Resubmissions

16-04-2024 19:30

240416-x7s5zsae68 10

16-04-2024 19:21

240416-x21ymsbh9v 10

Analysis

  • max time kernel
    336s
  • max time network
    349s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16-04-2024 19:21

Errors

Reason
Machine shutdown

General

  • Target

    Tic Toe/TTT.exe

  • Size

    78KB

  • MD5

    bea6449a9c00cf3667941b6d9de42610

  • SHA1

    dd771bee34b16935ff90b3baea5f854e8371b3dd

  • SHA256

    161b52b3f8b209d6ef096dd464d9ab5a749846f5593ed4b9e3d03aeb3a7a9861

  • SHA512

    8913be46ebcba2a7ce997a8b93caf80e5aa1878afd18c12191c6af6f388969970e625f8299dec08f2261bed5f00fd7408c542128d33d9139a72a0adcfbbd356e

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIC:5Zv5PDwbjNrmAE+6IC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIyNjYzNzczNjgyODYwMDMzMA.G6KXZO.KhvjpXnxesj0UFK2f4VA8aIK-hpf6VfhFGsAVo

  • server_id

    1224114376949235764

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Tic Toe\TTT.exe
    "C:\Users\Admin\AppData\Local\Temp\Tic Toe\TTT.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:964
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffad7d3ab58,0x7ffad7d3ab68,0x7ffad7d3ab78
      2⤵
        PID:840
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:2
        2⤵
          PID:3920
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:8
          2⤵
            PID:4848
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:8
            2⤵
              PID:2056
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:1
              2⤵
                PID:1452
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:1
                2⤵
                  PID:3524
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4240 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:1
                  2⤵
                    PID:1488
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4412 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:8
                    2⤵
                      PID:1712
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4512 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:8
                      2⤵
                        PID:2224
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:8
                        2⤵
                          PID:2768
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:8
                          2⤵
                            PID:2748
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4884 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:8
                            2⤵
                              PID:2744
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4168 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:1
                              2⤵
                                PID:3380
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4372 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:1
                                2⤵
                                  PID:3432
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2836 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:1
                                  2⤵
                                    PID:3280
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5072 --field-trial-handle=1808,i,15075862633796442512,11377966599718296172,131072 /prefetch:1
                                    2⤵
                                      PID:1764
                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                    1⤵
                                      PID:1032
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                      1⤵
                                      • Enumerates system info in registry
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:1388
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffae8633cb8,0x7ffae8633cc8,0x7ffae8633cd8
                                        2⤵
                                          PID:3096
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
                                          2⤵
                                            PID:1580
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1528
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
                                            2⤵
                                              PID:2764
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
                                              2⤵
                                                PID:2720
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                                                2⤵
                                                  PID:1500
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
                                                  2⤵
                                                    PID:2880
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
                                                    2⤵
                                                      PID:2928
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:8
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5020
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 /prefetch:8
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4956
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
                                                      2⤵
                                                        PID:2332
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
                                                        2⤵
                                                          PID:4600
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
                                                          2⤵
                                                            PID:3056
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
                                                            2⤵
                                                              PID:2256
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
                                                              2⤵
                                                                PID:4820
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4972 /prefetch:8
                                                                2⤵
                                                                  PID:4244
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5700 /prefetch:8
                                                                  2⤵
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3660
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
                                                                  2⤵
                                                                    PID:4160
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
                                                                    2⤵
                                                                      PID:1292
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
                                                                      2⤵
                                                                        PID:3716
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
                                                                        2⤵
                                                                          PID:1812
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
                                                                          2⤵
                                                                            PID:2224
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7048 /prefetch:2
                                                                            2⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:3860
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,16284721167014727008,7319131594470664289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3092 /prefetch:8
                                                                            2⤵
                                                                            • NTFS ADS
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:860
                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                          1⤵
                                                                            PID:1196
                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                            1⤵
                                                                              PID:4372
                                                                            • C:\Windows\System32\rundll32.exe
                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                              1⤵
                                                                                PID:2468
                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2428
                                                                              • C:\Windows\System32\DataExchangeHost.exe
                                                                                C:\Windows\System32\DataExchangeHost.exe -Embedding
                                                                                1⤵
                                                                                  PID:3672
                                                                                • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Spark\Spark.exe
                                                                                  "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Spark\Spark.exe"
                                                                                  1⤵
                                                                                  • Loads dropped DLL
                                                                                  • Drops file in Windows directory
                                                                                  • NTFS ADS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:2136
                                                                                  • C:\Windows\System32\bcdedit.exe
                                                                                    "C:\Windows\System32\bcdedit.exe" -set nointegritychecks on
                                                                                    2⤵
                                                                                    • Modifies boot configuration data using bcdedit
                                                                                    PID:1136
                                                                                  • C:\Windows\System32\bcdedit.exe
                                                                                    "C:\Windows\System32\bcdedit.exe" -set testsigning on
                                                                                    2⤵
                                                                                    • Modifies boot configuration data using bcdedit
                                                                                    PID:2728

