amadey | 47889c48da4c5e390f10c04d8390b2c5d9f68bec127bf0e18bbe686b9079b922

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d.exe
Size

1.7MB
MD5

7e7472d47e817c368c8e777c7ecace66
SHA1

947587e37ef199886f32686e111606142c56b50b
SHA256

a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d
SHA512

6bf1b6153397906a2ee3db5ba204775da984d83beb053002340db52e504fe3f9eebae9e5ace9ef9fbaaa09396b9352fd8c3ff1b7f7d06f9edfef242d7adbfbb7
SSDEEP

49152:8zby7WTAMA70B6AXkm6Hz5V6Bm5R1LIJY:cy87A70w26TH91Lh

Score

10^/10

amadey mystic redline 04d170 daf753 frant evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

frant

77.91.124.55:19071

Extracted

Family

amadey

Version

3.89

Botnet

04d170

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Extracted

Family

amadey

Version

3.89

Botnet

daf753

http://77.91.68.78

Attributes

install_dir
cb378487cf
install_file
legota.exe
strings_key
f3785cbeef2013b6724eed349fd316ba
url_paths
/help/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral15/memory/1744-70-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral15/memory/1744-73-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral15/memory/1744-71-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

1KZ31Ur9.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1KZ31Ur9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1KZ31Ur9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1KZ31Ur9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1KZ31Ur9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1KZ31Ur9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1KZ31Ur9.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral15/memory/3840-77-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4FW049ez.exeexplothe.exe5pU6Ut6.exelegota.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	4FW049ez.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	5pU6Ut6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 16 IoCs

Processes:

Rr8qm41.exebQ1zc18.exeQl8rz35.exebg9FO11.exe1KZ31Ur9.exe2Wv77ma.exe3Uh0431.exe4FW049ez.exeexplothe.exe5pU6Ut6.exelegota.exe6SK3wk36.exeexplothe.exelegota.exeexplothe.exelegota.exe

pid	process
1280	Rr8qm41.exe
5012	bQ1zc18.exe
2464	Ql8rz35.exe
3276	bg9FO11.exe
1916	1KZ31Ur9.exe
4916	2Wv77ma.exe
392	3Uh0431.exe
3744	4FW049ez.exe
3456	explothe.exe
3528	5pU6Ut6.exe
2036	legota.exe
4876	6SK3wk36.exe
5316	explothe.exe
5332	legota.exe
5284	explothe.exe
5300	legota.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

1KZ31Ur9.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1KZ31Ur9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1KZ31Ur9.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d.exeRr8qm41.exebQ1zc18.exeQl8rz35.exebg9FO11.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Rr8qm41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	bQ1zc18.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Ql8rz35.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	bg9FO11.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2Wv77ma.exe3Uh0431.exe

description	pid	process	target process
PID 4916 set thread context of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 392 set thread context of 3840	392	3Uh0431.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2888 4916 WerFault.exe 2Wv77ma.exe
1632 392 WerFault.exe 3Uh0431.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3800 schtasks.exe
5096 schtasks.exe

pid	pid_target	process	target process
2888	4916	WerFault.exe	2Wv77ma.exe
1632	392	WerFault.exe	3Uh0431.exe

pid	process
3800	schtasks.exe
5096	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

1KZ31Ur9.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1916	1KZ31Ur9.exe
1916	1KZ31Ur9.exe
4516	msedge.exe
4516	msedge.exe
3188	msedge.exe
3148	msedge.exe
3148	msedge.exe
3188	msedge.exe
2596	identity_helper.exe
2596	identity_helper.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3148 msedge.exe
3148 msedge.exe
3148 msedge.exe
3148 msedge.exe
3148 msedge.exe
3148 msedge.exe
3148 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1KZ31Ur9.exe

description pid process

Token: SeDebugPrivilege 1916 1KZ31Ur9.exe

description	pid	process
Token: SeDebugPrivilege	1916	1KZ31Ur9.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d.exeRr8qm41.exebQ1zc18.exeQl8rz35.exebg9FO11.exe2Wv77ma.exe3Uh0431.exe4FW049ez.exeexplothe.exe5pU6Ut6.execmd.exe

