amadey | 61a5f6593f9dc74943f1aa03d0a92297b9c2b6800265af3c5ba8bc67f90f6f33

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exe
Size

1.7MB
MD5

c1e80da312a1bd6a1f1aaa161018666c
SHA1

32e5f748d2e2cfae1be622e40f311915149416c7
SHA256

8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd
SHA512

3edf7efe24308d909f9709f281a5121c187d19823784feedc7f5d4ca9c42eb78c9f39ebf3c9c1d58956fd5881f2a230700bc11257f87d395032ab26a35a55552
SSDEEP

24576:cykJbJ36Orsbh8qXBxizQmEOUIx7qse9vvyDF4UMuohhDLFmEAfiVReF4EG9HfFs:Lkv36Ouh8qLiEldgYCx4L7YgaEH

Score

10^/10

amadey dcrat mystic redline smokeloader homed backdoor evasion infostealer persistence rat stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

homed

109.107.182.133:19084

Extracted

Family

amadey

Version

3.89

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Mystic stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Go0820.exe	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4320-48-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explothe.exe6Io5Sy6.exe5IT0Kz2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	6Io5Sy6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	5IT0Kz2.exe

Executes dropped EXE 14 IoCs

Processes:

PJ7bA32.exeaw7VQ41.exeDV7aS68.exerc0NI19.exe1fd71ys1.exe2Go0820.exe3NB83xM.exe4dc387bG.exe5IT0Kz2.exeexplothe.exe6Io5Sy6.exeexplothe.exeexplothe.exeebvvvjt

pid	process
4500	PJ7bA32.exe
760	aw7VQ41.exe
1696	DV7aS68.exe
2812	rc0NI19.exe
2240	1fd71ys1.exe
4276	2Go0820.exe
3992	3NB83xM.exe
3504	4dc387bG.exe
3628	5IT0Kz2.exe
4100	explothe.exe
4812	6Io5Sy6.exe
5512	explothe.exe
2092	explothe.exe
4252	ebvvvjt

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Io5Sy6.exe	upx
behavioral1/memory/4812-68-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/4812-92-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exePJ7bA32.exeaw7VQ41.exeDV7aS68.exerc0NI19.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	PJ7bA32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	aw7VQ41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	DV7aS68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	rc0NI19.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

1fd71ys1.exe3NB83xM.exe4dc387bG.exe

description	pid	process	target process
PID 2240 set thread context of 3192	2240	1fd71ys1.exe	AppLaunch.exe
PID 3992 set thread context of 2648	3992	3NB83xM.exe	AppLaunch.exe
PID 3504 set thread context of 4320	3504	4dc387bG.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1784 schtasks.exe

pid	process
1784	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exeAppLaunch.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
2648	AppLaunch.exe
2648	AppLaunch.exe
3192	AppLaunch.exe
3192	AppLaunch.exe
4348	msedge.exe
4348	msedge.exe
1288	msedge.exe
1288	msedge.exe
3320	msedge.exe
3320	msedge.exe
984	msedge.exe
984	msedge.exe
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

2648 AppLaunch.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3320 msedge.exe
3320 msedge.exe
3320 msedge.exe
3320 msedge.exe
3320 msedge.exe
3320 msedge.exe
3320 msedge.exe
3320 msedge.exe
3320 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 3192 AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	3192	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3444

pid	process
3444

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exePJ7bA32.exeaw7VQ41.exeDV7aS68.exerc0NI19.exe1fd71ys1.exe3NB83xM.exe4dc387bG.exe5IT0Kz2.exeexplothe.exe6Io5Sy6.execmd.exe