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

                                                                                  Filesize

                                                                                  49KB

                                                                                  MD5

                                                                                  d6fc110a07a2734773e1890681a1d94c

                                                                                  SHA1

                                                                                  7951130dabb8c0cf3a302f60ae5e248646e01362

                                                                                  SHA256

                                                                                  e7a505cce74a2b221fb9df953da3c3089bc21ebd61b6a177b05a916e26f593d8

                                                                                  SHA512

                                                                                  ebc452933d7f95de0f4115d4e73144aff48bd9f7ce176207964e659e6dbadb913408c79ba115a60274fd0fe952f3332203aa8f33fe7847b2b973e76d6b2865ea

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                  Filesize

                                                                                  432B

                                                                                  MD5

                                                                                  647d4bd01721645f374c407e4c01fc51

                                                                                  SHA1

                                                                                  18aac653fdafeecd970d14a860d7c7208704ed39

                                                                                  SHA256

                                                                                  5617cdf932772cc4c69015ab8e7ad54491a65d860e25d052c779a26a2aaea929

                                                                                  SHA512

                                                                                  043423bcc8f2e2f288c4ee29fd4ba3329fc5092c824acc1785f87de85e231558cc96f9403fcd334f94488031764a5e9010f00cb90cf23ca6becb49dd8bba9d1a

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                                                                  Filesize

                                                                                  264KB

                                                                                  MD5

                                                                                  2bc3da141a2ad3c5565ac1b902935542

                                                                                  SHA1

                                                                                  be12700a2d03ac4abaebd8c16ef250fbee16982a

                                                                                  SHA256

                                                                                  b1c2c76fd5e865eadc51f4f05a88f32c4a13a3ac198e02fbeadb47fee7edbf50

                                                                                  SHA512

                                                                                  e4e45fc7302e0e682fc22702e0bcdb8f0f5008e366b4c62ee59b256745284436eb484ef717c9b2478cba09cb49c21962ad2af64bfad6028080d2c46b9e490c01

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  2f3f104b5a42e42f23c42a80239c0d36

                                                                                  SHA1

                                                                                  e095041d0152e8561df5ea1a4854d16d4e7e0388

                                                                                  SHA256

                                                                                  ea34f745f32c2d10cf11e96d953fac0de0c08bb47ae726080f6fcb1c22865e84

                                                                                  SHA512

                                                                                  8b6195259b0077fcabc8e8b9075963ee1a2701dcac443a76fad6809858068a387dfdac569af3f3755ded4eae89e84914085248e3f36e7d8721c64952a72b37fe

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  9e799e478a00d407abec13ec9b08b948

                                                                                  SHA1

                                                                                  d59b8d51cdc922f480c89b58e9c17cd4f42e82c2

                                                                                  SHA256

                                                                                  ec96efb28263293af1f0b28da629fc68ce1bd0c9f6278ae5f47dabc70f20ee10

                                                                                  SHA512

                                                                                  78a0c889fc40882a6b679f3157c57a7ef957185d9f8c985b5e5693b7d9b703165e7e41d5a8dca86044fa9843a3eccdea9b3b9f01fb80c301a6f8dce4ff0e1f41

