amadey | e8ff089250c917fe30d47d7a01d38014910cdba44d551f8df261ec235a0d830d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4a8466ebd6ec25b836f3d0c5c54a633e4d4ec5ad8fd14edd57c14b239ffcce5.exe
Size

1.6MB
MD5

d4d937fe82ff4a99aab43581fb89ec9f
SHA1

fe92b474f9c335d77cbc3a12be2a3e0677038cf0
SHA256

b4a8466ebd6ec25b836f3d0c5c54a633e4d4ec5ad8fd14edd57c14b239ffcce5
SHA512

521c788a60c2f60327f28d79e53699d47d24786b9aa3af9403d103da589459e2320fb751a9803686f74f50b204387827010a96cbac5bd45b4c6947827b919a1e
SSDEEP

24576:OySD8YKtnyEXKS+e1RpuiZU498QkiRimacgdx9We/12zCrzi/O+O1ajULtfT22F6:d++tAde/iQkUipYet2zCrz1d1ajk9

Score

10^/10

amadey dcrat mystic redline smokeloader grome backdoor evasion infostealer persistence rat stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Mystic stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2440-51-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2440-49-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2440-48-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2440-47-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6bO3qV6.exe	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4248-63-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5Qf5VN2.exeexplothe.exe7XM4Ys25.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	5Qf5VN2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	7XM4Ys25.exe

Executes dropped EXE 15 IoCs

Processes:

jF3dl08.exeGU5lD08.exeff8hQ09.exetQ4Ct24.exeDx2cC84.exe1EV04Vx4.exe2Qd9357.exe3nd59wD.exe4Kv029eK.exe5Qf5VN2.exeexplothe.exe6bO3qV6.exe7XM4Ys25.exeexplothe.exeexplothe.exe

pid	process
4684	jF3dl08.exe
3964	GU5lD08.exe
4324	ff8hQ09.exe
3928	tQ4Ct24.exe
3968	Dx2cC84.exe
3808	1EV04Vx4.exe
3608	2Qd9357.exe
4576	3nd59wD.exe
1648	4Kv029eK.exe
2660	5Qf5VN2.exe
2828	explothe.exe
1456	6bO3qV6.exe
4844	7XM4Ys25.exe
3916	explothe.exe
1004	explothe.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

GU5lD08.exeff8hQ09.exetQ4Ct24.exeDx2cC84.exeb4a8466ebd6ec25b836f3d0c5c54a633e4d4ec5ad8fd14edd57c14b239ffcce5.exejF3dl08.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	GU5lD08.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	ff8hQ09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	tQ4Ct24.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	Dx2cC84.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b4a8466ebd6ec25b836f3d0c5c54a633e4d4ec5ad8fd14edd57c14b239ffcce5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	jF3dl08.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

1EV04Vx4.exe2Qd9357.exe4Kv029eK.exe

description	pid	process	target process
PID 3808 set thread context of 1232	3808	1EV04Vx4.exe	AppLaunch.exe
PID 3608 set thread context of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 1648 set thread context of 4248	1648	4Kv029eK.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2096 2440 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
2096	2440	WerFault.exe	AppLaunch.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3nd59wD.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3nd59wD.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3nd59wD.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3nd59wD.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

640 schtasks.exe

pid	process
640	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3nd59wD.exeAppLaunch.exemsedge.exemsedge.exe

pid	process
4576	3nd59wD.exe
4576	3nd59wD.exe
1232	AppLaunch.exe
1232	AppLaunch.exe
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3500
3716	msedge.exe
3716	msedge.exe
3500
3500
872	msedge.exe
872	msedge.exe
3500
3500

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3nd59wD.exe

pid process

4576 3nd59wD.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4388 msedge.exe
4388 msedge.exe
4388 msedge.exe
4388 msedge.exe
4388 msedge.exe
4388 msedge.exe
4388 msedge.exe
4388 msedge.exe
4388 msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1232	AppLaunch.exe
Token: SeShutdownPrivilege	3500
Token: SeCreatePagefilePrivilege	3500
Token: SeShutdownPrivilege	3500
Token: SeCreatePagefilePrivilege	3500
Token: SeShutdownPrivilege	3500
Token: SeCreatePagefilePrivilege	3500
Token: SeShutdownPrivilege	3500
Token: SeCreatePagefilePrivilege	3500
Token: SeShutdownPrivilege	3500
Token: SeCreatePagefilePrivilege	3500
Token: SeShutdownPrivilege	3500
Token: SeCreatePagefilePrivilege	3500
Token: SeShutdownPrivilege	3500
Token: SeCreatePagefilePrivilege	3500
Token: SeShutdownPrivilege	3500
Token: SeCreatePagefilePrivilege	3500
Token: SeShutdownPrivilege	3500
Token: SeCreatePagefilePrivilege	3500