description	pid	process	target process
PID 4284 wrote to memory of 4500	4284	8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exe	PJ7bA32.exe
PID 4284 wrote to memory of 4500	4284	8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exe	PJ7bA32.exe
PID 4284 wrote to memory of 4500	4284	8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exe	PJ7bA32.exe
PID 4500 wrote to memory of 760	4500	PJ7bA32.exe	aw7VQ41.exe
PID 4500 wrote to memory of 760	4500	PJ7bA32.exe	aw7VQ41.exe
PID 4500 wrote to memory of 760	4500	PJ7bA32.exe	aw7VQ41.exe
PID 760 wrote to memory of 1696	760	aw7VQ41.exe	DV7aS68.exe
PID 760 wrote to memory of 1696	760	aw7VQ41.exe	DV7aS68.exe
PID 760 wrote to memory of 1696	760	aw7VQ41.exe	DV7aS68.exe
PID 1696 wrote to memory of 2812	1696	DV7aS68.exe	rc0NI19.exe
PID 1696 wrote to memory of 2812	1696	DV7aS68.exe	rc0NI19.exe
PID 1696 wrote to memory of 2812	1696	DV7aS68.exe	rc0NI19.exe
PID 2812 wrote to memory of 2240	2812	rc0NI19.exe	1fd71ys1.exe
PID 2812 wrote to memory of 2240	2812	rc0NI19.exe	1fd71ys1.exe
PID 2812 wrote to memory of 2240	2812	rc0NI19.exe	1fd71ys1.exe
PID 2240 wrote to memory of 3192	2240	1fd71ys1.exe	AppLaunch.exe
PID 2240 wrote to memory of 3192	2240	1fd71ys1.exe	AppLaunch.exe
PID 2240 wrote to memory of 3192	2240	1fd71ys1.exe	AppLaunch.exe
PID 2240 wrote to memory of 3192	2240	1fd71ys1.exe	AppLaunch.exe
PID 2240 wrote to memory of 3192	2240	1fd71ys1.exe	AppLaunch.exe
PID 2240 wrote to memory of 3192	2240	1fd71ys1.exe	AppLaunch.exe
PID 2240 wrote to memory of 3192	2240	1fd71ys1.exe	AppLaunch.exe
PID 2240 wrote to memory of 3192	2240	1fd71ys1.exe	AppLaunch.exe
PID 2812 wrote to memory of 4276	2812	rc0NI19.exe	2Go0820.exe
PID 2812 wrote to memory of 4276	2812	rc0NI19.exe	2Go0820.exe
PID 2812 wrote to memory of 4276	2812	rc0NI19.exe	2Go0820.exe
PID 1696 wrote to memory of 3992	1696	DV7aS68.exe	3NB83xM.exe
PID 1696 wrote to memory of 3992	1696	DV7aS68.exe	3NB83xM.exe
PID 1696 wrote to memory of 3992	1696	DV7aS68.exe	3NB83xM.exe
PID 3992 wrote to memory of 2648	3992	3NB83xM.exe	AppLaunch.exe
PID 3992 wrote to memory of 2648	3992	3NB83xM.exe	AppLaunch.exe
PID 3992 wrote to memory of 2648	3992	3NB83xM.exe	AppLaunch.exe
PID 3992 wrote to memory of 2648	3992	3NB83xM.exe	AppLaunch.exe
PID 3992 wrote to memory of 2648	3992	3NB83xM.exe	AppLaunch.exe
PID 3992 wrote to memory of 2648	3992	3NB83xM.exe	AppLaunch.exe
PID 760 wrote to memory of 3504	760	aw7VQ41.exe	4dc387bG.exe
PID 760 wrote to memory of 3504	760	aw7VQ41.exe	4dc387bG.exe
PID 760 wrote to memory of 3504	760	aw7VQ41.exe	4dc387bG.exe
PID 3504 wrote to memory of 4320	3504	4dc387bG.exe	AppLaunch.exe
PID 3504 wrote to memory of 4320	3504	4dc387bG.exe	AppLaunch.exe
PID 3504 wrote to memory of 4320	3504	4dc387bG.exe	AppLaunch.exe
PID 3504 wrote to memory of 4320	3504	4dc387bG.exe	AppLaunch.exe
PID 3504 wrote to memory of 4320	3504	4dc387bG.exe	AppLaunch.exe
PID 3504 wrote to memory of 4320	3504	4dc387bG.exe	AppLaunch.exe
PID 3504 wrote to memory of 4320	3504	4dc387bG.exe	AppLaunch.exe
PID 3504 wrote to memory of 4320	3504	4dc387bG.exe	AppLaunch.exe
PID 4500 wrote to memory of 3628	4500	PJ7bA32.exe	5IT0Kz2.exe
PID 4500 wrote to memory of 3628	4500	PJ7bA32.exe	5IT0Kz2.exe
PID 4500 wrote to memory of 3628	4500	PJ7bA32.exe	5IT0Kz2.exe
PID 3628 wrote to memory of 4100	3628	5IT0Kz2.exe	explothe.exe
PID 3628 wrote to memory of 4100	3628	5IT0Kz2.exe	explothe.exe
PID 3628 wrote to memory of 4100	3628	5IT0Kz2.exe	explothe.exe
PID 4284 wrote to memory of 4812	4284	8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exe	6Io5Sy6.exe
PID 4284 wrote to memory of 4812	4284	8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exe	6Io5Sy6.exe
PID 4284 wrote to memory of 4812	4284	8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exe	6Io5Sy6.exe
PID 4100 wrote to memory of 1784	4100	explothe.exe	schtasks.exe
PID 4100 wrote to memory of 1784	4100	explothe.exe	schtasks.exe
PID 4100 wrote to memory of 1784	4100	explothe.exe	schtasks.exe
PID 4812 wrote to memory of 3840	4812	6Io5Sy6.exe	cmd.exe
PID 4812 wrote to memory of 3840	4812	6Io5Sy6.exe	cmd.exe
PID 4100 wrote to memory of 4972	4100	explothe.exe	cmd.exe
PID 4100 wrote to memory of 4972	4100	explothe.exe	cmd.exe
PID 4100 wrote to memory of 4972	4100	explothe.exe	cmd.exe
PID 4972 wrote to memory of 4992	4972	cmd.exe	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exe
"C:\Users\Admin\AppData\Local\Temp\8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4284