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                  Filesize

                                                                                  2B

                                                                                  MD5

                                                                                  d751713988987e9331980363e24189ce

                                                                                  SHA1

                                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                                  SHA256

                                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                  SHA512

                                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                  Filesize

                                                                                  521B

                                                                                  MD5

                                                                                  d5920314e6521c0bb4fa598af2dd6f89

                                                                                  SHA1

                                                                                  bf70612b5a0f1f23718f078abdfa8b3ae4ca70ea

                                                                                  SHA256

                                                                                  c387fef0cdf8dd37f9f4a78d69ea883b2a507a23ec994abd1290b34b4adda56a

                                                                                  SHA512

                                                                                  58f8cc93e40589063eb22006f5a0e3145fe362f2d2c3f864241f34588f06087a49837534d5e2815c82d6ba097d80801d9dca30c7dc8a244ebe108fb838a8ccf1

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                  Filesize

                                                                                  521B

                                                                                  MD5

                                                                                  2d62381e9281a171887676188f65bdd3

                                                                                  SHA1

                                                                                  e3bba667388a41f36866e8114c580abdf9ff7df9

                                                                                  SHA256

                                                                                  333148922726b27ed0ed6dde54cf603e1c2a11961740c83bb4f7eeabc6e080be

                                                                                  SHA512

                                                                                  1c06912ea8edbea90b99e2a248c4ef3a2d69996c9064df9d4467f51c9ab224012568904213c0c568e4bc860864bafa97ece27c239b790f4c79cf2e7cbc3af684

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                  Filesize

                                                                                  354B

                                                                                  MD5

                                                                                  47f79cc775502e41e68cb490f897d476

                                                                                  SHA1

                                                                                  990f8990ebfdd716502e568e2faeb6d09f1814ab

                                                                                  SHA256

                                                                                  fc33be61e2bb03a63e10e8e81616d6387ccdae29d9d1d44f79803c130c60c4be

                                                                                  SHA512

                                                                                  ff84bcd65c68175aaa10562201d5ebdebe76735a8dfa73b7e7a80c624cc0ab66546ce8113db47da20d2678238b85f0e54a535c075f7707d603de7d3938a30509

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  7KB

                                                                                  MD5

                                                                                  7830cf59b90dacbbf3ac0b259284ffec

                                                                                  SHA1

                                                                                  f0bad4a86c74c797bc409581f65e470583f8ae84

                                                                                  SHA256

                                                                                  2435ffc79c542078328ea17a66db1cd05b9a1794732d249f74a8fb072d154bb8

                                                                                  SHA512

                                                                                  d3ab4614a52636d4b89ccba3a3527847e73715582b8af06c4173f77fb36b77f51ea8076d9eadb79fcf5643f3354072c86a2b95cac8cded6c1f8f1f188e068c1b

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  6KB

                                                                                  MD5

                                                                                  bd12f1503a67c7e2615099fd4f6aff57

                                                                                  SHA1

                                                                                  e3a87e2e9e98034c32b37356246358c6bedae7e5

                                                                                  SHA256

                                                                                  cebdc6a3fc7d0e6d389e818865e5ae7f3d36c53c574860c9f94b2e706105fb27

                                                                                  SHA512

                                                                                  0e0ec817ceda80c4d4876ad064731941d19f65bc61793bbdc0f65f1f7fc45fccffa8ce429e1652472b8b37f8cb7d2ebb7959359520ebb766ff5a68825eeb20bd

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  7KB

                                                                                  MD5

                                                                                  62709e087e92c57450f61e91997149d3

                                                                                  SHA1

                                                                                  013575a87869046e8c3e87c77976d3393fa55472

                                                                                  SHA256

                                                                                  a12e49f0710de11f372566cd0bf3d27e2ff1c03284366e64d0b8f1600421305a

                                                                                  SHA512

                                                                                  23cdb9be7e55dbc2edf74db0f55011160bd3245348cce616ecc8a9697029088d46f07ac1f87c8bf12086e14c3f092cd984c690c56ff3a423b28aed911308b9eb

