crimsonrat | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

09-06-2024 15:14

240609-smc6tace62 10

09-06-2024 15:07

240609-shrhmsbg8v 4

Analysis

max time kernel
199s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

crimsonrat metasploit modiloader netwire njrat backdoor botnet evasion persistence rat stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

http://149.129.72.37:23456/SNpK

Attributes

headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP09; NP09; MAAU)

Extracted

Family

crimsonrat

185.136.161.124

Extracted

Family

modiloader

https://drive.google.com/u/0/uc?id=1TcSctGVBajYMA7CFDc158wpvqkpxmkhJ&export=download

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023506-1000.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3584	4448	rundll32.exe	112

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

ModiLoader First Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023540-1022.dat	modiloader_stage1
behavioral1/memory/5484-1130-0x0000000010410000-0x000000001047E000-memory.dmp	modiloader_stage1

Blocklisted process makes network request 1 IoCs

flow	pid	Process
79	3584	rundll32.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5492	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe\:SmartScreen:$DATA	NJRat.exe

Executes dropped EXE 18 IoCs

pid	Process
5360	NJRat.exe
2584	CrimsonRAT.exe
5732	dlrarhsiva.exe
5804	NJRat.exe
5484	NetWire.exe
5504	NetWire.exe
6800	NetWire.exe
6880	NetWire.exe
5524	NetWire.exe
7596	NetWire.exe
7640	NetWire.exe
6560	NetWire.exe
2172	NetWire.exe
8020	NetWire.exe
7828	NetWire.exe
1888	NetWire.exe
8556	NetWire.exe
8244	MeltingScreen.exe

Loads dropped DLL 1 IoCs

pid	Process
6892	NetWire.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Qspt = "C:\\Users\\Admin\\AppData\\Local\\Qspt\\Qspt.hta"	NetWire.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Qspt = "C:\\Users\\Admin\\AppData\\Local\\Qspt\\Qspt.hta"	NetWire.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Qspt = "C:\\Users\\Admin\\AppData\\Local\\Qspt\\Qspt.hta"	NetWire.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Qspt = "C:\\Users\\Admin\\AppData\\Local\\Qspt\\Qspt.hta"	NetWire.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Qspt = "C:\\Users\\Admin\\AppData\\Local\\Qspt\\Qspt.hta"	NetWire.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Qspt = "C:\\Users\\Admin\\AppData\\Local\\Qspt\\Qspt.hta"	NetWire.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Qspt = "C:\\Users\\Admin\\AppData\\Local\\Qspt\\Qspt.hta"	NetWire.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Downloads\\NJRat.exe\" .."	NJRat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Downloads\\NJRat.exe\" .."	NJRat.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
166	drive.google.com
168	drive.google.com
172	drive.google.com
175	drive.google.com
68	raw.githubusercontent.com
159	drive.google.com
177	drive.google.com
179	drive.google.com
69	raw.githubusercontent.com
160	drive.google.com

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5504 set thread context of 5660	5504	NetWire.exe	158
PID 6892 set thread context of 5800	6892	NetWire.exe	165
PID 5524 set thread context of 7440	5524	NetWire.exe	166
PID 7640 set thread context of 8688	7640	NetWire.exe	168
PID 2172 set thread context of 8156	2172	NetWire.exe	170
PID 8556 set thread context of 7752	8556	NetWire.exe	172

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	msedge.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
8296	reg.exe
8212	reg.exe
5556	reg.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 796070.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 727643.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 183559.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 591517.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 684070.crdownload:SmartScreen	msedge.exe