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PJ7bA32.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PJ7bA32.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4500

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aw7VQ41.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aw7VQ41.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:760

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\DV7aS68.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\DV7aS68.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rc0NI19.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rc0NI19.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2812

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1fd71ys1.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1fd71ys1.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Go0820.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Go0820.exe
6⤵
- Executes dropped EXE
PID:4276

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3NB83xM.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3NB83xM.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2648

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4dc387bG.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4dc387bG.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:4320

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5IT0Kz2.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5IT0Kz2.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
5⤵
- Creates scheduled task(s)
PID:1784

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
5⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4992

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
6⤵
PID:3516

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
6⤵
PID:3704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:3064

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
6⤵
PID:1904

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
6⤵
PID:3556

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Io5Sy6.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Io5Sy6.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3C9B.tmp\3C9C.tmp\3C9D.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Io5Sy6.exe"
3⤵
PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fff772846f8,0x7fff77284708,0x7fff77284718
5⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
5⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
5⤵
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
5⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
5⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
5⤵
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
5⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
5⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4784 /prefetch:8
5⤵
PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
5⤵
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
5⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
5⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
5⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
5⤵
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
5⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2843650299715749125,14706396100626491788,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5860 /prefetch:2
5⤵
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
4⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fff772846f8,0x7fff77284708,0x7fff77284718
5⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5759626173006019555,13641216543540319912,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
5⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5759626173006019555,13641216543540319912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fff772846f8,0x7fff77284708,0x7fff77284718
5⤵
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3488179992840966797,7557005939434528361,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
5⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3488179992840966797,7557005939434528361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6024

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:5512

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:2092

C:\Users\Admin\AppData\Roaming\ebvvvjt
C:\Users\Admin\AppData\Roaming\ebvvvjt
1⤵
- Executes dropped EXE
PID:4252

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
27839ef112b7dd7677ed5f13f9fb79f0

SHA1
de49b2fdacaecd014e049c10288c9cb22866b4db

SHA256
ec04456197df998f9e973aa85f53c3e2e926d3bdb31e2f01b1851202e6e47852

SHA512
dbb7b2122684baf83c287befa6fa9f2f27f5cea880326ac2fe4c33dc89a7405ef3cce3426dd7226ef2ad1d9abeea73266e8e82860edfd3a3f2fbe231a3882446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
2b20beaa129f6c34ac8abaa133014657

SHA1
1a29ad33324807c2de1edcedd6ab5805f2103215

SHA256
1d09fc07db9e304e27b4fdc38016b2bf04fd0cd2d24b47ec5f45d7ec2da81ff9

SHA512
b0eb9ddfa0b0b97647ce017d443b4f9cee37047eaebe493556d5c6f07a7363708e8685e8c5e1150f1c3d303c7b8e68a31ae55dc2f6a91d9ce1ea24658bd61813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
56a65985892114ba51a969458af2383c

SHA1
2fe97e29b83d603606409d1e264702be8f31b40e

SHA256
ece6f231e6024c43ddd6da0b3c9961d47ddd4bb5bcdd2bfa3cfaf22e9877207e

SHA512
0fe252bde4f196271ed4d9eab21418a1f405d1fbcebb0d0ed67800d571eab470358a1f299bfeea18b837129777471165e9f2180d20f917a64ffb04a432926892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3e0a857fe8b144b20f3500203b1af2c9