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  7KB

                                                                                  MD5

                                                                                  920fe87cd7591ad6a6a101e2c50f3ff6

                                                                                  SHA1

                                                                                  03937dd3af63018d403a2e5c480adb0db7895da9

                                                                                  SHA256

                                                                                  7639067ccec2b4e2c4c6fe4ca175de7e60fcac0546e357adfa3a1b2683314216

                                                                                  SHA512

                                                                                  d27b37c62d2d6aaf397fb83f5f11e8a358746adf6321c89ad47098ae4369ab068daa3b4f56f16b56c71a1b82cb225097a1b42241671794034c3a60e30e0f8275

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                  Filesize

                                                                                  251KB

                                                                                  MD5

                                                                                  215b909338c1d814e6b2caba9ed70e49

                                                                                  SHA1

                                                                                  b3e6b7ce8910c1d45d33b6d68705907374f24bf4

                                                                                  SHA256

                                                                                  5d001c3571121097fa65a54a8698e05388ce24040d7ebefc9ca7f9c6fae3a732

                                                                                  SHA512

                                                                                  c82878544e8eafaf31bc7ca553bf074e71732d3f5736911529ec97c7b4c6f905a5996554d89405a13ea691adfa6c999f9e4421e62dc5f9e469c184857493d194

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                  Filesize

                                                                                  251KB

                                                                                  MD5

                                                                                  b90ef8ed63ce07ab2691ff7a5fbd8f1b

                                                                                  SHA1

                                                                                  5098fe72ab4d18430108139afdd792bf7c0c85bd

                                                                                  SHA256

                                                                                  67b071a09be844da5ead8ba6500552011d8bda7ea03c2e91b42d36f8a724ce37

                                                                                  SHA512

                                                                                  ccf9b31596486cfe87b81813e6897031fddc4fa624cdadecbf807853f36255a44e907ca58fd2c4d8e425f5cb3346ff561435c5adc1f8e6988980e231c7517c54

                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                  Filesize

                                                                                  251KB

                                                                                  MD5

                                                                                  4d27fbdd6ca085fc2f227acf7dcb8fe9

                                                                                  SHA1

                                                                                  e954087cb38144d02423a779155c07fb6a000f4a

                                                                                  SHA256

                                                                                  6a2e17972edc5b655a60619f30875919a4a00a2870f00f820f8e9a798b116693

                                                                                  SHA512

                                                                                  f36a477b2cd0d69ddb8358c2c7a57187c7448db19e0145db0f392cd41e1e6d536ac0355dc2d5744839985357b25316200d57242402f1bb67dcd65b9493db73b0

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  493e7e14aceba0ff1c0720920cccc4a2

                                                                                  SHA1

                                                                                  468f39cefbcf14a04388b72d4f02552649bf3101

                                                                                  SHA256

                                                                                  a0dd32ed60115f661a4ca537472e0d4e230ff844d56a3db766299cf4cd817842

                                                                                  SHA512

                                                                                  e16c748e4513ea10bf7124cef7b50dc5f3a1802205af9228e0c33fdbf3c24286739db08db4b813079ed7cc36be43d7457f4c26f00ae3126a2fafd77d2696107a

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  57e5c5a9236321d336e2c8ce1eeff844

                                                                                  SHA1

                                                                                  8fd4288af72ba3f7a0ecc5583a9265723fefc096

                                                                                  SHA256

                                                                                  ae6496cf397848bf3139858deaf567e3df991bab5a7704a0fa7aae95474872d7

                                                                                  SHA512

                                                                                  bc3f24afe6ce0494022d8201a01a60239ac5cfee54e0650a337036817056424b418cb636d58d07e5034dffe2226906202b56509e4cc07562c0b60f618c420080

