Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26-07-2024 11:54

General

  • Target

    NiggerDick.exe

  • Size

    3.6MB

  • MD5

    edcd9b037986143a8bad4985bf0e661d

  • SHA1

    aa7ad22502f138c9ef68b6e66f50999ed94c7276

  • SHA256

    e65878b615947fcf75baee636c9a2012e28873beb43b8b0250bd9af4b11339ba

  • SHA512

    3f62163ae6bb81dc59e23c6ad5192de1fd0bfe7e6e85e4420119e314b48c7431bdd368c841f802c858aee67a45b88959ce32f961de9a8e965cc47cf7b946ea9c

  • SSDEEP

    49152:8F24+xNyKwdkMRcHwK5+MdqUolO+r8tEAmafrP4iUUYJETGXP6XA:8F24gNyKw6MpMdqpfrjgUi2ETGXM

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NiggerDick.exe
    "C:\Users\Admin\AppData\Local\Temp\NiggerDick.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Users\Admin\AppData\Local\Temp\rig.exe
      "C:\Users\Admin\AppData\Local\Temp\rig.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4880
    • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
      "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
        3⤵
        • Executes dropped EXE
        PID:4136
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
        3⤵
        • Executes dropped EXE
        PID:4824
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
        3⤵
        • Executes dropped EXE
        PID:3424
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
        3⤵
        • Executes dropped EXE
        PID:2084
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
        3⤵
        • Executes dropped EXE
        PID:4288
      • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
        "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /main
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3316
        • C:\Windows\SysWOW64\notepad.exe
          "C:\Windows\System32\notepad.exe" \note.txt
          4⤵
          • System Location Discovery: System Language Discovery
          PID:752
    • C:\Users\Admin\AppData\Local\Temp\32.exe
      "C:\Users\Admin\AppData\Local\Temp\32.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Users\Admin\AppData\Local\Temp\32.exe
        "C:\Users\Admin\AppData\Local\Temp\32.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1132
  • C:\Windows\SysWOW64\colorerchunk.exe
    "C:\Windows\SysWOW64\colorerchunk.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Windows\SysWOW64\colorerchunk.exe
      "C:\Windows\SysWOW64\colorerchunk.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4008
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3204
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:2336
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1256
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4408
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:876
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:4984
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:2328
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:4772
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:4324
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:5292
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x3fc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VSH5XF98\edgecompatviewlist[1].xml

    Filesize

    74KB

    MD5

    d4fc49dc14f63895d997fa4940f24378

    SHA1

    3efb1437a7c5e46034147cbbc8db017c69d02c31

    SHA256

    853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

    SHA512

    cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DNTHEMS\anchor[5].htm

    Filesize

    48KB

    MD5

    55b876bd8573a3f1119fd1ed78e4d3d5

    SHA1

    57b1c1ada57d6b7ef61296c4fc4893682fdefd27

    SHA256

    eff9b8cc30c0a948085105bddbd2274d4e04e2a9a68e07f1b06515c82602fd81

    SHA512

    a900480aef46b0a608c5a3996d3ff86b738da11f64478ca7600f993935ad40c166141f511f568f354199c977065deb6b451f8e014174ff4238e8b0b8956732f0

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DNTHEMS\bframe[5].htm

    Filesize

    7KB

    MD5

    191ea853d612b5ca5db7e64b5c278e33

    SHA1

    518ee4451dc4e36c49933c5e9adcaba1da7ee1af

    SHA256

    42eca4255b44d568e7eb9114b1871844a1f4db0160d4437599a68aa51877f15d

    SHA512

    624bf1c409ef4c0eb74acf25cae230a028ed8810cf42efef7c23a4742f5154bad722a00600eb0c9ad9566eae9ff0963b6d6afaec5047cd32370889c8f1c4aa45

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DNTHEMS\styles__ltr[1].css

    Filesize

    55KB

    MD5

    4adccf70587477c74e2fcd636e4ec895

    SHA1

    af63034901c98e2d93faa7737f9c8f52e302d88b

    SHA256

    0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d

    SHA512

    d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\recaptcha__en[1].js

    Filesize

    531KB

    MD5

    2ea96f82197c227ad3d999f6a6fcf54d

    SHA1

    dc1499948a1822d16cab150eaee16f4ab8c028d8

    SHA256

    e1d667d61bb50e0a815101a7d0d7f379b7219776fee856eedbe965a049db8d44

    SHA512

    dafee1d415487b796e02ef295073382aac48ac76e90c749028a9241bd44ec04ec2ee34163b8177f94d01e9e9d87577ec34c18d780a9f17b80923106d992749a9