description	pid	process	target process
PID 4088 wrote to memory of 1280	4088	a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d.exe	Rr8qm41.exe
PID 4088 wrote to memory of 1280	4088	a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d.exe	Rr8qm41.exe
PID 4088 wrote to memory of 1280	4088	a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d.exe	Rr8qm41.exe
PID 1280 wrote to memory of 5012	1280	Rr8qm41.exe	bQ1zc18.exe
PID 1280 wrote to memory of 5012	1280	Rr8qm41.exe	bQ1zc18.exe
PID 1280 wrote to memory of 5012	1280	Rr8qm41.exe	bQ1zc18.exe
PID 5012 wrote to memory of 2464	5012	bQ1zc18.exe	Ql8rz35.exe
PID 5012 wrote to memory of 2464	5012	bQ1zc18.exe	Ql8rz35.exe
PID 5012 wrote to memory of 2464	5012	bQ1zc18.exe	Ql8rz35.exe
PID 2464 wrote to memory of 3276	2464	Ql8rz35.exe	bg9FO11.exe
PID 2464 wrote to memory of 3276	2464	Ql8rz35.exe	bg9FO11.exe
PID 2464 wrote to memory of 3276	2464	Ql8rz35.exe	bg9FO11.exe
PID 3276 wrote to memory of 1916	3276	bg9FO11.exe	1KZ31Ur9.exe
PID 3276 wrote to memory of 1916	3276	bg9FO11.exe	1KZ31Ur9.exe
PID 3276 wrote to memory of 1916	3276	bg9FO11.exe	1KZ31Ur9.exe
PID 3276 wrote to memory of 4916	3276	bg9FO11.exe	2Wv77ma.exe
PID 3276 wrote to memory of 4916	3276	bg9FO11.exe	2Wv77ma.exe
PID 3276 wrote to memory of 4916	3276	bg9FO11.exe	2Wv77ma.exe
PID 4916 wrote to memory of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 4916 wrote to memory of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 4916 wrote to memory of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 4916 wrote to memory of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 4916 wrote to memory of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 4916 wrote to memory of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 4916 wrote to memory of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 4916 wrote to memory of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 4916 wrote to memory of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 4916 wrote to memory of 1744	4916	2Wv77ma.exe	AppLaunch.exe
PID 2464 wrote to memory of 392	2464	Ql8rz35.exe	3Uh0431.exe
PID 2464 wrote to memory of 392	2464	Ql8rz35.exe	3Uh0431.exe
PID 2464 wrote to memory of 392	2464	Ql8rz35.exe	3Uh0431.exe
PID 392 wrote to memory of 3840	392	3Uh0431.exe	AppLaunch.exe
PID 392 wrote to memory of 3840	392	3Uh0431.exe	AppLaunch.exe
PID 392 wrote to memory of 3840	392	3Uh0431.exe	AppLaunch.exe
PID 392 wrote to memory of 3840	392	3Uh0431.exe	AppLaunch.exe
PID 392 wrote to memory of 3840	392	3Uh0431.exe	AppLaunch.exe
PID 392 wrote to memory of 3840	392	3Uh0431.exe	AppLaunch.exe
PID 392 wrote to memory of 3840	392	3Uh0431.exe	AppLaunch.exe
PID 392 wrote to memory of 3840	392	3Uh0431.exe	AppLaunch.exe
PID 5012 wrote to memory of 3744	5012	bQ1zc18.exe	4FW049ez.exe
PID 5012 wrote to memory of 3744	5012	bQ1zc18.exe	4FW049ez.exe
PID 5012 wrote to memory of 3744	5012	bQ1zc18.exe	4FW049ez.exe
PID 3744 wrote to memory of 3456	3744	4FW049ez.exe	explothe.exe
PID 3744 wrote to memory of 3456	3744	4FW049ez.exe	explothe.exe
PID 3744 wrote to memory of 3456	3744	4FW049ez.exe	explothe.exe
PID 1280 wrote to memory of 3528	1280	Rr8qm41.exe	5pU6Ut6.exe
PID 1280 wrote to memory of 3528	1280	Rr8qm41.exe	5pU6Ut6.exe
PID 1280 wrote to memory of 3528	1280	Rr8qm41.exe	5pU6Ut6.exe
PID 3456 wrote to memory of 3800	3456	explothe.exe	schtasks.exe
PID 3456 wrote to memory of 3800	3456	explothe.exe	schtasks.exe
PID 3456 wrote to memory of 3800	3456	explothe.exe	schtasks.exe
PID 3456 wrote to memory of 4340	3456	explothe.exe	cmd.exe
PID 3456 wrote to memory of 4340	3456	explothe.exe	cmd.exe
PID 3456 wrote to memory of 4340	3456	explothe.exe	cmd.exe
PID 3528 wrote to memory of 2036	3528	5pU6Ut6.exe	legota.exe
PID 3528 wrote to memory of 2036	3528	5pU6Ut6.exe	legota.exe
PID 3528 wrote to memory of 2036	3528	5pU6Ut6.exe	legota.exe
PID 4340 wrote to memory of 1324	4340	cmd.exe	cmd.exe
PID 4340 wrote to memory of 1324	4340	cmd.exe	cmd.exe
PID 4340 wrote to memory of 1324	4340	cmd.exe	cmd.exe
PID 4340 wrote to memory of 2856	4340	cmd.exe	cacls.exe
PID 4340 wrote to memory of 2856	4340	cmd.exe	cacls.exe
PID 4340 wrote to memory of 2856	4340	cmd.exe	cacls.exe
PID 4088 wrote to memory of 4876	4088	a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d.exe	6SK3wk36.exe