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                  Filesize

                                                                                  3KB

                                                                                  MD5

                                                                                  82e4d9357e5288a3a59a6c1c0aa097c9

                                                                                  SHA1

                                                                                  1f7670f4e867d4f15c5208b4a8e913acd9457a7a

                                                                                  SHA256

                                                                                  d9b3d5f7dc0a780f0c6b4a8fa49a1b64bd648540f11e3c73f1f79a4c0703a4ba

                                                                                  SHA512

                                                                                  988db2a016e0092a50c1faf870f90aefae074893c100faad098ce7afe858e2bfcbdfcea4131096be97f0903df20e40261822dbfa4d98a64a1f292dd5405d3421

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  3d8f9b1b1758e3ba474a2f8574179c67

                                                                                  SHA1

                                                                                  8ccfb0294b9d5436333315b9eec0cfe1acfe453c

                                                                                  SHA256

                                                                                  f21bc106c6ac9599abca9dc2cfa09f1203fc6253c8cfe076b02328875c604e53

                                                                                  SHA512

                                                                                  26915c4c7dbbe203d6446fbb282022a648ecd384393e36909dcae1f0c0a23083c3f06337647304f437d3dc0a89449e338a98072ae45e83985475d9105e5ad39a

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  5KB

                                                                                  MD5

                                                                                  c65b7d1184c6d806136bdb225e0b863b

                                                                                  SHA1

                                                                                  287d660b478ef88bb99f7b6bee82e5d29723449c

                                                                                  SHA256

                                                                                  093dedef596be9a7d8fd07234f32919a6fd784b4c7cb8f163b3d508465d5a776

                                                                                  SHA512

                                                                                  6ba254987702d3a86aff542ca38567e365f8bde43fb2b1be628f93b3d3e5c386657183c76e68753b266ed8dc024d10ffb2bbd636d67210b89ef4da437621cc76

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  6KB

                                                                                  MD5

                                                                                  61b50c628ed44054158c1c64f9de4311

                                                                                  SHA1

                                                                                  afcebb644bc2c1f5f74cdb630e088c9154b24531

                                                                                  SHA256

                                                                                  e710aee21e1c56774614f37e21bc40dad618b6361443aa29bcd54bed88689748

                                                                                  SHA512

                                                                                  58cd6e647196dbb23d9cbc85de13db8f9268714389e2480e75e88cdb65c3c61c88cd6f2639afdc92d2bb0b536be400c751bfc9d5877a15204a8875a356028fa1

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  5KB

                                                                                  MD5

                                                                                  a35c9d609c6e046d253492aaa3315849

                                                                                  SHA1

                                                                                  dc7556a54dc70cf95c9f67caec5da252ed6c4bf4

                                                                                  SHA256

                                                                                  a344afa668289f7ab446f2e53ac39a18d7b173317ed9d24b915e45da3adaafae

                                                                                  SHA512

                                                                                  0bae19e8769ee753ce2f183243e923e7bc4f3fb15fe84b9d4eaf5f62eac864f4de6a3d4dd88db6e92930523be17a039afe0d1e75af3543e352950aaee7389e8b

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                  Filesize

                                                                                  16B

                                                                                  MD5

                                                                                  46295cac801e5d4857d09837238a6394

                                                                                  SHA1

                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                  SHA256

                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                  SHA512

                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                  Filesize

                                                                                  16B

                                                                                  MD5

                                                                                  206702161f94c5cd39fadd03f4014d98

                                                                                  SHA1

                                                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                  SHA256

                                                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                  SHA512

                                                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  0aa2650e70491bcde328deeb88a5792b

                                                                                  SHA1

                                                                                  9943107c13f52639f823410d0c294b26c2d2d3fa

                                                                                  SHA256

                                                                                  bb63f6126456291bd2a904a92425baf7ed9a2bd427e08df503dc767b9356352c

                                                                                  SHA512

                                                                                  7792036b12a74b0b3458f4bc7177656f91f8c8c2b587dc73e59e37771f9e520579cd66e12e8fc8321f6966a10cc5d5724ce676dc1b7d474d884258d5dfd3d16c

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  50ce5a33a88518a78a3513496456884b