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3500

pid	process
3500

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b4a8466ebd6ec25b836f3d0c5c54a633e4d4ec5ad8fd14edd57c14b239ffcce5.exejF3dl08.exeGU5lD08.exeff8hQ09.exetQ4Ct24.exeDx2cC84.exe1EV04Vx4.exe2Qd9357.exe4Kv029eK.exe

description	pid	process	target process
PID 1124 wrote to memory of 4684	1124	b4a8466ebd6ec25b836f3d0c5c54a633e4d4ec5ad8fd14edd57c14b239ffcce5.exe	jF3dl08.exe
PID 1124 wrote to memory of 4684	1124	b4a8466ebd6ec25b836f3d0c5c54a633e4d4ec5ad8fd14edd57c14b239ffcce5.exe	jF3dl08.exe
PID 1124 wrote to memory of 4684	1124	b4a8466ebd6ec25b836f3d0c5c54a633e4d4ec5ad8fd14edd57c14b239ffcce5.exe	jF3dl08.exe
PID 4684 wrote to memory of 3964	4684	jF3dl08.exe	GU5lD08.exe
PID 4684 wrote to memory of 3964	4684	jF3dl08.exe	GU5lD08.exe
PID 4684 wrote to memory of 3964	4684	jF3dl08.exe	GU5lD08.exe
PID 3964 wrote to memory of 4324	3964	GU5lD08.exe	ff8hQ09.exe
PID 3964 wrote to memory of 4324	3964	GU5lD08.exe	ff8hQ09.exe
PID 3964 wrote to memory of 4324	3964	GU5lD08.exe	ff8hQ09.exe
PID 4324 wrote to memory of 3928	4324	ff8hQ09.exe	tQ4Ct24.exe
PID 4324 wrote to memory of 3928	4324	ff8hQ09.exe	tQ4Ct24.exe
PID 4324 wrote to memory of 3928	4324	ff8hQ09.exe	tQ4Ct24.exe
PID 3928 wrote to memory of 3968	3928	tQ4Ct24.exe	Dx2cC84.exe
PID 3928 wrote to memory of 3968	3928	tQ4Ct24.exe	Dx2cC84.exe
PID 3928 wrote to memory of 3968	3928	tQ4Ct24.exe	Dx2cC84.exe
PID 3968 wrote to memory of 3808	3968	Dx2cC84.exe	1EV04Vx4.exe
PID 3968 wrote to memory of 3808	3968	Dx2cC84.exe	1EV04Vx4.exe
PID 3968 wrote to memory of 3808	3968	Dx2cC84.exe	1EV04Vx4.exe
PID 3808 wrote to memory of 1232	3808	1EV04Vx4.exe	AppLaunch.exe
PID 3808 wrote to memory of 1232	3808	1EV04Vx4.exe	AppLaunch.exe
PID 3808 wrote to memory of 1232	3808	1EV04Vx4.exe	AppLaunch.exe
PID 3808 wrote to memory of 1232	3808	1EV04Vx4.exe	AppLaunch.exe
PID 3808 wrote to memory of 1232	3808	1EV04Vx4.exe	AppLaunch.exe
PID 3808 wrote to memory of 1232	3808	1EV04Vx4.exe	AppLaunch.exe
PID 3808 wrote to memory of 1232	3808	1EV04Vx4.exe	AppLaunch.exe
PID 3808 wrote to memory of 1232	3808	1EV04Vx4.exe	AppLaunch.exe
PID 3968 wrote to memory of 3608	3968	Dx2cC84.exe	2Qd9357.exe
PID 3968 wrote to memory of 3608	3968	Dx2cC84.exe	2Qd9357.exe
PID 3968 wrote to memory of 3608	3968	Dx2cC84.exe	2Qd9357.exe
PID 3608 wrote to memory of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 3608 wrote to memory of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 3608 wrote to memory of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 3608 wrote to memory of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 3608 wrote to memory of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 3608 wrote to memory of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 3608 wrote to memory of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 3608 wrote to memory of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 3608 wrote to memory of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 3608 wrote to memory of 2440	3608	2Qd9357.exe	AppLaunch.exe
PID 3928 wrote to memory of 4576	3928	tQ4Ct24.exe	3nd59wD.exe
PID 3928 wrote to memory of 4576	3928	tQ4Ct24.exe	3nd59wD.exe
PID 3928 wrote to memory of 4576	3928	tQ4Ct24.exe	3nd59wD.exe
PID 4324 wrote to memory of 1648	4324	ff8hQ09.exe	4Kv029eK.exe
PID 4324 wrote to memory of 1648	4324	ff8hQ09.exe	4Kv029eK.exe
PID 4324 wrote to memory of 1648	4324	ff8hQ09.exe	4Kv029eK.exe
PID 1648 wrote to memory of 2604	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 2604	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 2604	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 3744	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 3744	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 3744	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 1772	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 1772	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 1772	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 4588	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 4588	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 4588	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 4248	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 4248	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 4248	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 4248	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 4248	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 4248	1648	4Kv029eK.exe	AppLaunch.exe
PID 1648 wrote to memory of 4248	1648	4Kv029eK.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\b4a8466ebd6ec25b836f3d0c5c54a633e4d4ec5ad8fd14edd57c14b239ffcce5.exe
"C:\Users\Admin\AppData\Local\Temp\b4a8466ebd6ec25b836f3d0c5c54a633e4d4ec5ad8fd14edd57c14b239ffcce5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1124