Script User-Agent 14 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	180	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	160	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	166	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	175	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	178	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	179	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	167	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	168	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	170	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	172	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	174	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	164	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	176	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	177	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4448	WINWORD.EXE
4448	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
1528	msedge.exe
1528	msedge.exe
3852	identity_helper.exe
3852	identity_helper.exe
632	msedge.exe
632	msedge.exe
1952	msedge.exe
1952	msedge.exe
4908	msedge.exe
4908	msedge.exe
5144	msedge.exe
5144	msedge.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe
5360	NJRat.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5360	NJRat.exe
Token: SeDebugPrivilege	5804	NJRat.exe
Token: 33	5360	NJRat.exe
Token: SeIncBasePriorityPrivilege	5360	NJRat.exe
Token: 33	5360	NJRat.exe
Token: SeIncBasePriorityPrivilege	5360	NJRat.exe
Token: 33	5360	NJRat.exe
Token: SeIncBasePriorityPrivilege	5360	NJRat.exe
Token: 33	5360	NJRat.exe
Token: SeIncBasePriorityPrivilege	5360	NJRat.exe
Token: 33	5360	NJRat.exe
Token: SeIncBasePriorityPrivilege	5360	NJRat.exe
Token: 33	5360	NJRat.exe
Token: SeIncBasePriorityPrivilege	5360	NJRat.exe
Token: 33	5360	NJRat.exe
Token: SeIncBasePriorityPrivilege	5360	NJRat.exe
Token: 33	5360	NJRat.exe
Token: SeIncBasePriorityPrivilege	5360	NJRat.exe
Token: 33	5360	NJRat.exe
Token: SeIncBasePriorityPrivilege	5360	NJRat.exe
Token: 33	5360	NJRat.exe
Token: SeIncBasePriorityPrivilege	5360	NJRat.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE
4448	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4008	1528	msedge.exe	81
PID 1528 wrote to memory of 4008	1528	msedge.exe	81
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 900	1528	msedge.exe	82
PID 1528 wrote to memory of 4080	1528	msedge.exe	83
PID 1528 wrote to memory of 4080	1528	msedge.exe	83
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84
PID 1528 wrote to memory of 1904	1528	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd92c546f8,0x7ffd92c54708,0x7ffd92c54718
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1792 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\CobaltStrike (1).doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4448
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe
    3⤵
    - Process spawned unexpected child process
    - Blocklisted process makes network request
    PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1920 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5448 /prefetch:2
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1888 /prefetch:8
  2⤵
  PID:5216
- C:\Users\Admin\Downloads\NetWire.exe
  "C:\Users\Admin\Downloads\NetWire.exe"
  2⤵
  - Executes dropped EXE
  PID:5484
- - C:\Users\Admin\Downloads\NetWire.exe
    "C:\Users\Admin\Downloads\NetWire.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:5504
  - - C:\Windows\SysWOW64\Notepad.exe
      C:\Windows\System32\Notepad.exe
      4⤵
      PID:8528
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Natso.bat" "
        5⤵
        
        PID:8536
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete hkcu\Environment /v windir /f
        6⤵
        Modifies registry key
        
        PID:8296
      - C:\Windows\SysWOW64\reg.exe
        
        reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
        6⤵
        Modifies registry key
        
        PID:8212
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
        6⤵
        
        PID:7336
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete hkcu\Environment /v windir /f
        6⤵
        Modifies registry key
        
        PID:5556
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      PID:5660
- C:\Users\Admin\Downloads\NetWire.exe
  "C:\Users\Admin\Downloads\NetWire.exe"
  2⤵
  - Executes dropped EXE
  PID:6800
- - C:\Users\Admin\Downloads\NetWire.exe
    "C:\Users\Admin\Downloads\NetWire.exe"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:6892
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      PID:5800
- C:\Users\Admin\Downloads\NetWire.exe
  "C:\Users\Admin\Downloads\NetWire.exe"
  2⤵
  - Executes dropped EXE
  PID:6880
- - C:\Users\Admin\Downloads\NetWire.exe
    "C:\Users\Admin\Downloads\NetWire.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:5524
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      PID:7440
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\ILOVEYOU.vbs"
  2⤵
  PID:7504
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\ILOVEYOU.vbs"
  2⤵
  PID:7548
- C:\Users\Admin\Downloads\NetWire.exe
  "C:\Users\Admin\Downloads\NetWire.exe"
  2⤵
  - Executes dropped EXE
  PID:7596
- - C:\Users\Admin\Downloads\NetWire.exe
    "C:\Users\Admin\Downloads\NetWire.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:7640
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      PID:8688
- C:\Users\Admin\Downloads\NetWire.exe
  "C:\Users\Admin\Downloads\NetWire.exe"
  2⤵
  - Executes dropped EXE
  PID:6560
- - C:\Users\Admin\Downloads\NetWire.exe
    "C:\Users\Admin\Downloads\NetWire.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:2172
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      PID:8156
- C:\Users\Admin\Downloads\NetWire.exe
  "C:\Users\Admin\Downloads\NetWire.exe"
  2⤵
  - Executes dropped EXE
  PID:8020
- - C:\Users\Admin\Downloads\NetWire.exe
    "C:\Users\Admin\Downloads\NetWire.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:7828
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      PID:7848
- C:\Users\Admin\Downloads\NetWire.exe
  "C:\Users\Admin\Downloads\NetWire.exe"
  2⤵
  - Executes dropped EXE
  PID:1888
- - C:\Users\Admin\Downloads\NetWire.exe
    "C:\Users\Admin\Downloads\NetWire.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:8556
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      PID:7752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:8488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,9934200901223996785,3537013900748688442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:7248
- C:\Users\Admin\Downloads\MeltingScreen.exe
  "C:\Users\Admin\Downloads\MeltingScreen.exe"
  2⤵
  - Executes dropped EXE
  PID:8244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5304

