emotet | e65878b615947fcf75baee636c9a2012e28873beb43b8b0250bd9af4b11339ba

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NiggerDick.exe
Size

3.6MB
MD5

edcd9b037986143a8bad4985bf0e661d
SHA1

aa7ad22502f138c9ef68b6e66f50999ed94c7276
SHA256

e65878b615947fcf75baee636c9a2012e28873beb43b8b0250bd9af4b11339ba
SHA512

3f62163ae6bb81dc59e23c6ad5192de1fd0bfe7e6e85e4420119e314b48c7431bdd368c841f802c858aee67a45b88959ce32f961de9a8e965cc47cf7b946ea9c
SSDEEP

49152:8F24+xNyKwdkMRcHwK5+MdqUolO+r8tEAmafrP4iUUYJETGXP6XA:8F24gNyKw6MpMdqpfrjgUi2ETGXM

Score

10^/10

emotet privateloader xmrig banker discovery loader miner trojan vmprotect

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 3 IoCs

miner

Processes:

resource	yara_rule
behavioral2/files/0x00090000000233eb-6.dat	xmrig
behavioral2/memory/4760-46-0x0000000000450000-0x000000000099D000-memory.dmp	xmrig
behavioral2/memory/4760-71-0x0000000000450000-0x000000000099D000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MEMZ-Destructive.exeMEMZ-Destructive.exeNiggerDick.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	NiggerDick.exe

Executes dropped EXE 12 IoCs

Processes:

rig.exeMEMZ-Destructive.exe32.exe32.exepremiummonjpn.exepremiummonjpn.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exe

pid	Process
4760	rig.exe
2456	MEMZ-Destructive.exe
1908	32.exe
4028	32.exe
3512	premiummonjpn.exe
3164	premiummonjpn.exe
404	MEMZ-Destructive.exe
2808	MEMZ-Destructive.exe
1740	MEMZ-Destructive.exe
2756	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
2388	MEMZ-Destructive.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/files/0x00090000000233eb-6.dat	vmprotect
behavioral2/memory/4760-46-0x0000000000450000-0x000000000099D000-memory.dmp	vmprotect
behavioral2/memory/4760-71-0x0000000000450000-0x000000000099D000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

Processes:

mmc.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe

Drops file in Windows directory 57 IoCs

Processes:

mmc.exe

description	ioc	Process
File created	C:\Windows\INF\digitalmediadevice.PNF	mmc.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	mmc.exe
File created	C:\Windows\INF\c_fsencryption.PNF	mmc.exe
File created	C:\Windows\INF\c_apo.PNF	mmc.exe
File created	C:\Windows\INF\oposdrv.PNF	mmc.exe
File created	C:\Windows\INF\rawsilo.PNF	mmc.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	mmc.exe
File created	C:\Windows\INF\c_fshsm.PNF	mmc.exe
File created	C:\Windows\INF\remoteposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_fsreplication.PNF	mmc.exe
File created	C:\Windows\INF\c_processor.PNF	mmc.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	mmc.exe
File created	C:\Windows\INF\c_camera.PNF	mmc.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	mmc.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystem.PNF	mmc.exe
File created	C:\Windows\INF\c_firmware.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	mmc.exe
File created	C:\Windows\INF\c_volume.PNF	mmc.exe
File created	C:\Windows\INF\ts_generic.PNF	mmc.exe
File created	C:\Windows\INF\miradisp.PNF	mmc.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_fscompression.PNF	mmc.exe
File created	C:\Windows\INF\c_display.PNF	mmc.exe
File created	C:\Windows\INF\c_proximity.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	mmc.exe
File created	C:\Windows\INF\c_mcx.PNF	mmc.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	mmc.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	mmc.exe
File created	C:\Windows\INF\c_linedisplay.PNF	mmc.exe
File created	C:\Windows\INF\c_netdriver.PNF	mmc.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	mmc.exe
File created	C:\Windows\INF\c_extension.PNF	mmc.exe
File created	C:\Windows\INF\c_ucm.PNF	mmc.exe
File created	C:\Windows\INF\c_fsundelete.PNF	mmc.exe
File created	C:\Windows\INF\c_diskdrive.PNF	mmc.exe
File created	C:\Windows\INF\c_media.PNF	mmc.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	mmc.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	mmc.exe
File created	C:\Windows\INF\c_smrdisk.PNF	mmc.exe
File created	C:\Windows\INF\wsdprint.PNF	mmc.exe
File created	C:\Windows\INF\c_scmdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_swcomponent.PNF	mmc.exe
File created	C:\Windows\INF\c_holographic.PNF	mmc.exe
File created	C:\Windows\INF\xusb22.PNF	mmc.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	mmc.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	mmc.exe
File created	C:\Windows\INF\c_scmvolume.PNF	mmc.exe
File created	C:\Windows\INF\rdcameradriver.PNF	mmc.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	mmc.exe
File created	C:\Windows\INF\dc1-controller.PNF	mmc.exe
File created	C:\Windows\INF\c_sslaccel.PNF	mmc.exe
File created	C:\Windows\INF\c_monitor.PNF	mmc.exe
File created	C:\Windows\INF\c_smrvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	mmc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rig.exeMEMZ-Destructive.exepremiummonjpn.exenotepad.exenotepad.exe32.exe32.exeMEMZ-Destructive.exepremiummonjpn.exemmc.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	premiummonjpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	premiummonjpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

mmc.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

MEMZ-Destructive.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	MEMZ-Destructive.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