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jF3dl08.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jF3dl08.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4684

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GU5lD08.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GU5lD08.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3964

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ff8hQ09.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ff8hQ09.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4324

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tQ4Ct24.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tQ4Ct24.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3928

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Dx2cC84.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Dx2cC84.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3968

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EV04Vx4.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EV04Vx4.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Qd9357.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Qd9357.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 540
9⤵
- Program crash
PID:2096

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3nd59wD.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3nd59wD.exe
6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4576

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Kv029eK.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Kv029eK.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:2604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:3744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:1772

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4248

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Qf5VN2.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Qf5VN2.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:2660

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:2828

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
6⤵
- Creates scheduled task(s)
PID:640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
6⤵
PID:3520

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:3368

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
7⤵
PID:1404

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
7⤵
PID:2532

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:2644

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
7⤵
PID:1392

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
7⤵
PID:5024

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6bO3qV6.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6bO3qV6.exe
3⤵
- Executes dropped EXE
PID:1456

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7XM4Ys25.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7XM4Ys25.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4844

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\690A.tmp\690B.tmp\690C.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7XM4Ys25.exe"
3⤵
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff962f846f8,0x7ff962f84708,0x7ff962f84718
5⤵
PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7602248565068285052,13800309010860030578,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
5⤵
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,7602248565068285052,13800309010860030578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x174,0x178,0x17c,0x150,0x180,0x7ff962f846f8,0x7ff962f84708,0x7ff962f84718
5⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
5⤵
PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
5⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
5⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
5⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
5⤵
PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
5⤵
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
5⤵
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5100 /prefetch:8
5⤵
PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
5⤵
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
5⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
5⤵
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
5⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
5⤵
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
5⤵
PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3308310852032281869,15389998809576596527,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
5⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff962f846f8,0x7ff962f84708,0x7ff962f84718
5⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,5516737794456883494,8788056435311123233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
5⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2440 -ip 2440
1⤵
PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1260

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:3916

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:1004

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
9c62c05145f55e984545d80c1a54fc88

SHA1
18021e99472e71536831417d25b149c06589b460

SHA256
b267502eb65ccf88fb86740a09e204853df59059e05f2c177468d1499654f4b0

SHA512
00080ee9be28e864f5cb86be63a0731d8089f4a30882e49f7350460be48b650f881db3407f04466137b89635e6d604be86cebdf67682d58774d08963887b321e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
17d82d9cf9a1a865169bdcd2f5762c3a