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\4QQNSJPZ\favicon[1].ico

    Filesize

    5KB

    MD5

    f3418a443e7d841097c714d69ec4bcb8

    SHA1

    49263695f6b0cdd72f45cf1b775e660fdc36c606

    SHA256

    6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

    SHA512

    82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\OM0SALLZ\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DNTHEMS\KFOlCnqEu92Fr1MmEU9fABc4EsA[1].woff2

    Filesize

    9KB

    MD5

    df648143c248d3fe9ef881866e5dea56

    SHA1

    770cae7a298ecfe5cf5db8fe68205cdf9d535a47

    SHA256

    6a3f2c2a5db6e4710e44df0db3caec5eb817e53989374e9eac68057d64b7f6d2

    SHA512

    6ff33a884f4233e092ee11e2ad7ef34d36fb2b61418b18214c28aa8b9bf5b13ceccfa531e7039b4b7585d143ee2460563e3052364a7dc8d70b07b72ec37b0b66

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DNTHEMS\KFOmCnqEu92Fr1Mu4WxKOzY[1].woff2

    Filesize

    7KB

    MD5

    7aa7eb76a9f66f0223c8197752bb6bc5

    SHA1

    ac56d5def920433c7850ddbbdd99d218d25afd2b

    SHA256

    9ca415df2c57b1f26947351c66ccfaf99d2f8f01b4b8de019a3ae6f3a9c780c7

    SHA512

    e9a513741cb90305fbe08cfd9f7416f192291c261a7843876293e04a874ab9b914c3a4d2ed771a9d6484df1c365308c9e4c35cd978b183acf5de6b96ac14480d

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9ZOAZUWB\KFOlCnqEu92Fr1MmEU9fBBc4[1].woff2

    Filesize

    15KB

    MD5

    285467176f7fe6bb6a9c6873b3dad2cc

    SHA1

    ea04e4ff5142ddd69307c183def721a160e0a64e

    SHA256

    5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

    SHA512

    5f9bb763406ea8ce978ec675bd51a0263e9547021ea71188dbd62f0212eb00c1421b750d3b94550b50425bebff5f881c41299f6a33bbfa12fb1ff18c12bc7ff1

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9ZOAZUWB\KFOlCnqEu92Fr1MmEU9fBxc4EsA[1].woff2

    Filesize

    7KB

    MD5

    207d2af0a0d9716e1f61cadf347accc5

    SHA1

    0f64b5a6cc91c575cb77289e6386d8f872a594ca

    SHA256

    416d72c8cee51c1d6c6a1cab525b2e3b4144f2f457026669ddad34b70dabd485

    SHA512

    da8b03ee3029126b0c7c001d7ef2a7ff8e6078b2df2ec38973864a9c0fd8deb5ecef021c12a56a24a3fd84f38f4d14ea995df127dc34f0b7eec8e6e3fc8d1bbd

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9ZOAZUWB\KFOlCnqEu92Fr1MmEU9fCxc4EsA[1].woff2

    Filesize

    5KB

    MD5

    6bef514048228359f2f8f5e0235f8599

    SHA1

    318cb182661d72332dc8a8316d2e6df0332756c4

    SHA256

    135d563a494b1f8e6196278b7f597258a563f1438f5953c6fbef106070f66ec8

    SHA512

    23fb4605a90c7616117fab85fcd88c23b35d22177d441d01ce6270a9e95061121e0f7783db275ad7b020feaba02bbbc0f77803ca9fb843df6f1b2b7377288773

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9ZOAZUWB\logo_48[1].png

    Filesize

    2KB

    MD5

    ef9941290c50cd3866e2ba6b793f010d

    SHA1

    4736508c795667dcea21f8d864233031223b7832

    SHA256

    1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

    SHA512

    a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\0dKosa6Lh2NxpFh0svIz4L-wz65qkRTTn4jOj6ZWQ1s[1].js

    Filesize

    17KB

    MD5

    6f2415d78a81478937ed57418fc720d6

    SHA1

    6198da214539d4ef2bff03b2f3bb2a0ec475a599

    SHA256

    d1d2a8b1ae8b876371a45874b2f233e0bfb0cfae6a9114d39f88ce8fa656435b

    SHA512

    ee5e271d863ddba41d1ac423376a8431264d02e71bce7c6e888e4214adec77a65dccc8e3f4801fe1f1c9ebcf64f86b4278146652a7e0dfd92b700c070be9e043