SHA1
2401eb6fca25dc28d3e59836c4ffeabf94f79bd9

SHA256
9840cd075c1aba09f40e33ede798387eb57b77bf56fef426cac41a6404cc6abe

SHA512
4bf0933e68e2fb65e63c6c8392fd6db8e01523812c093a2dd27736ac4afe3f70cba5e55fc68b5c50f3368aec22780fd2bb654744a0afc1a9728fa2e7c4ea8825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
339251c61e9aba28f470e072537cffff

SHA1
267eb50825813dbcb48cc8edbe12304ab8016ed0

SHA256
758edbc7508a81300194652da44360c2a793aa12040dead6adeb4307bf2559a2

SHA512
1840b919fcd81d502d46bf46f29f5508a4fbac13a83ccc0af3abdb851b5d38b97e6b2e6c02c678d75ec341329916bbcec4e36926dde449941cc75b319dee188f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
05fe87f5bddc36c072802b0846ecf467

SHA1
090fc3e6a3852ec5073c74cb8ed534b223f289df

SHA256
c808759d0d11127e1d640196d68c92fbf67d67a05357adf9ebf2ed98846d5f2a

SHA512
9e987ee5d6be50a1e67268aff00f75d4fd243fa2a0182793ea003633619fb6c0214c5cb506ad18bf9d73d8781b9d6fb8630db4383b97e13ad809b9662e56a674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
377e2b24615c824990615f62d305f845

SHA1
1c829a9e15e6e7dcff0d2b088536f19fac3f2032

SHA256
a0347a5a15f5c69360321070d7bea4a192b2ef7e29a9e4d39fddd0f91bd1eae2

SHA512
9b8d5684936958f92176d821638da2705a56f1dacb2467aa618ca5d6882755a6a59b5760f03683953d38b82d7fa527994755908ef4da9af734ced03a49dc81cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
0c0699f16bd3c526ee5e623d8c345d6f

SHA1
a8bd92c9a468154f0efef91e326ffec6245c4dd1

SHA256
d18c6a47c75439b80bc7ab89db196ff1dc63d9df4278d698df68c1cb4b6a500a

SHA512
5eca874193e93ac06d41509b6e578b9884c783f5345fc99a8da78aa0756a92610d70bb76045964caa63679c4faf91b0694b617e46b5a37ce5dafab74dee59c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
a520f1e72cdcddb3fed5048c9926bbf7

SHA1
8d98a2c09e41711ca87667a44cf03e9bbafd7c78

SHA256
cfa5d001071fde56558e6e750bb599d5f245955bcb1bb0b3ef58a04055f02729

SHA512
96f4ece25d9e9c2797b59c2bacdd3a07e5ee9c8695b7a850cb9a1a705ec3e3890ed5760d2e0219c0ff663f84f891850bfb5156c7aee978bda3cd1141321b492e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ae12.TMP
Filesize
48B

MD5
b5335f30e5ceeb08df91ff383aa632ed

SHA1
410d0ced03feb15717cb3def2b6635c58a926336

SHA256
291f90cfc9e101dc7ac4084eb3ab2231ad77b591d4d4012a12b5a2adbc97fd2c

SHA512
309dbdfd788fe7c2a6e9ba72a559d701a961bd4e275008766b20cdd8453ca2ffda763a94597605c98c88b85ebd84404cf604292396d03f27b678511159698752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
a09831f47352d78e9241817fecffc349

SHA1
017f981235d07a5269b77714d18d762c9298ede1

SHA256
7da7dd5d7b120a7dd64b209a3adbbf059915831d80d1e9c44cf486876e56c181

SHA512
3a855e0f124138d6a3045431424bac2c274c6f8fb1937c819e078b3f53780fd8990c6e2c403d8bbc5647e552e619a0623ccc5164e5a5741a8bab7eecbae3d2c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
87d6c8c7645572b071f24db68167f421

SHA1
5451632d5a9a10d29a625c7b2868b4d36e12c220

SHA256
cb923cd0f804c58c4e6afda33cebe5cb4f49730701f55ad4b9e07f392a9ce0e8

SHA512
c0ad173293183916e881dbf0973bdd3365009f61448847d2fb1d9cb5f7bee24db5c9d86d9a9af9f70837592e60a1a51b8fc97d851cf7cc1cd00b8207bbeebb21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
70b10307922abec5af763f8843a25954

