea2d5eb53a02676087b7738e67d8617c634b43c3c4e423dd202c589a39781210da69fccb490316f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\GI9Ju35.exe
Filesize
532KB

MD5
abc5894b2b927c28707bf4e1a53b3380

SHA1
7481ae78cc53022cc196ca1633777d33934a5816

SHA256
b3f8df1c32b147d3cbb51aad55974ff54467eceda45adf03cf1083702ec6fd87

SHA512
2f8e77ac03670ee3a7a09e13b6f0dda9523e24d4ab643a324694e69ff115fad6d03905ca71182e248f396bdd411cfa45dccdfeed85da76829ef123079cad37a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Ee74lL7.exe
Filesize
891KB

MD5
1299e1843120126ed0b7f61f3c7d3281

SHA1
46f29ca7b1d6273a8ec8eb591106db30b0c4803a

SHA256
0c9423ff86ef39dbf0115e766256c97d5386d5d86ffda0faa599dc12a47b9b10

SHA512
e3b1050d11978148cc5f677eb8b04f1d0eea3fb0ee4a2c59fb0b88d9389b7ba12f2ac10becf25b5287bc4ad2572bced0ba4f19acf032f3fa493d2476102bdf79

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2eJ5051.exe
Filesize
1.1MB

MD5
8ee06103508841d589beebb3170fe1f1

SHA1
5779caa74ca1824fa1faf171a24a4905c2b8c43e

SHA256
8b8ef90fc3e3331f756cd68a285540d0e21e10617998e2bf0d513635dd71cc9b

SHA512
fa95f22ae95a1b7b679db8e960a00e3e8bff03f0ed3de6acb862ce85f43ddb8f2bcac9e6148944761664f69fe12a8515cd0a2fa2f08be7d7ec0c91672b5add40

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
\??\pipe\LOCAL\crashpad_3696_THBWNPLJGNETGFAG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1672-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1672-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2396-46-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/2396-64-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/2396-42-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3508-56-0x0000000002F40000-0x0000000002F56000-memory.dmp

Filesize
88KB

Download
memory/4136-95-0x0000000007F30000-0x0000000007F6C000-memory.dmp

Filesize
240KB

Download
memory/4136-90-0x0000000008CC0000-0x00000000092D8000-memory.dmp

Filesize
6.1MB

Download
memory/4136-83-0x0000000007DF0000-0x0000000007DFA000-memory.dmp

Filesize
40KB

Download
memory/4136-65-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4136-78-0x0000000007C40000-0x0000000007CD2000-memory.dmp

Filesize
584KB

Download
memory/4136-75-0x00000000080F0000-0x0000000008694000-memory.dmp

Filesize
5.6MB

Download
memory/4136-381-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/4136-382-0x0000000007E80000-0x0000000007E90000-memory.dmp

Filesize
64KB

Download
memory/4136-96-0x0000000007F70000-0x0000000007FBC000-memory.dmp

Filesize
304KB

Download
memory/4136-82-0x0000000007E80000-0x0000000007E90000-memory.dmp

Filesize
64KB

Download
memory/4136-93-0x0000000007ED0000-0x0000000007EE2000-memory.dmp

Filesize
72KB

Download
memory/4136-72-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/4136-92-0x00000000086A0000-0x00000000087AA000-memory.dmp

Filesize
1.0MB

Download
memory/4632-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-51-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download