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\KFOlCnqEu92Fr1MmEU9fCBc4EsA[1].woff2

    Filesize

    1KB

    MD5

    52e881a8e8286f6b6a0f98d5f675bb93

    SHA1

    9c9c4bc1444500b298dfea00d7d2de9ab459a1ad

    SHA256

    5e5321bb08de884e4ad6585b8233a7477fa590c012e303ea6f0af616a6e93ffb

    SHA512

    45c07a5e511948c328f327e2ef4c3787ac0173c72c51a7e43e3efd3e47dd332539af15f3972ef1cc023972940f839fffe151aefaa04f499ae1faceaab6f1014f

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\KFOlCnqEu92Fr1MmEU9fCRc4EsA[1].woff2

    Filesize

    14KB

    MD5

    79c7e3f902d990d3b5e74e43feb5f623

    SHA1

    44aae0f53f6fc0f1730acbfdf4159684911b8626

    SHA256

    2236e56f735d25696957657f099459d73303b9501cc39bbd059c20849c5bedff

    SHA512

    3a25882c7f3f90a7aa89ecab74a4be2fddfb304f65627b590340be44807c5c5e3826df63808c7cd06daa3420a94090249321a1e035b1cd223a15010c510518df

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\KFOlCnqEu92Fr1MmEU9fChc4EsA[1].woff2

    Filesize

    11KB

    MD5

    16aedbf057fbb3da342211de2d071f11

    SHA1

    fdee07631b40b264208caa8714faaa5b991d987b

    SHA256

    7566a2f09ff8534334b7a44f72a1afaba6bdbb782209be8804636ee8b963c75f

    SHA512

    5cd45dfb0d0ee44afd9b3ffd93c2942c2f04e359d067d4631edd67a2ee09149766294b29c75aaab7436dacc775a8ca02392c5e4cfb8d7fede19c028448507e0e

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\KFOlCnqEu92Fr1MmYUtfCxc4EsA[1].woff2

    Filesize

    4KB

    MD5

    133b0f334c0eb9dbf32c90e098fab6bd

    SHA1

    398f8fd3a668ef0b16435b01ad0c6122e3784968

    SHA256

    6581d0d008bc695e0f6beffbd7d51abb4d063ef5dedc16feb09aa92ea20c5c00

    SHA512

    2a5a0956ecc8680e4e9ef73ec05bc376a1cc49ddb12ee76316378fe9626dccedb21530e3e031b2dae2830874cc1b6bfd6cce2d6d0dce54587ff0fc3780041ace

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\KFOmCnqEu92Fr1Mu5mxKOzY[1].woff2

    Filesize

    9KB

    MD5

    efe937997e08e15b056a3643e2734636

    SHA1

    d02decbf472a0928b054cc8e4b13684539a913db

    SHA256

    53f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361

    SHA512

    721c903e06f00840140ed5eec06329221a2731efc483e025043675b1f070b03a544f8eb153b63cd981494379a9e975f014b57c286596b6f988cee1aaf04a8c65

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\KFOmCnqEu92Fr1Mu7GxKOzY[1].woff2

    Filesize

    11KB

    MD5

    15d8ede0a816bc7a9838207747c6620c

    SHA1

    f6e2e75f1277c66e282553ae6a22661e51f472b8

    SHA256

    dbb8f45730d91bffff8307cfdf7c82e67745d84cb6063a1f3880fadfad59c57d

    SHA512

    39c75f8e0939275a69f8d30e7f91d7ca06af19240567fb50e441a0d2594b73b6a390d11033afb63d68c86c89f4e4bf39b3aca131b30f640d21101dc414e42c97

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\KFOmCnqEu92Fr1Mu7WxKOzY[1].woff2

    Filesize

    5KB

    MD5

    a835084624425dacc5e188c6973c1594

    SHA1

    1bef196929bffcabdc834c0deefda104eb7a3318

    SHA256

    0dfa6a82824cf2be6bb8543de6ef56b87daae5dd63f9e68c88f02697f94af740

    SHA512

    38f2764c76a545349e8096d4608000d9412c87cc0cb659cf0cf7d15a82333dd339025a4353b9bd8590014502abceb32ca712108a522ca60cbf1940d4e4f6b98a

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\KFOmCnqEu92Fr1Mu7mxKOzY[1].woff2