SHA1
61012641796d30440416353863fe3a23913a0788

SHA256
a92cb9d417f9dd4e866406be794438d0877b9aabdeeb8f9eda25c651588c6c01

SHA512
305e167d54e3379eda52bf0641026b25cf3191a968c5fffd0a6fdcf4145054ed29e023223f90d3163ff4d22610e64eca768d336239c1b7e26ff9caabe9d800fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
84446dfdfae93e38856d2336469d45f7

SHA1
2e38b3fa5a84609e1e948d17e11d8a6a77597126

SHA256
cb3fe0903899abe6a769ac4dcb2526494971b4a8de8e09d8828141e8ae34620e

SHA512
18ccfd36e070d6580cc816b01f05bb8298bcc00cbba6c078f8d268ec4c44260d2d42a01143d5adb56f7a3cad5de377c4aa9ab5f849cc14d9b61be626b3e794c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
3808ce9b47a479e8e87a4adf0fb629a8

SHA1
8fb1cf9a9abe343d476f1b0920f39bf165a36f99

SHA256
699888d81d141a3b5d78d151c24a1cd7431a72d4136305513bddd40b7366c565

SHA512
71fac6c38fb7e920a36ec309e56670515893e8d60a87c697e9c6de9986e870a6f6b4fe934b8ecc7b4eddd51eb927c35a5679e56e6cdbfd2c433e92d5b774e8f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d6af9c60bc263a7dac7f3b884e6f874c

SHA1
d04970c309afb8240214721f310252c052f17e26

SHA256
d58407d09feb72386214c5d187fcbbe4e71945dcb253685ea05e521aaea127d7

SHA512
882e322d662649fbb73b3eed5fb348ff242b26cff15145cac6b21d43eec5ff0779d1ee81a665c6ac084bbd8f9ef0f6a2df75f48f96322adc56d9fae086bfa0f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
4450cffbd5d1226399d09c402877da15

SHA1
cdc702441c78f11f11bd748d19634869a8a64fd7

SHA256
b0975fbe2d428339f8762ea90a4811970068791ee7a38773939b77c7b560d10e

SHA512
101bc2e713389310fb6cc6bda9e78113640e0f53b0abf2d731d62627accdb629c96f4f0ac59d2355dc426236f1370f3d9d25e9d868f41f6584a32d77603e7a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
2c2ad9d3b8c907aeaedf3f6d357936b2

SHA1
e0ea69b0250cb1ce66da4948f842bb955127578f

SHA256
3832d24e77389e8ccc517e9ccc186ce3a15aa8ba42aff99c33365685804442bc

SHA512
cabbb96daa6cce990beaca283fc3df1a20bea9a60a310592429233663cfa8899fdbdb22cd2ea67522f15dfcbb066ed2841d172b61c5beac0f5e64a3ad23226d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
539ee4968f3399679bb8983b620de69e

SHA1
b1fc663a998b74933de7ea376841259fb31eaba5

SHA256
2c39f68c30a6e09833473572bb4627621ae8983bd43043b8aa39f06e329bfbca

SHA512
40f0f5adbc7a324723fe0b1ac3ad37d4c74792c17be9e67111c6b9cf42746d7e05235149df9434a8e893cd7c97659319047186acbabea8554a6a146bd97bda08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
a273b515464996c63144f9eef8799f59

SHA1
882e8a8b36a54c47d297c76136dc40b3569ec7e9

SHA256
f531b675df815352828e8c34f410c8b3f36b27fd117e4cb4487cd03878fd9822

SHA512
9d131df519e75aeed188ff994e5b9caec9099bf671cf641754d91c230e0dc0675dfac4cf87acf8f37002bf4b53dca9f7fb29abb2320a22d0b9dcbd7da5a805e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ce3d.TMP
Filesize
48B

MD5
742f05ec2554cb90916adc4cd4464abc

SHA1
6535687e274d0b63bd33da7b226819e93a4c139d

SHA256
e51359070046566ab5e553eeda5d47267e7c5df283b25e085e0de6066465dbec

SHA512
1a4a70831e6673dd91e11f2f07f3af6783c2f62ff2df3a405fff13b87645c0432884f6fd360ce90ebe46fa51cb857ea9080892c96b4fad50cc54f00dec54e552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
ac40025338fa9df3206bb555b08fc9e8