C:\Users\Admin\Downloads\NJRat.exe
"C:\Users\Admin\Downloads\NJRat.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5360
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\Downloads\NJRat.exe" "NJRat.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:5492

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2584
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:5732

C:\Users\Admin\Downloads\NJRat.exe
"C:\Users\Admin\Downloads\NJRat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5804

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x4e8
1⤵
PID:6760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
86KB

MD5
96ff9d4cac8d3a8e73c33fc6bf72f198

SHA1
17d7edf6e496dec4695d686e7d0e422081cd5cbe

SHA256
96db5d52f4addf46b0a41d45351a52041d9e5368aead642402db577bcb33cc3d

SHA512
23659fb32dff24b17caffaf94133dac253ccde16ea1ad4d378563b16e99cb10b3d7e9dacf1b95911cd54a2cad4710e48c109ab73796b954cd20844833d3a7c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
23b5fbd43f4cde3805398bfa45c62a23

SHA1
20839610ddd827369329fb7cbd2ebbe28475ef61

SHA256
6bc4a4c8b568f9dc6bfedba3d0ac98dae74a05455a8985203a39cdef407e0f1e

SHA512
738a3d98cfb9cb9577392d9a1c600bf61762296967332fb7a047118ff5ba655eef2a3fe788b153ba1deaf67e9f1f950b43fb90a369a1e4875b33169fbdbc806e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b2471fbf45cd625862da155af60ee343

SHA1
797da97407f9d7d90634fa01b45520a86fb7a1a5

SHA256
d5eadfccb2a6b4f6777aae8c06c5e9af14d55a9a71ee208c1088dcebcc1be70e

SHA512
d4d9d2dacd63a76a6b0469e061dfa44141ec68e8d8e6af873f53136ad9d7fe662d9925d2a8cd8dcc6c5e9f9ede25944415e17cc1766e3f56661c1da2e52ce50e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
8bbf66ae9ec386af4152e640d99ee79f

SHA1
6eed11e2861ec6509f508ae7197d0338897fb869

SHA256
63323b56c49b79c0cc4e1d4860f2121f462a4813f256a028c777604470013209

SHA512
fa2ca0c0a7a8f8d3396001a6e23113ed50d54ae83af55b5b0f4db40fee7d04590eb316f315eadc08677fcb6a731d9b662d1bff18faea70a66f566a1136792ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10f5a90957b40896838d1cc5698ec753

SHA1
e480e0b03541132870868d58e0784b4bc44aa547

SHA256
7a600aa12db68d8321a5fac5fd5d22033344aadffd69cfe990374ff6e54fb4af

SHA512
44dd8b06593d6c85c7be846121d8d44e99b41ad68c12a5db8ff7bf426e1f6b06b28d5a186e3f35fd55775b198ec2000effcc1ba38a8dafbed0c12abe744148d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
060b32ae220e9837e0946708de8d9356

SHA1
added328b9270f0452e7ca1113e38ee071b5f47b

SHA256
132c728184dfa3b74462069b68800a11c1dc6b8508b2cd9ee4d886c5d5171783

SHA512
07aa4611dd5dd5fd7ff1c892e6823836dd90f2eb1b4ee9ac9efe317c5f530776aee43fd5cc4e331f3fa24e91938ac524fb86af7e08baedd2a0f48fd3ed1c7b2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d886acd848703def850df6d7631cad0