SHA1
7a582dbec493316859c621e477c72952a9803d72

SHA256
d25312673e698774a13322435f731082d360b69e1eb53bd21ba8f134d5d6d07d

SHA512
7628d3be74a3ba1a5058b0df2e0994de44ecca1586532069e3a2abd98cc9a3a0b3e1ccbe55ce4b7b675cf352725ed27fc3f44bf4b61f83158096e1403b965319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a623.TMP
Filesize
1KB

MD5
21a877e38cece15f7ef851cb4055bc1d

SHA1
517909a5cd2c7facaf06888dc1274fb88d80bba0

SHA256
2322b4a7894eab9b5bad772ba6026a7b0bc8da5910504a913f85b453c1d82a5d

SHA512
feaa4c836b8f22489aab4ec3c06faa4741d64cf0b571dd6436359b46b12e86ca2d1e01d3df26013be7c7653a11934f221d03eb1693c01ab319135c02f6ae0592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
4d376e28656a69bb049e2d1aad2cf7f4

SHA1
933bc9da5760e75c27ca294a22f438d0e26809a0

SHA256
cfdd6a58baa862d580d98c92b661d4e2ce1cdd3667abe8ee680c5a9aa72bfeab

SHA512
e1188c0814f86bce9df25d8ae732cc84ea6bd0548b32289e9f774b26df00350ecc80b022f6e60ea863d22c2e5714ffc0489f9a76635b18c81333f42897df6528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
b2eaf6aadf4815ec0334d8d1bca72d1b

SHA1
6cec95cda9d36ebde28ee50432f7c86ee2892c4a

SHA256
299513a14914d8da0beba1d019ce7e1793bba070f4d1380e1f35cb4a54dc2ac1

SHA512
246562720bf1fb788423d36857a44a0763a998b44b55356aa7141040fb8beaf4fa95ad495775e8710212d63a6beeae7a07c34061e0afaf3b374afe9de8719ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
15fc3c35c6fae7578142f6f9cf44157e

SHA1
a9bf257e494b143844c09072ba77b9c9ac7d15fa

SHA256
711813273f98d0f2bf125fec50b74b99c6e178b0616e5a010589abedcee080fd

SHA512
5bb229768ad2eeef59f3e4e91e1f6f053192199170d34c4fecef9e0ff37f6a7d75f50e560a1c7f64616ed544ba85a5c99b920df7bdca55eff226e52d37f78234

Download Submit
C:\Users\Admin\AppData\Local\Temp\3C9B.tmp\3C9C.tmp\3C9D.bat
Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Io5Sy6.exe
Filesize
45KB

MD5
7e65536a8734d994381b94df542c681d

SHA1
6c8df2dfe8c6d04f0d1f15ce06c2d6bfbd8366ad

SHA256
364f53238942781491cfb97ed08d72fa766d91db5c6b6dd58cb34e4f147f6452

SHA512
a1c4d9dc3f79a7d3b6f160bbd40a089a45c8d4d039c8043231216e78a9d32c8ba7e6577e6eeba066440b2b042363df03f7c7d296090918ad4e0884938fae968e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PJ7bA32.exe
Filesize
1.6MB

MD5
40eb9ea6fc3236eba7a19cad7e24cab5

SHA1
2ea4d70ebad06980f711d58c934ccb85cd0a30e7

SHA256
1b8a306830eac504d4e37d891cc22317fd0ab2b84706357fc07cd31739538f00

SHA512
4f6491c92464e38539c3d40387cc73a30a2436b5e2b37a725797a173d31d2a483e9b3735af25dcb04f01e7c668b3e13bf7e0732595851019a3ca4b1f357eadef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5IT0Kz2.exe
Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aw7VQ41.exe
Filesize
1.4MB

MD5
a029584ec52010c23c5018a5d36d86e6

SHA1
058733134b70d8d556535a297d393946e1dcabc2

SHA256
2781ebebaf6b6da8cd0be7550152f15ae66824911acce6c499912ac240d86f3d

SHA512
af4b4f31047f7664038cdc7c15f7d91ff0562e92ed1017683506ed2868324b9c49476049c85f9cb4c586c9b589fd992f433deca9e5bef9a140213e904215d73d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4dc387bG.exe
Filesize
1.9MB