SHA1
e55c8654d77870c1ebbd1f599050ee557fc96f2c

SHA256
7fbb2f882b0a28c10fe16dca88e719542bfd2c9f7d36ed843d88273baf2febff

SHA512
8c52a6f0b1917d19ff536d2d6ef153573d396109117f7ea75c5d5fd9ef4d3e3d827a0eeed4e0ad19593f7769b4159ea7754865c7bea3b95d8546dcad494982d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
cbf474d034c9d44c181ca8247990d46d

SHA1
42f9959e8d9ea92edf9ca9b9979cb2eb46068918

SHA256
ed2317157c6cb1ee62c952bf631b2aed5100dea003e55d420028e1b9544d53d3

SHA512
a508ce7b0a195130b0f5b3f7c29b2ca3bcfbab60f295f7dc7874f251f9753d8ee1b23b7a9307cadbc2b5d42e86730fd70b23abe4196ed85c85efe1d7b82f576d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
1a1496c8eef5a6115546d23d4c3690a9

SHA1
f39276d71b311284a59886c1dfc318a5d075ffa9

SHA256
2be7ae797014bffdf19ea3053b6d6373ab5c032efb5cdcb7cc164397490f343b

SHA512
2904a2d8a19c191c5116a399500befc321b15b9a91d17ce461731c59a774bd3ee8350d3cd9ce0507c66389eb1f83bb301a3227f08481d160c9f4fb74e7e10751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
09a80f246070042ab0990d6bae553a39

SHA1
22e3ee02b20e3c033b3ced1714574cbcea18076f

SHA256
09107f391bff3681746622816f3e0fe2a204a53d17f92e21a71a03d41dd2f811

SHA512
fd5bbd355d58e825f40192a1d0020215d0eb6c37a9275701b36465f18255879b6135908f0c2142512a1589d4d62033548b2adb59750eba7bebf34fb1a9bd08e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cd33.TMP
Filesize
1KB

MD5
85cdda741be7a8a89a7c599f24c0f58c

SHA1
8eb4ffa95c40c1fbaf40a177935cc9edd5d4a8e5

SHA256
d724fcd9f3af9b9f907fe51fcf696a5cd37dd37089c8030177f25761b17d0778

SHA512
b06c7a1fa5d7fe314dadac5ebe4ea343332be552b314827630c391aed877398f07df0d956bfc25d20d13b4e99cffd86ced8fbbf05cbd7f4b9f62298edf4792ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
26f3e3e192072e0025d5c4e153c5a1e5

SHA1
383a7a181353d0c8c903e3e0139d3a68dbe30472

SHA256
ef59485b6151f430999359ab94e13a451221ac1c1948c660ac958b80c77e80c6

SHA512
a2bb8447f56bb5335c4683a5bbda5a84436565ed231e177088f3d92392beb9fdeaa798d5f811f6c010e871f0d42318a14baa043b1a3568acae22d1b03268e6f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
7179d101909e6c375fb652eb2dcb021b

SHA1
a934be4755259a2a987270e6fcbeb682df16a65f

SHA256
8ab3f2c51f7a1733f840716ecfa57a810013662f2215938bc5e27b18e8b44656

SHA512
0e730dfc5ddaf158fbcba3a92c7a92f3a9e4ad2f29dd4b1189d4ba304c8523992e171308e1fd859e2bcd7b8eeffcc526ff3d2b6672c943137ea8281db5b19ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a6962546a2af20cb0c98ac8fba202423

SHA1
e783473316cecb311eb3348b83614aa5d7a6100c

SHA256
ad5a80c3590365b8e127225e92d254bf03dbcdf0885855190ec3627c22234b31

SHA512
be172c88e6f0e4d26a09ef9aa1f88318cae3ef89d05feb1dd44b694440e6b3286583c2458791701205a533bd082523d99c0dd5451efe520a810b66dd53deea0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\690A.tmp\690B.tmp\690C.bat
Filesize
568B

MD5
bcbb9cb105a5466367c5f6ceb38e614a

SHA1
be7f3382e1a4a78428c8285e961c65cefb98affb

SHA256
878c05348c1269420ec01dd070212589b5118eba58a4592f89fc36b2a5860d8d

SHA512
efed12dc71ded17bde4a2f7849ef77d80db75d29c52351f6338f4a9ab5d8b42ba7b9fdca7eb472866819749587f79eb3c6b73e0398f4813b51f300d9a65b0fbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7XM4Ys25.exe
Filesize
87KB