    Filesize

    1KB

    MD5

    57993e705ff6f15e722f5f90de8836f8

    SHA1

    3fecc33bac640b63272c9a8dffd3df12f996730b

    SHA256

    836f58544471e0fb0699cb9ddd0fd0138877733a98b4e029fca1c996d4fb038d

    SHA512

    31f92fb495a1a20ab5131493ab8a74449aabf5221e2901915f2cc917a0878bb5a3cbc29ab12324ffe2f0bc7562a142158268c3f07c7dca3e02a22a9ade41721e

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\api[1].js

    Filesize

    870B

    MD5

    e9dec22fcfdf664ec4fa785cc2d8317a

    SHA1

    65b176ba5ab9cac538af82ea4f580c3bf22d0305

    SHA256

    0f0a70b4ff4a326079d0a1063ae8905940ca4e2529ba64169d42952966f9f693

    SHA512

    5781361dd03e3a896504f1c8776a9d862ecd103c67925ae0762fd32128a29730887b336fdf2e4dc2ab5f28bf8a84f1e8a98f94ec7d38191044a56251a29d0b55

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\KKENGRF2\webworker[1].js

    Filesize

    102B

    MD5

    487a5328afcf6c20ddc11ca1b46a4a44

    SHA1

    f37e030501a0a3ff828bef96481ac1c71043999f

    SHA256

    de9539c3628315c1a7d33dc3e09dd75767bce3868c188cdc7c90ff207da0fec3

    SHA512

    71e22ba1a7bcab2f7ddce3153eee1cd961de32a9000c94a59f097cecac9918e94b4cfbd944081a1df4a594f20193bcb39fa7323b3e519e5d5956c342908dc53d

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\KFOlCnqEu92Fr1MmYUtfABc4EsA[1].woff2

    Filesize

    9KB

    MD5

    797d1a46df56bba1126441693c5c948a

    SHA1

    01f372fe98b4c2b241080a279d418a3a6364416d

    SHA256

    c451e5cf6b04913a0bc169e20eace7dec760ba1db38cdcc343d8673bb221dd00

    SHA512

    99827a3fab634b2598736e338213e1041ef26108a1607be294325d90a6ba251a947fd06d8cb0a2104b26d7fe9455feb9088a79fe515be1896c994c5850705edc

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\KFOlCnqEu92Fr1MmYUtfBBc4[1].woff2

    Filesize

    14KB

    MD5

    19b7a0adfdd4f808b53af7e2ce2ad4e5

    SHA1

    81d5d4c7b5035ad10cce63cf7100295e0c51fdda

    SHA256

    c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd

    SHA512

    49da16000687ac81fc4ca9e9112bdca850bb9f32e0af2fe751abc57a8e9c3382451b50998ceb9de56fc4196f1dc7ef46bba47933fc47eb4538124870b7630036

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\KFOlCnqEu92Fr1MmYUtfBxc4EsA[1].woff2

    Filesize

    7KB

    MD5

    585f849571ef8c8f1b9f1630d529b54d

    SHA1

    162c5b7190f234d5f841e7e578b68779e2bf48c2

    SHA256

    c6dcdefaa63792f3c29abc520c8a2c0bc6e08686ea0187c9baac3d5d329f7002

    SHA512

    1140c4b04c70a84f1070c27e8e4a91d02fda4fc890877900c53cfd3a1d8908b677a412757061de43bc71022dfdd14288f9db0852ef6bf4d2c1615cb45628bebc

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\KFOlCnqEu92Fr1MmYUtfCBc4EsA[1].woff2

    Filesize

    1KB

    MD5

    7cbd23921efe855138ad68835f4c5921

    SHA1

    78a3ae9ec08f2cf8ebb791a2331b33a03ab8cc76

    SHA256

    8eaae4c8680e993b273145315c76a9a278f696467c426637d4beab8cb3dc4a3d

    SHA512

    d8a4db91d2063273d31f77728b44557612b85f51143973caa3cfd60ab18f8c3e4b8cdaab43af843fe29441cd1d8299bf2f139a78e47bf740277b33a377377177

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\KFOlCnqEu92Fr1MmYUtfCRc4EsA[1].woff2

    Filesize

    14KB

    MD5

    e904f1745726f4175e96c936525662a7

    SHA1

    af4e9ee282fea95be6261fc35b2accaed24f6058

    SHA256

    65c7b85c92158adb2d71bebe0d6dfb31ab34de5e7d82134fe1aa4eba589fc296

    SHA512

    7a279d41c8f60806c2253cba5b399be7add861bd15bf0ac4fa7c96fa1eee6557bf1ebd684e909086d9292739f27fa18947af5c98f4920fe00da3acf209c6260a