SHA1
24808c1bdf8d93ff97d7d288719adb18873ae005

SHA256
36600650a2d71b361e597ec5ce3d447a2478deb6bdfdd3f348d533bab850c427

SHA512
571175eb126440436e02ce8ada88223a91496105e985661a118f40fe4eac10e6e2c732f47ddfe3a89b6bb497fe513dbe7938448b1aaee451f896b3259a91d835

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7ba56e7f4f8b0c719ca4375522080116

SHA1
dc01a25143ceb46dd2930783f6c6419bf9a2201b

SHA256
af26ab5054e8e034489ac8f387493c02af0fc53ef2bf8bdc1b6545900a103796

SHA512
eb2682c9575506b255ec17d8329462ed60261cbb1cd506ecac196977948ac4c2cbc7161412ec7b54ccf86a433491b5c5bed73e23d3278b977ad55bc1ed061879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
925b9b76c753b1253f25e8a7ba18bec8

SHA1
a9cd3f597021f2472645f009e4eb52d99c6f2136

SHA256
65b2edc6c77bbd2d922b1a82a80c07227cf924abc2b2f6b19f68ac68495f0db1

SHA512
abba74b7c1fbbe15e46bf30fb90b5f5378c2aa96be679c6ce508487f2a013974adeaa763379cc0f78bfbd2a23a822d6fe772ede8e8686dd431d54f4b1bd4c7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
804b3d942066003e7a51c529a3c3db66

SHA1
066f47aea24503433e61cad5b82c4e696594555b

SHA256
af79e441accb4c6df71443f9289a3eb37e89cf546cf81c8919121f345d300406

SHA512
6958c07070095e7dabbff58bcd68a071a36a262866e568506682ce0b09a1ff7e5dc119b6b1317e6fdf1316b9fefe0b4624a80fcd59232a483b3ab341e07d31b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1ad34af390b96054192d64e9b4c60313

SHA1
8a9ccf10105fc4666128190df8f3e71b484d0c3e

SHA256
b6f7ae8196dc4a7d2204d4a085af4db666925e2e5acf178b8756dcf09b9594ac

SHA512
ffd768226fffa41fc2c7f8fec358ea3c7481a703def734e3e4c880be5ad80fae5102bc8c87dbbd7f179abe7fe9eba46e45faffca74d42261a6adc50fea247676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
5e6c181ab2dfe7f92f90b4a0844d2a78

SHA1
be908bd0acd451f822f4144ea1e617ab7a9f94c1

SHA256
4d659e94fc94ef1e075ff6b240dd7f916c3cf75bba85ea002732fc7c4aa62642

SHA512
b42b5c00adc5cd382660038c75c58a70734441aa20d24753d57fd3553b4f12bed16cc8d75c2286b61287b6e47a5e0707c65729c0a84aee49c4145273c6425c87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b8cd844a26e129c916201557cdf9745b

SHA1
0512dfba286f33ddd8457e54700d24cbb4ad9ad1

SHA256
68df1b967892d096810495c9dc7be7c8e0f4e29004b9bc7269d3632e85d490e6

SHA512
6a62903a6a704b2bc75a0128b7553af0f68fd7a44dfe61fc508662a9df7c910f8d537777a554fe010bc7a478dc8dc4e5941677dd679f4c2a8c7b740890d926d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
58f805f7e058d6354a49ef9fa18f32ba

SHA1
53658cf15d3c16db99f0493836ab91cc33c8648d

SHA256
71c2b4df45bb5f973bb263be8d1bac3a7124f4c535b02c801e7b71e5cb9064d1

SHA512
9dc407073679581c730ce115c46fe0173fb41d29f76bbd375ae6493b6d8c7dd18c1f0b35256075c22e39720b923d5b1b3fb60c999f3abb1ed5ed365893ef5c87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583bfa.TMP

Filesize
874B

MD5
d502db36174e23e33452ef743a5a2e29

SHA1
5763303e5b8de91692ae2973eaa9363e6d4762cc

SHA256
0b6362fcac742914bbcb906c2de4e9f09ca172214ca573d56dd3da67e9143570

SHA512
d50a99f0ddd523d7d88306924100548f91dbba2159c6b8179c9353661646b0d7cb58745142ce0f81abc225f744a1d6bf307a81a93e9ce96de3e65dd42c61401b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8bc006f-934a-4932-8031-e09da984488b.tmp