MD5
ec083492f9f0b17ce4f7402eeb9e0dd7

SHA1
fa7f2cf93fb07bd003329ead26c63cf1e8ba4299

SHA256
7b1ce8561335c18331ec3e591b13f478896a5dc5c699de8660c105a4a22dcd5e

SHA512
87a8b14fdbed7d0adca32c953c70ddf84afb3fe05a91d3ade7b3e08197061833ebed50f25f2f1c6e214e0fd740cb852543e6fc6ba58d0a0f00f150306f08f545

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jF3dl08.exe
Filesize
1.4MB

MD5
4c53fbf14494b6cd45493944018118f2

SHA1
fda4ae283b70b107ef5f9ceeecc54cdca76bab88

SHA256
d661fa15f79f8248884a2b9e5a229a8017393ddca4791abb4850dc4b178a422a

SHA512
e327d3babc443502fed3f78a3e29dc8cfacdbbff4bd4629ddfe8512dd2ab0e76ff6317e7e610a3898be1c71f5d27b6e8935200146f575ba5bd9624282f8b69b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6bO3qV6.exe
Filesize
180KB

MD5
dcfac39d20d74126a22a10f173d4de4b

SHA1
3c9b1aa139a5b72e103b08f93b0f7cc3c536785e

SHA256
256895e6954ade36dd2e510e96cde8ea732aa36ebab655682ec49531dedbabfb

SHA512
6551cc3a1a7186f7b8dd33df07dd6d39e43b034735b4b7bba0ed92023c9eed08e15507b0368258d6d74c6ca169bed2f7890a6a40a0b054d4507a60b970cb5a93

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GU5lD08.exe
Filesize
1.2MB

MD5
fe181080e72086313526413ff818f5fc

SHA1
1d7a9641824497c0eefd970fb0a54d38108d8ebb

SHA256
54dd36e249cbf6e5f54c3309158b929f864ca2e349e7812c8aa377eb0706e48f

SHA512
1d52513b60f76c331928ddad81f17ca621d03b33503831554afd62e5f7fa1aade3adba14059531d6aba5c9e8f7aa34c99678354c3dada3d3a74dc28ae4916388

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5Qf5VN2.exe
Filesize
219KB

MD5
2adc73cc227264a2b2cb65605e04ddd2

SHA1
d8f25c99f0d39b01e2dbd12ab1a8e559f2701458

SHA256
3855c50036648f2ad569d7dc85ede5bd55e0ed7b8ec45ca108cbc321c4c1272f

SHA512
fe4170c1058396e9a259a95f1c8960abbaa7a6189af60149ec0b467a5038145daae751d9aa44ae07f5566a7de52038c4315f71ffe4340609940ea7bf65ef0f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ff8hQ09.exe
Filesize
1.1MB

MD5
1d9d511a6d2a8743d15242a6a35e71ae

SHA1
3db17ee8cfd1ee01f4d26bd6da4564e6bf19629c

SHA256
302990e72db4d6a9bb10cb67f2c9e29662a04c64a963a44e43e7964b93779ee7

SHA512
91ddac4a483ecb994f05effc5c155cec7f85e50b2f11444fd9807a287e40a5bef700baffa260ff7fb5e946e9a039e38828b8a54338a0e4803a98f48a20f65ad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Kv029eK.exe
Filesize
1.1MB

MD5
95917bceef5fca8716f25b0a44c6a081

SHA1
190afc3788a4d9efdf440a0ffb7c5731ede3a6e6

SHA256
ea54047b72c1fe2e67e639b88bebc27d71aeda525dfb4f5ed8cd1c5d3225a57d

SHA512
0e17f462126c7db9e589e260ceeaf94848856c82a8404806725b504bb2ab6214df957cdbef10902439df61daeb8585596404d5a61a76d92d0e0343456b0ff070

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tQ4Ct24.exe
Filesize
660KB

MD5
b2d5c98a2cd42f96a2aea6356ca89e08

SHA1
27b13c0e76240dc50068094d19fedc1c404665e1

SHA256
e9e2131227858b984af0d80c5d7899c0776c0ede43ced95ad546fa4bae1598fa

SHA512
77090b0efce8ab0cee36d4e6b7390301fbad2d9779142f4e56f26a554aca92b7fd5f20afa74b2ba25b8eadefb02aa48e9065f7524d4e3c5d82e382ee5cbfa231