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\KFOlCnqEu92Fr1MmYUtfChc4EsA[1].woff2

    Filesize

    11KB

    MD5

    29542ac824c94a70cb8abdeef41cd871

    SHA1

    df5010dad18d6c8c0ad66f6ff317729d2c0090ba

    SHA256

    63ef838f895e018722b60f6e7e1d196ff3d90014c70465703fc58e708e83af64

    SHA512

    52f91e02b82f9f27d334704b62a78e746c80023ee8882b96cb24cb4043f9a256f395d24830b1f4513bd7597f8c564af20db9c715ab014eb2ab752fd697156591

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\KFOmCnqEu92Fr1Mu4mxK[1].woff2

    Filesize

    14KB

    MD5

    5d4aeb4e5f5ef754e307d7ffaef688bd

    SHA1

    06db651cdf354c64a7383ea9c77024ef4fb4cef8

    SHA256

    3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

    SHA512

    7eb7c301df79d35a6a521fae9d3dccc0a695d3480b4d34c7d262dd0c67abec8437ed40e2920625e98aaeafba1d908dec69c3b07494ec7c29307de49e91c2ef48

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\REES9JN5\KFOmCnqEu92Fr1Mu72xKOzY[1].woff2

    Filesize

    15KB

    MD5

    e3836d1191745d29137bfe16e4e4a2c2

    SHA1

    4dc8845d97df9cb627d9e6fdd49be1ef9eb9a69c

    SHA256

    98eec6c6fa4dcd4825e48eff334451979afc23cd085aea2d45b04dc1259079dd

    SHA512

    9e9ec420cf75bf47a21e59a822e01dc89dcf97eec3cc117c54ce51923c9a6f2c462355db1bc20cdf665ef4a5b40ffcfa9c8cee05bb5e112c380038bfef29c397

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\07C83F77\www.google[1].xml

    Filesize

    95B

    MD5

    8d076b502373401140711daf74f4b8a5

    SHA1

    e827a2d39acd14630fd47157edcf0b312cc52820

    SHA256

    cfcba3ca439544b19141407429b61546be4df79fcaaf71ff25e832e301608a98

    SHA512

    03237cfe2e3dc536e3bde2fd5ae55830db125611eea4d78dae639b91da32001304b63a320d8390ed3b9598bdecb1f914ef570a793419545376ce5a1d43784b71

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    157082b65ad9c3f8dc7e23e0f0fe38aa

    SHA1

    a008731e3c20d507458ea6fa5d063a78a0a12d8b

    SHA256

    fc88707e5e8307869688fb96bdec9e85d630c5bea3eabbef0df67d7989fe1ad2

    SHA512

    fbb691afdef2fbedd432a8c84c0e0766534b626094d0dc96724d0c3e4e3d3047b596b409a85b33096e47f53efed5d8ad74a752569367751682916cdac85da145

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_6FECED388A0018EC91E0052A44417642

    Filesize

    471B

    MD5

    25896e222f5514fca82f66dacd2daaf8

    SHA1

    37b8a261af87de05afca4c1149c8027a01c88322

    SHA256

    06704b0c124973002bb187fe80cae31528c62d2348d3a3a83c1a11ef7538acb3

    SHA512

    a3337ae86d4a7244fbb346f44760ea5feea1421eda2fa25524039dee4917902f9dc8cc62b55a134c8a20453beab407ef5b10ceebb4a10906e1a86730d871533f

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    ea56fe5d9e6fe17d241ef9fcad2764ff

    SHA1

    9bf0570c7d6dea303f8c74f12d4fcd85e532e084

    SHA256

    0543f88c0964c479922775ad025e15e2febc19eaf08beae4dca4f634b2f50b87

    SHA512

    165b1ed56d2115cead19f52c2544d4dee430ba72d40749d59ecb6757e028ec60e936b01d80314302c00271413a0c85a3897a685f708589540d059449d83e4c89

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    c904cbe5299f1c22ff00ce8cace84806

    SHA1

    dab03eb534bad279bd3fdf6dec00d634d6709a25

    SHA256

    121998e62e2a09483692b592b5e53905222011ddf41c59f61b896591ba78d04e

    SHA512

    dbd3990f2984cfe8196ea2ea02835a773edc89e896c4348644f85304a570838ea317aa72b17aece17b26505a5697973f4dea82fcc2361ab1de5bae1fbe81ce1b

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_6FECED388A0018EC91E0052A44417642