32.exe32.exerig.exepremiummonjpn.exepremiummonjpn.exe

pid	Process
1908	32.exe
1908	32.exe
4028	32.exe
4028	32.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
3512	premiummonjpn.exe
3512	premiummonjpn.exe
3164	premiummonjpn.exe
3164	premiummonjpn.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe
4760	rig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

mmc.exe

pid	Process
4612	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

rig.exemmc.exeAUDIODG.EXE

description	pid	Process
Token: SeLockMemoryPrivilege	4760	rig.exe
Token: SeLockMemoryPrivilege	4760	rig.exe
Token: 33	4612	mmc.exe
Token: SeIncBasePriorityPrivilege	4612	mmc.exe
Token: 33	4612	mmc.exe
Token: SeIncBasePriorityPrivilege	4612	mmc.exe
Token: 33	5932	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5932	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

mmc.exemmc.exe

pid	Process
3020	mmc.exe
4612	mmc.exe
4612	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NiggerDick.exe32.exepremiummonjpn.exeMEMZ-Destructive.exemmc.exemsedge.exe

description	pid	Process	procid_target
PID 2004 wrote to memory of 4760	2004	NiggerDick.exe	83
PID 2004 wrote to memory of 4760	2004	NiggerDick.exe	83
PID 2004 wrote to memory of 4760	2004	NiggerDick.exe	83
PID 2004 wrote to memory of 2456	2004	NiggerDick.exe	84
PID 2004 wrote to memory of 2456	2004	NiggerDick.exe	84
PID 2004 wrote to memory of 2456	2004	NiggerDick.exe	84
PID 2004 wrote to memory of 1908	2004	NiggerDick.exe	85
PID 2004 wrote to memory of 1908	2004	NiggerDick.exe	85
PID 2004 wrote to memory of 1908	2004	NiggerDick.exe	85
PID 1908 wrote to memory of 4028	1908	32.exe	86
PID 1908 wrote to memory of 4028	1908	32.exe	86
PID 1908 wrote to memory of 4028	1908	32.exe	86
PID 3512 wrote to memory of 3164	3512	premiummonjpn.exe	93
PID 3512 wrote to memory of 3164	3512	premiummonjpn.exe	93
PID 3512 wrote to memory of 3164	3512	premiummonjpn.exe	93
PID 2456 wrote to memory of 404	2456	MEMZ-Destructive.exe	99
PID 2456 wrote to memory of 404	2456	MEMZ-Destructive.exe	99
PID 2456 wrote to memory of 404	2456	MEMZ-Destructive.exe	99
PID 2456 wrote to memory of 2808	2456	MEMZ-Destructive.exe	100
PID 2456 wrote to memory of 2808	2456	MEMZ-Destructive.exe	100
PID 2456 wrote to memory of 2808	2456	MEMZ-Destructive.exe	100
PID 2456 wrote to memory of 1740	2456	MEMZ-Destructive.exe	101
PID 2456 wrote to memory of 1740	2456	MEMZ-Destructive.exe	101
PID 2456 wrote to memory of 1740	2456	MEMZ-Destructive.exe	101
PID 2456 wrote to memory of 2756	2456	MEMZ-Destructive.exe	102
PID 2456 wrote to memory of 2756	2456	MEMZ-Destructive.exe	102
PID 2456 wrote to memory of 2756	2456	MEMZ-Destructive.exe	102
PID 2456 wrote to memory of 1924	2456	MEMZ-Destructive.exe	103
PID 2456 wrote to memory of 1924	2456	MEMZ-Destructive.exe	103
PID 2456 wrote to memory of 1924	2456	MEMZ-Destructive.exe	103
PID 2456 wrote to memory of 2388	2456	MEMZ-Destructive.exe	104
PID 2456 wrote to memory of 2388	2456	MEMZ-Destructive.exe	104
PID 2456 wrote to memory of 2388	2456	MEMZ-Destructive.exe	104
PID 3020 wrote to memory of 4612	3020	mmc.exe	111
PID 3020 wrote to memory of 4612	3020	mmc.exe	111
PID 4180 wrote to memory of 1356	4180	msedge.exe	114
PID 4180 wrote to memory of 1356	4180	msedge.exe	114
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115
PID 4180 wrote to memory of 4000	4180	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\NiggerDick.exe
"C:\Users\Admin\AppData\Local\Temp\NiggerDick.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\rig.exe
  "C:\Users\Admin\AppData\Local\Temp\rig.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:2808
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2388
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:3240
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe2f7346f8,0x7ffe2f734708,0x7ffe2f734718
        5⤵
        