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3nd59wD.exe
Filesize
30KB

MD5
0088d891f0ccafad63181e8dff1e9575

SHA1
b5c09cef3d91a010ceb2da45edef303e0d7e5361

SHA256
e8ef41e2a49a71b66681d19dac104d5f45bcd980d3bb741c929abd3d6bebba4b

SHA512
658239997d0eac78ba03bb6b57e3982559ae98b7b9877d904fc84e9bf72898ca9d5f4e70e9ea7361078e3e764d6a1b231582a92b7b862b63a1fc117cd7b4e51c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Dx2cC84.exe
Filesize
536KB

MD5
9ef8691532e800852481defe770c3f06

SHA1
81c0ba8094a9be3b706acc0d9d381d159c1fd4fd

SHA256
7707ca8b641aa543df0696c298916e6b0105484f66e8485f922a2f962ca04075

SHA512
7c0d4cc9100d0c3aa8d5b90fb9347e184698c56aed89123a073bf1e20a1657a2e79db7453c6eab40624afe44a2ad07b70134082f85086b0b8872b0b3d2d6c457

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EV04Vx4.exe
Filesize
896KB

MD5
31dc50bb7773755a0b527415d04064f2

SHA1
ec2d24de207ce4f31bac02db633e1fa308173c58

SHA256
b59deefdc1962e108c7c124acab2bd04c57436e09ddeaa67d521a5403c10d2c3

SHA512
333d6e21de76a52b0e7a8e8609bc444ef02b714ba4bf66786485796a24b4fefbd9ce4251d4c5417a2df4f7fc8b46b2333536142d305c4d3a63bbdeb6c25695e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Qd9357.exe
Filesize
1.1MB

MD5
3fcddf95e9b7166866a8462b7ab3e502

SHA1
3fb56bd3a7bd3a546be7e72d1cb31c7923817cbf

SHA256
a564ebbcfc4b309723e77e39ce633a68efec5ffbd883d9c7a2f1fe58f54f5fdc

SHA512
d6f961937a72420d60563f455fcf0d3a60922a3252bc5fa5f599094c5f99aaaec3e9549ae86029d964deddf23c860fdd202079387f1ea8ae013532b4d9b1e7ac

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
\??\pipe\LOCAL\crashpad_4388_ZREDAGWLSURXOLNL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1232-42-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1232-46-0x0000000074790000-0x0000000074F40000-memory.dmp

Filesize
7.7MB

Download
memory/1232-181-0x0000000074790000-0x0000000074F40000-memory.dmp

Filesize
7.7MB

Download
memory/2440-47-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2440-51-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2440-49-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2440-48-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3500-56-0x00000000024F0000-0x0000000002506000-memory.dmp

Filesize
88KB

Download
memory/4248-76-0x0000000007CD0000-0x0000000007CE0000-memory.dmp

Filesize
64KB

Download
memory/4248-69-0x0000000074790000-0x0000000074F40000-memory.dmp

Filesize
7.7MB

Download
memory/4248-369-0x0000000074790000-0x0000000074F40000-memory.dmp

Filesize
7.7MB

Download
memory/4248-370-0x0000000007CD0000-0x0000000007CE0000-memory.dmp

Filesize
64KB

Download
memory/4248-88-0x0000000008B20000-0x0000000009138000-memory.dmp

Filesize
6.1MB

Download
memory/4248-70-0x0000000007F50000-0x00000000084F4000-memory.dmp

Filesize
5.6MB

Download
memory/4248-71-0x0000000007A50000-0x0000000007AE2000-memory.dmp

Filesize
584KB

Download
memory/4248-80-0x0000000005000000-0x000000000500A000-memory.dmp

Filesize
40KB

Download
memory/4248-63-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4248-90-0x0000000007C70000-0x0000000007C82000-memory.dmp

Filesize
72KB

Download
memory/4248-89-0x0000000007DF0000-0x0000000007EFA000-memory.dmp

Filesize
1.0MB

Download
memory/4248-91-0x0000000007D20000-0x0000000007D5C000-memory.dmp

Filesize
240KB

Download
memory/4248-93-0x0000000007D60000-0x0000000007DAC000-memory.dmp

Filesize
304KB

Download
memory/4576-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4576-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download