Filesize
1KB

MD5
1f6da8b8a9c0bdab46cdc8139b835020

SHA1
4d2e87317f08d394562edca87f9c94012d33d615

SHA256
08dce0fd158f445910bc720880eb812cfbb58b786324478fa45919b456979f06

SHA512
78d4456cbfd4173ddac5b67ceffdd8726febffc77793c22fc65473d7d90a12c78b35cf5ff2929310527842ee0e7d9508411cfc7e01f24becb83b173270bef705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5f3489843c72867662d43fd877d1f081

SHA1
05328265a13c76a36349c752b0f686b6095ddf77

SHA256
a6d47d2e291197780a5a63ecb2532a344e1eb0dbe37422fcfbaee977d294ed78

SHA512
fe96c3064c88575df428da27c482774e885e41f5a9af5ce31da9d978ab519696fb704ddacf16b4876f6e76274f1cb30231e5607d0d6acbc768a7d0ecdfde05cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5feb144e770699b6e66238baee0b55f3

SHA1
3bfcd188c75194ad0232e670502289f0b2f53778

SHA256
5679f8a2903af041221178890c06c10c9ad0929008fc38588f15a110c20acea7

SHA512
0067e440fdd500732e0aeda1ba974883c16cabf63be69b31d4497deeabc04a52e92140abe8f05de70ce0e51e45fb08b8de852e6f63aedcaa687fc38003447657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
73708bbf38e9a93b4fbabd4ece669ea7

SHA1
f8a3868f412c35482122d67849a1bca5ba796270

SHA256
c7ee764d124849d6f6429191d96fd04c57fc4035f2a895f4f2f6ec43a36bcfc0

SHA512
be037b6e03ad82e63ab91fff6cebf798c0218c96e9ba89ae32a8099e78ce8b48ff27c13c8e875c72fe756198cb2cc97e49fe0dddaee572708d297269731c6482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f646bb28-5270-4045-8fb2-d777881b5ea3.tmp

Filesize
11KB

MD5
0b11bb089843305fbb19da566b1256ca

SHA1
814618969a888f6a12e0688d3d841114550c43f4

SHA256
2f92f856346a89672200c77bf5a4d75374666ad799c8b5637b8e8488a51ce3d5

SHA512
6e918d4488b10f4d10f4ea1a72103f22ea578dfad5731f33716b90ba24ee20190e2cab5cd658dadf1a370c6bff88b7e3d8e1fb0383ae11f3d7eec31f6fb35d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
f15d37994c4a0ea169e7c5f2cf03ad4b

SHA1
95af7bea86a21c1b1e57eed2b6595d48701d473f

SHA256
e017605eeba4070a9904f9776162b16a30c5eb5fb703c122617096b33a2cfe53

SHA512
9bfeb3b929278f9c4b48a3cc094b2eca0ef44145f2a58d66c3b1086660605d661b2ea39155b2e38e507fd137da4fa83d3ddbae413d8fc555b1a7b9d36689568c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD9810.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
265B

MD5
9d09e1fce3dd97dfe8042242cd93d8b8

SHA1
82eb159b5926690a15d72e9d378cab50e7b7fd56

SHA256
1c454548634500c495feb620ee9b4edfe44673399bf2602389fab50dac6370ce

SHA512
0ed6c30e2cd415fb4d8a0fb2e6722727b33043f0edd6c7bb551e5cc52864c5e81473d1952d00d5b7690b3d5782db0c73e647cad5fe2b0ea6f06c045aa7748ac2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
8KB

MD5
198dbe75c01dc527d475b229145ab3f4

SHA1
db6880fc862cd499670b20a2b03bfc1dae8edbe3

SHA256
9f353c8dcd897b845408cff8237c85a57176820b864f53198f010f0013eebab6

SHA512
462e2f3d4ac010118b18bdd8e20270e2d5c53ab170825b2723c9437abd844f2a5beb65b0423f47c58673729404aafa96867653045ecd3633083f91d4b9d32da4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
836dd3e9db6c3462eb6f2461d030225c