C:\Users\Admin\AppData\Local\Temp\a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d.exe
"C:\Users\Admin\AppData\Local\Temp\a69474bf18a7cca7eda490dd3a0e3f56de60989fbd935adbc91521cc640dd35d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4088

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rr8qm41.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rr8qm41.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bQ1zc18.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bQ1zc18.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5012

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ql8rz35.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ql8rz35.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2464

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bg9FO11.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bg9FO11.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3276

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1KZ31Ur9.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1KZ31Ur9.exe
6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Wv77ma.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Wv77ma.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4916

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 580
7⤵
- Program crash
PID:2888

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3Uh0431.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3Uh0431.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 572
6⤵
- Program crash
PID:1632

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4FW049ez.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4FW049ez.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
6⤵
- Creates scheduled task(s)
PID:3800

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:1324

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
7⤵
PID:2856

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
7⤵
PID:2504

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:4164

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
7⤵
PID:4140

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
7⤵
PID:4280

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5pU6Ut6.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5pU6Ut6.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:2036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
5⤵
- Creates scheduled task(s)
PID:5096

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
5⤵
PID:4872

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:768

C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
6⤵
PID:4648

C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
6⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:3280

C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
6⤵
PID:1652

C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
6⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6SK3wk36.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6SK3wk36.exe
2⤵
- Executes dropped EXE
PID:4876

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6745.tmp\6746.tmp\6747.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6SK3wk36.exe"
3⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffaa3f946f8,0x7ffaa3f94708,0x7ffaa3f94718
5⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:2
5⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:8
5⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
5⤵
PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
5⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
5⤵
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
5⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
5⤵
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
5⤵
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
5⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
5⤵
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2280,457495876434156267,1191125553603004636,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffaa3f946f8,0x7ffaa3f94708,0x7ffaa3f94718
5⤵
PID:920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15863601101486434506,11167532761467382928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
5⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15863601101486434506,11167532761467382928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4916 -ip 4916
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 392 -ip 392
1⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1296

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:5316

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:5332

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:5284

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:5300

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
a9513612adc29a9c1e437e04d6216485

SHA1
52eb7c3d57a2119dd6c4eec6aea2ec73ad2a4a3c

SHA256
28265b57de709d7f2ec45b3795f2caaeab716f575fd743f61ad016ed5beb979d

SHA512
f9f6da9a9d90114837907c19c44092eff25f14f90bfefb56ee65f29d35e2965cea9b78378dca45446d3bdff2441c6498d99b3e40f39c65ed4005fbc9257d8c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
c568963995ad20fcd0e42b00ef053e66

SHA1
a3fd7fa2a7cc6a96c11d8838f7053f2aae083396

SHA256
1511b1dfd2340352f3713a189c1d0c529460b36effabaaaec07a7c79c826eccd

SHA512
5e918aed8d0eda0e2e91b7bba57f4d1dbde22e1eae9df3a25ee94c8d0a555bd795546e70a2de0f011414404c0740e2badf4b930117fae597af3dc79efec39957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
76bef9a2545c72765b77b95e001150cc

SHA1
22719836649e569574852bb7e4500e67faf046ec

SHA256
81db99a5ea64e4dce6458fa897dd2252b08254793683ff45be0edf296355a84f

SHA512
01e6adda97450ad3c7fb1f4ec7d94490656f0be6d1dd863025fc86f5f4d19c6c04842fa499b501a8e9e635ca4f401b9728b6425db27cd7e294982ca8b26216b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
0608d6a8e0f951a80de9d6b538c4ae7d

SHA1
908c5fa27aec0f0bd8faafe18e66cc703cd95909

SHA256
45e961980ddeb9eb949d50ca6506f455bdbe8584371d23209be10d1af9f53e41

SHA512
34f61ee03a44d2305b2f3c0fe9328f8e2b9c482bc173f117c78632b2be2145101e3f4dc8388f7c5758d21485465d39069e6f70eb4b8bbcd59901722b5cc6bfc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
a54c72a22d849f7392a351d4c3e93b74