                                                                                  SHA1

                                                                                  ae1bb694bf1eaefd3f21e57d0905702d515bb303

                                                                                  SHA256

                                                                                  4f4150b9e94d4fe57889740d53ae37133f80d553dee215c18c11a502a2614e76

                                                                                  SHA512

                                                                                  c1c08d49bb62a4c44801b8d8a005e7e8f699d908a66b0dcaf7beaff3bababc35b5391f821de3ddaf63821334c9c0ec2270a888234dbf277e4c8c2b410d9562b3

                                                                                • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  e3e15a868a60c5bc28058860580772ff

                                                                                  SHA1

                                                                                  31e64db52bcf6826fb18556214cc11cfca9ef116

                                                                                  SHA256

                                                                                  4dfd6f56923734f981111a3fc4cf3e11b420522506dac49441312b2fe80c4db9

                                                                                  SHA512

                                                                                  2b0db39c132bf6df3945c6acf0bc656650051c9483f0f454afd4640dc252c964049f4338889ed1289334fb536ad27997ff19746af420d11eaabf95db0e89f11c

                                                                                • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  c0030affddfc4db4d0a06599ddadda16

                                                                                  SHA1

                                                                                  2e7a60a302ab2ba17317fdcead42cf4d3759eb08

                                                                                  SHA256

                                                                                  e8479f26639eefedde0ef3fe76b3eb20d077d9d0394c026a8c6d6841c9dead09

                                                                                  SHA512

                                                                                  018f14e2481294cefc16aac1693526c0aafc8469dffacad96ddf4bc93a965dceb11b2e4c3eed258938e9a7b5e646d455e499377a3334154a8cf749648b9f4fa2

                                                                                • C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

                                                                                  Filesize

                                                                                  26B

                                                                                  MD5

                                                                                  fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                  SHA1

                                                                                  d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                  SHA256

                                                                                  eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                  SHA512

                                                                                  aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                • C:\Windows\File Cache\DLL.dll

                                                                                  Filesize

                                                                                  116KB

                                                                                  MD5

                                                                                  a61c26b360471c8258c7571037c4bca0

                                                                                  SHA1

                                                                                  5db105e0384f25b1ab165c10a9445e6b943cd0ff

                                                                                  SHA256

                                                                                  e77316a1fd682e1af8af3ccd03c170f886b9ec8edf7013e1be6a6207cb5a6f16

                                                                                  SHA512

                                                                                  3ef680d50ccfa4311d3d1bec1648c48cf8e8633353dea5e06f52339047ede36fd1655ce728541e769d9fcaa6ab8c2a66981aef708a9f4d05ae46ad26f9d6aef4

                                                                                • memory/964-114-0x0000015952740000-0x0000015952750000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/964-4-0x0000015953BF0000-0x0000015954118000-memory.dmp

                                                                                  Filesize

                                                                                  5.2MB

                                                                                • memory/964-3-0x0000015952740000-0x0000015952750000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/964-2-0x00007FFADB4D0000-0x00007FFADBF92000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                • memory/964-104-0x00007FFADB4D0000-0x00007FFADBF92000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                • memory/964-1-0x0000015952820000-0x00000159529E2000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/964-0-0x00000159381A0000-0x00000159381B8000-memory.dmp

                                                                                  Filesize

                                                                                  96KB

                                                                                • memory/2136-747-0x0000000074D70000-0x0000000075521000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/2136-746-0x0000000000F80000-0x0000000001000000-memory.dmp

                                                                                  Filesize

                                                                                  512KB

                                                                                • memory/2136-748-0x0000000006090000-0x0000000006636000-memory.dmp

                                                                                  Filesize

                                                                                  5.6MB

                                                                                • memory/2136-749-0x0000000005BE0000-0x0000000005C72000-memory.dmp

                                                                                  Filesize

                                                                                  584KB

                                                                                • memory/2136-755-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/2136-756-0x0000000009790000-0x00000000097E4000-memory.dmp

                                                                                  Filesize

                                                                                  336KB