SHA1
3c770d744fac50c93793571354b0e6715110d692

SHA256
3d90892f5df9c793d8ba1075e8428f29e62f05fa5961d00e217592227189a596

SHA512
989c734065dffad1e72e34dcfbb3e1e1710bf394e6012e4fe99badffa2cf3673682a0da758ceb126dc0377a642dcd89b6879223047d3e653eb14db09666f3406

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
31d0b42026282edcc1e1b4563087a3d5

SHA1
1e530de6d192d051330fbc42aa5fb28de8949fbe

SHA256
739415d8ace29adfc62f6bfc519d3ff999f2a4dc93d495075e7e5a5cd501073a

SHA512
7215acb4d8898aefeb83fef5ef4a8ab4f9544154ce3b634ad65d03feb52cf2344314140ddf011913dc1705996fee7b8dd1f10e9eae0e79587988b81b871c14c9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 183559.crdownload

Filesize
1.2MB

MD5
7621f79a7f66c25ad6c636d5248abeb9

SHA1
98304e41f82c3aee82213a286abdee9abf79bcce

SHA256
086d35f26bd2fd886e99744960b394d94e74133c40145a3e2bc6b3877b91ec5d

SHA512
59ffcf6eeac00c089e9c77192663d0dc97b2e62cedb6d64fe7dc2e67499abc34e33977e05113c9d39ca6d3e37e8b5c3e6aa926c8526215808b147c0152f7dbfd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 591517.crdownload

Filesize
10KB

MD5
8e2c097ca623ca32723d57968b9d2525

SHA1
dccfb092fa979fb51c8c8ca64368a6f43349e41d

SHA256
556700ac50ffa845e5de853498242ee5abb288eb5b8ae1ae12bfdb5746e3b7b1

SHA512
a468476a8463c36c2db914e3fe4dc7aee67ac35e5e39292107431d68ab1553ca3c74255a741432ba71e8a650cf19eb55d43983363bfc9710e65b212fba37bbde

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 591517.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 684070.crdownload

Filesize
17KB

MD5
4784e42c3b15d1a141a5e0c8abc1205c

SHA1
48c958deba25a4763ef244ac87e87983c6534179

SHA256
9d355e4f9a51536b05269f696b304859155985957ba95eb575f3f38c599d913c

SHA512
d63d20a38602d4d228367b6596454a0f5b2884c831e3a95237d23b882abd624de59ea47835636b06a96e216f1decf8c468caacd45e5d3b16a5eb9e87bc69eb97

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 727643.crdownload

Filesize
31KB

MD5
29a37b6532a7acefa7580b826f23f6dd

SHA1
a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f

SHA256
7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69

SHA512
a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 796070.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Public\Natso.bat

Filesize
283B

MD5
5cc1682955fd9f5800a8f1530c9a4334

SHA1
e09b6a4d729f2f4760ee42520ec30c3192c85548

SHA256
5562cc607d2f698327efacc4a21bd079bb14a99b03e7a01b3c67f8440e341cb3

SHA512
80767263aad44c739236161d4338d5dd8b0b58613f22cd173c3e88ebf143220ee56bbf93ace69a07d3c2f00daff0adbaa8461a1d53d12699725395c931c43cb6

Download Submit
memory/2584-977-0x0000024AB1710000-0x0000024AB172E000-memory.dmp

Filesize
120KB

Download
memory/3584-302-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/4448-268-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

Filesize
64KB

Download
memory/4448-269-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

Filesize
64KB

Download
memory/4448-875-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

Filesize
64KB

Download
memory/4448-873-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

Filesize
64KB

Download
memory/4448-266-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

Filesize
64KB

Download
memory/4448-876-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

Filesize
64KB

Download
memory/4448-874-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

Filesize
64KB

Download
memory/4448-267-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

Filesize
64KB

Download
memory/4448-265-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

Filesize
64KB

Download
memory/4448-270-0x00007FFD5E690000-0x00007FFD5E6A0000-memory.dmp

Filesize
64KB

Download
memory/4448-271-0x00007FFD5E690000-0x00007FFD5E6A0000-memory.dmp

Filesize
64KB

Download
memory/5484-1130-0x0000000010410000-0x000000001047E000-memory.dmp

Filesize
440KB

Download
memory/5504-1131-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/5504-1132-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/5732-1008-0x000001D6A6920000-0x000001D6A7234000-memory.dmp

Filesize
9.1MB

Download