SHA1
c8e4c78b810c2a0c0436ab3da20fa7a25c0c9499

SHA256
21e9dfa189e1a0d0c2078c433c496ca8fa07ab6ddab8d26138d662e581a22329

SHA512
1bd9b2891efc5217becbf04d76bd1419c5488e8d8a83290e4294a68d3577b494ed27545fce3a4a7be482881f9e0412a5279653a81540a15dbbd150a2c1709882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
872B

MD5
55ae18a0d43424e8fa67e89f0260b924

SHA1
1e1ca9150ce26403ad923b9cfebd34291124dde6

SHA256
f892c5fab07baaec277b8d25ec0f9c808d2217cf36c62971c4490215276fce5d

SHA512
205753985b4a0c115e43a8bb80a7158ca9b71bbdbbf11bdac83990c6bfa7c039c938c7bb8dfe052008d3bccb6d29e3c48c708d89174f39dc04ba6e8380ea885a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
872B

MD5
974ed660c20c0be41ad98fbb143b7793

SHA1
a09cf4d4396985185df3a3f67fdc76e9512ba740

SHA256
0f7e9c6000fcc06e83760b51033a2605bba99b2220c841a2c80018c79ca35bf5

SHA512
99c0d90df4894ce75d33edd616e237e2c84a79969d1d4a1320cb3471147728da1399135e963ba1041752e7b10b94f08cee7f24e56a17a6355f440e928a573efc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581316.TMP
Filesize
872B

MD5
c383193aabe72fb3b5519fc715654440

SHA1
02675f9db40902b9ca2136f34fe99136ecd64f2a

SHA256
c8b50f30ad3a66e786e3404cd1378a7a06f80bd1d8ab975a7a82aa503d4c2546

SHA512
c2a4a67435d469300e6e41e3384a806b14100c1b18af515fe292351f34fbba9cfdbdb844b01cc29ae38962037d255f5ca3d1d671694219159076f8dd7f00f7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8c179919f890d786451718dc07e95cf6

SHA1
08f896fdc5a71674cd4f64d7a0967c610b3c7977

SHA256
1cff81b3023e314928ee91ce0756bfe8305b53b5f21b54e8d9ad1def8aa87536

SHA512
9bb0b81ec517955997d042f7f9d3640231ef3b58f5007c88b82af88cbbfc460cd427f847cdf42ad39d845a598d572c1e90eed4313783c1a246019ec577cd2b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
341d823239dabe38b612beaa56fc8a57

SHA1
6bf04e8a682548eddda10b264b8121755f45fe59

SHA256
a1aae1ca2169ee1863065051e35ef6e9c9b3983edc0eacaa18a40b9b1ea0ceb2

SHA512
bef5684684090c025e810a139301d56b5006e68fb76ffe237078373ac20050b5acb82325b9de7e5a036264c61222516eb8ed5c40eb57651f2ea496661f65a4db

Download Submit
C:\Users\Admin\AppData\Local\Temp\6745.tmp\6746.tmp\6747.bat
Filesize
90B

MD5
5a115a88ca30a9f57fdbb545490c2043

SHA1
67e90f37fc4c1ada2745052c612818588a5595f4

SHA256
52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d

SHA512
17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6SK3wk36.exe
Filesize
100KB

MD5
efd476d150b2aeef62f7d12de1792ef7

SHA1
41016b138dd683e92daee166bbc2e2b40a2a27d6

SHA256
6dd5a20032bb66386e1625e635db648894952b3ba33a60a40e27732f7db0f3ed

SHA512
22bad9e3aa16fcbec46799bd64e4d8658a2ce2112f9f8fe0e02d1df7d1a4ad64680d11510e5dbcbc2b0af8fdfa42ae51749641e0a2f8eaa1f6028d7d544ab94d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rr8qm41.exe
Filesize
1.5MB

MD5
64404f221bcca95bbd867a12ed8df2e6

SHA1
eb483389c3f73e6d61d01b684831cc3eff7930b9

SHA256
bd6ab15ae085b65856c5c5fb558c00ac6d6b8dd165fd526c86e2116b3cc618df

SHA512
4c980add9c29e7ab78ba68152397f8c611e72fd49807a41fa754c721d7a3d69b599553fdaacc5814500c6fd71623d6020fd2e22e5f1095886b459619ae8e354c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5pU6Ut6.exe
Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bQ1zc18.exe
Filesize
1.4MB