MD5
54d27aec8c5f05fcabdbad2c97ffd625

SHA1
6e8215c173d7f4079fbcc13bf645e6e8e907718c

SHA256
428b5e514b65da390b7e7093da93eb8207c83a9e70778d116ad92a9b968e7769

SHA512
4b3ea8256021557e5ac3822b62ddb6a4d34373a6dcf14a9e10cb93b4ad8441268a71ca65a3955386b4bb6228b01cd55c2ef8472cde05b740018274120e31094b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\DV7aS68.exe
Filesize
935KB

MD5
2d08a83c6d431c37fb253b1f56f2dc16

SHA1
b13715e9672c3636a254c6eb5f97a19d4322d557

SHA256
07e21b763006b3d54c2877cc735a2fe459ddd145917e8a0e16b19bb67811b59b

SHA512
400591304083d3d1600530212610ed14a53c4e8eca58603eec6f089852592e45e453e0ef5fea939f01281e952b10ac25992b5189b1a32094261e807f8e6ced90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3NB83xM.exe
Filesize
1.6MB

MD5
dc169c429fc214291f3fccd46e0a0f4a

SHA1
56eca1bfc9237e0264623858c36d82cdd8b5ce07

SHA256
9d8edf4ead299677eeca1c331442aa314784ff659b8125cdc88d993f7c577aed

SHA512
6ba89e6a8758a4e71cbd03ce10967c266c64f77df5c2ee76322c0492c5dcc3dc25a22c4fb95a3feccdfd440f4a6107e9ddc6e418f3fc07b22123392775893c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rc0NI19.exe
Filesize
458KB

MD5
9aefabb3891dbd67c09415ba0eb04a5d

SHA1
0f382c6072a628b9587c8300eb91016dcff82e76

SHA256
88ea323910ebefecb33f7eafbb76ef72e6f47b88030e5df3b63ca4bce860a08e

SHA512
8b22120049cda3c7e279eb67dcccfbe50cd03e96aa7660ce4cb69b247f9234385a9c0bcf0f78fd2cf20eab7364fe374e11edb7223a989bb5744db65c276883e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1fd71ys1.exe
Filesize
875KB

MD5
73d86751a127f28504b4239773c328be

SHA1
a7b5a37edc0841e9a269b827bb0bf28ae0d8c330

SHA256
e0923f519bbf0f9c43922d26954359eed1c352db6deda6e655f838a44d655030

SHA512
464df937ab7ed3a7af81f18d5238019b4268a78dfd8b9d0df6a459c5fd19dfa480c441ce2f20f8b63dcba806e6fc646beaa6b778b52fedee7077739634bad3e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Go0820.exe
Filesize
180KB

MD5
0635bc911c5748d71a4aed170173481e

SHA1
6d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b

SHA256
a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1

SHA512
50ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
C:\Users\Admin\AppData\Roaming\ebvvvjt
Filesize
101KB

MD5
89d41e1cf478a3d3c2c701a27a5692b2

SHA1
691e20583ef80cb9a2fd3258560e7f02481d12fd

SHA256
dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

SHA512
5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

Download Submit
\??\pipe\LOCAL\crashpad_4456_SKOOHNTKCAPRAWEL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2648-177-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3192-42-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3192-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3192-304-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3444-175-0x0000000002880000-0x0000000002896000-memory.dmp

Filesize
88KB

Download
memory/4320-364-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4320-72-0x0000000008D20000-0x0000000009338000-memory.dmp

Filesize
6.1MB

Download
memory/4320-64-0x0000000007E40000-0x0000000007E50000-memory.dmp

Filesize
64KB

Download
memory/4320-374-0x0000000007E40000-0x0000000007E50000-memory.dmp

Filesize
64KB

Download
memory/4320-73-0x0000000007FE0000-0x00000000080EA000-memory.dmp

Filesize
1.0MB

Download
memory/4320-56-0x0000000007C80000-0x0000000007D12000-memory.dmp

Filesize
584KB

Download
memory/4320-55-0x0000000008150000-0x00000000086F4000-memory.dmp

Filesize
5.6MB

Download
memory/4320-52-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4320-76-0x00000000080F0000-0x000000000813C000-memory.dmp

Filesize
304KB

Download
memory/4320-75-0x0000000007F70000-0x0000000007FAC000-memory.dmp

Filesize
240KB

Download
memory/4320-70-0x0000000007E30000-0x0000000007E3A000-memory.dmp

Filesize
40KB

Download
memory/4320-74-0x0000000007F10000-0x0000000007F22000-memory.dmp

Filesize
72KB

Download
memory/4320-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4812-92-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4812-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download