    Filesize

    406B

    MD5

    256cfb25d0f2f2ac8a386bf6688795ad

    SHA1

    b509641d0317fb4164f43b24c4f1551e3beb95c6

    SHA256

    90be3aefc00e898180e269845305129bcfc8934c395c40630e5e51afe9d1f482

    SHA512

    63fda712f260fdf6b9a617254e794195fd2bc9e8c4cf47a2d4ddbca3f88a0f47da35f630d59121522793ef0bc2bfc7c71e98b57910504dc81337c64297ee16d8

  • C:\Users\Admin\AppData\Local\Temp\32.exe

    Filesize

    1.2MB

    MD5

    568d17d6da77a46e35c8094a7c414375

    SHA1

    500fa749471dad4ae40da6aa33fd6b2a53bcf200

    SHA256

    0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615

    SHA512

    7beb044f8bd366350b267c0fedc8466d2c5fd80b0f791f5697ce4577edced36b668401fd48df90b6c4ced05247d990c5e739e7232a2dcfc059dcc0c6a79d9427

  • C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

    Filesize

    14KB

    MD5

    19dbec50735b5f2a72d4199c4e184960

    SHA1

    6fed7732f7cb6f59743795b2ab154a3676f4c822

    SHA256

    a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

    SHA512

    aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

  • C:\Users\Admin\AppData\Local\Temp\rig.exe

    Filesize

    2.4MB

    MD5

    570a9cc9fd20159e92707abe69676299

    SHA1

    864cb610c0c80cf8ff00fd4aaae9b05fa63fd990

    SHA256

    ba52bd426e17cf8902ae05eb8caea7e0510d668db97dedd2cabcd1dc5a06063f

    SHA512

    ba11d2e1888f736d1934e78db6397ae04ea49422beb7392575422ea51cd459ac9b0c8a274397ab828792728364d145c16fc2390242a17a56a8ad02fa4c580f92

  • C:\note.txt

    Filesize

    218B

    MD5

    afa6955439b8d516721231029fb9ca1b

    SHA1

    087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

    SHA256

    8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

    SHA512

    5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

  • memory/876-113-0x00000203C59A0000-0x00000203C5AA0000-memory.dmp

    Filesize

    1024KB

  • memory/876-109-0x00000203C51A0000-0x00000203C51A2000-memory.dmp

    Filesize

    8KB

  • memory/876-111-0x00000203C51C0000-0x00000203C51C2000-memory.dmp

    Filesize

    8KB

  • memory/876-106-0x00000203C5150000-0x00000203C5152000-memory.dmp

    Filesize

    8KB

  • memory/1132-49-0x0000000000400000-0x000000000052A000-memory.dmp

    Filesize

    1.2MB

  • memory/1132-24-0x00000000005E0000-0x00000000005F9000-memory.dmp

    Filesize

    100KB

  • memory/1132-28-0x00000000005E0000-0x00000000005F9000-memory.dmp

    Filesize

    100KB

  • memory/1620-22-0x0000000002050000-0x0000000002069000-memory.dmp

    Filesize

    100KB

  • memory/1620-18-0x0000000002050000-0x0000000002069000-memory.dmp

    Filesize

    100KB

  • memory/3204-93-0x0000021952AB0000-0x0000021952AB2000-memory.dmp

    Filesize

    8KB

  • memory/3204-58-0x0000021953920000-0x0000021953930000-memory.dmp

    Filesize

    64KB

  • memory/3204-74-0x0000021953A20000-0x0000021953A30000-memory.dmp

    Filesize

    64KB

  • memory/3212-38-0x00000000006B0000-0x00000000006C9000-memory.dmp

    Filesize

    100KB

  • memory/3212-42-0x00000000006B0000-0x00000000006C9000-memory.dmp

    Filesize

    100KB

  • memory/4008-44-0x0000000000F60000-0x0000000000F79000-memory.dmp

    Filesize

    100KB

  • memory/4008-48-0x0000000000F60000-0x0000000000F79000-memory.dmp

    Filesize

    100KB

  • memory/4700-1-0x00000000007F0000-0x0000000000B92000-memory.dmp

    Filesize

    3.6MB

  • memory/4700-0-0x00007FFE454A3000-0x00007FFE454A4000-memory.dmp

    Filesize

    4KB

  • memory/4880-29-0x00000000005E0000-0x00000000005E1000-memory.dmp

    Filesize

    4KB

  • memory/4880-30-0x0000000000950000-0x0000000000E9D000-memory.dmp

    Filesize

    5.3MB