MD5
81c678adef473eadef88e72a9ad40874

SHA1
8db5122a8a402b2bd2e3912dc8773c80aa001131

SHA256
dc475cdb930376eee40b3e34deef01192fedc6831a3c45cecce184641f0d73db

SHA512
b88a5039612820f427a82b3d12f432bd9113e98a92e69c36abec2e85d54276d5cb9fcb0fa02b77b229dc9ff7a2536a37118774137225416ed2fffdcfbd6264ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4FW049ez.exe
Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ql8rz35.exe
Filesize
1.2MB

MD5
da5ac3fa1df159e83740bc240633ce78

SHA1
69a6e14b3af787fc6cae50391e52cacabf1e59b3

SHA256
4290c4e23d723aaad6d63b302b74fb8ce4e01fb8582f62cecd610d9f594f1f61

SHA512
391aee5f5e6102f5d6319441881818ed2fe137ee48f97abe1e979dccd41b7f7da259b7c8f33cb795b264d6c61267289f121b8d8347f6667b4eded86a4f429486

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\3Uh0431.exe
Filesize
1.8MB

MD5
8d0c6685f8e6a523501deb09471bdca2

SHA1
3f720d980f7e6cf5fb059add43037743a01deaa1

SHA256
8f45ad9997b481c18cf73140ba8c9ac0891648c3ad32b8dba859199f0c92384e

SHA512
081cb6da42601ff8db03c230a57834887a07404977fa0e97a59039381ff9b8a0202a5b4b1f56c88bdcd25e7e8428ebb3ecc4e554300357a327175ed58e848b19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bg9FO11.exe
Filesize
685KB

MD5
d37dfa589d4e3c0f54461f845dc41ec1

SHA1
4c276d0e3ad9ccac6f0ed739ec49ed60c1190677

SHA256
478dae73571c5146b701268cfff9a2f40e28a5f047691414be00491d9d648ad9

SHA512
70b8189e16dc6a571ab5d3ae58d52351a024159d618d2407a15fda710f7921d60643c88be8f8f6781687cb2e3469742f83b9771cab0f7b4e713ae4f3826859f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1KZ31Ur9.exe
Filesize
192KB

MD5
8904f85abd522c7d0cb5789d9583ccff

SHA1
5b34d8595b37c9e1fb9682b06dc5228efe07f0c6

SHA256
7624b62fe97c8e370c82bc86f69c2f627328e701ce1f3d9bed92a1e5fe11fd7f

SHA512
04dd0c4e612b6287af6a655425085d687538d756dcd639ecb6c62bcdafddde52c56ae305a6240ee1329a95d9cc59dee6de5000d273a5a560ad1adc3284e00e12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Wv77ma.exe
Filesize
1.7MB

MD5
9dd5f3d8acc816ffeb4b22efb5fcda42

SHA1
62cc6b989309ed3b29b40ae9ec878624d5df7b2c

SHA256
dce9a9925c986fd469ea92b92de4a8d823e0fd12a4b5509a7395e6f7bd52f397

SHA512
8c9f40cf10b9024409897de251e46fe3bbb130bf022116a9ac12dc8cff06eb8c9e30c5b137842d9445b221e3a512543a665bf50d401c82e3eab5aee16b92b778

Download Submit
\??\pipe\LOCAL\crashpad_3080_CIOJVVLYTRPRIIJT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1744-73-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1744-71-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1744-70-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1916-62-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-63-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-50-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-51-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-47-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-36-0x0000000004AD0000-0x0000000005074000-memory.dmp

Filesize
5.6MB

Download
memory/1916-37-0x00000000049A0000-0x00000000049BC000-memory.dmp

Filesize
112KB

Download
memory/1916-41-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-38-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-59-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-43-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-45-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-35-0x0000000002270000-0x000000000228E000-memory.dmp

Filesize
120KB

Download
memory/1916-65-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-39-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-53-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-55-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/1916-58-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/3840-79-0x00000000047A0000-0x00000000047AA000-memory.dmp

Filesize
40KB

Download
memory/3840-77-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3840-78-0x0000000007330000-0x00000000073C2000-memory.dmp

Filesize
584KB

Download
memory/3840-101-0x00000000074B0000-0x00000000074FC000-memory.dmp

Filesize
304KB

Download
memory/3840-95-0x0000000007450000-0x000000000748C000-memory.dmp

Filesize
240KB

Download
memory/3840-86-0x0000000007DB0000-0x0000000007EBA000-memory.dmp

Filesize
1.0MB

Download
memory/3840-91-0x00000000073F0000-0x0000000007402000-memory.dmp

Filesize
72KB

Download
memory/3840-85-0x00000000083D0000-0x00000000089E8000-memory.dmp

Filesize
6.1MB

Download