        PID:1356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:4000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
        5⤵
        
        PID:1884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
        5⤵
        
        PID:4852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
        5⤵
        
        PID:2036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        5⤵
        
        PID:4884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
        5⤵
        
        PID:5116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
        5⤵
        
        PID:1848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
        5⤵
        
        PID:2104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
        5⤵
        
        PID:1708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
        5⤵
        
        PID:3296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
        5⤵
        
        PID:4920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
        5⤵
        
        PID:4212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
        5⤵
        
        PID:244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
        5⤵
        
        PID:5544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,748409106211841672,275309615345531879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
        5⤵
        
        PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
      4⤵
      PID:5480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe2f7346f8,0x7ffe2f734708,0x7ffe2f734718
        5⤵
        
        PID:5492
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5416
- C:\Users\Admin\AppData\Local\Temp\32.exe
  "C:\Users\Admin\AppData\Local\Temp\32.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Users\Admin\AppData\Local\Temp\32.exe
    "C:\Users\Admin\AppData\Local\Temp\32.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4028

C:\Windows\SysWOW64\premiummonjpn.exe
"C:\Windows\SysWOW64\premiummonjpn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\premiummonjpn.exe
  "C:\Windows\SysWOW64\premiummonjpn.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1592

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x45c 0x4e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c7d17f7a29b2187dc6ed54131f37b380

SHA1
0752830e42ed3f652cdb60a1c2bb89174630d10e

SHA256
37a06b02bb38c349d00797ed533dad3bb23ead07af379ec5596c0c2da562648b

SHA512
7ede362c69bbbec544bde595cc313b403f1d2b3f0637f773e6ea82ba2a2e077d78cdfe759e83491ac4df4988fbd114b8c5e4742852d98b07ba37801dd71dfb55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
8e8bab069c53280affdb24778ebac918

SHA1
d2042d2a5716ebae2c66aca01c580bb8f8742db4

SHA256
09daf942b2425e63683cf9ead5cfcaf3953b56172b842949621c07b9584049a3

SHA512
bd303d30b34fd03c4fbfc510ab8f0fcef8633781013d17ddc5fc1571455abb5c96d6fd01749d6b6532e98b8dfd15d6a76b92415fbae5bbc6ff9a9ddfd3e20cd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
815B

MD5
214386e7d7eca1c41deb8b0f426fa5bd

SHA1
1ff4856b4bf2d3c5097db7dd521f34187804743c

SHA256
967d466f43382f410e75ad662744a1db7ce4b82aa2b2794a2bac700fba66ec72

SHA512
39487f1b60a4e7a8756212cb95e96c0c4235a99ca7ee480fdee924d48c0b11c2cf37634e555ad97e8ccb2f4561934626109b8839224ac7e23c31469460decd8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
594e8c8bd8d8c9e42ec9825c07d358ff

SHA1
7e1cbd1d6e3e27f5adb0a5f38214fdd67b81a71d

SHA256
61dd8bb1e191908b762646022158542ef4057d96f8b457bb5a7dc4ccfb0aa42b

SHA512
216e9595840562f53237eed21878e102567e94e362c40866b2e5ed350b00e92c0c04a6ff561a058f23c01e6154cc0d4b0ac780f2e31fb1675fd109457196ab80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e7b6bb5f6b5f91d859b4539e59614fa

SHA1
92fb186a10e7b352fc57cf81260a1e6d80be3aae

SHA256
9fc1422cb288486a9d1bea91fd39afe357d0b65aad9ff972316f38928b0d7afb

SHA512
4ba45c1c5ab711a7f1df2ad62ebbee3921ae38434356cbdb0820fb46dd5972640466a672cc152fe2fa6df1bf7aa83ca7743635743effacca87cec78ceddc1de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af6828e02f433961f72564fe310f041c

SHA1
a98b5edaed7eb52da3ec8b5475b88102f12263d5

SHA256
4002ce4290e4ed83bc7c60fecfecf865aeb9f544154d31303e9e3fe16339a0ea

SHA512
d68ff3d3a9cbcd430786b654aeffb80cc5f10f34ac1dc8233e0e6d5b11a68e720c3b01d54b1b9261c532829b91cc5915294eaf60f58a47b0592e88c9140b0211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
032603f2b51559a9ef42f10d302de219

SHA1
f936d1ee618b75907776d39eb2dddea3bb3cf6d5

SHA256
8e6d04e3e339c95e6492861b587092f77fc4d1035f9d0826a892af8cd5a7de6a

SHA512
c9059c2e266966f1c80740d107274f706bb984e21e8df5abf8ac7e2fdc3ba1833da49e1cc45451eb85bd2646b395d081e3f8325e4dbfe1022a29a483cc0c3ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
26222a37d76d214f8e09cec5a599bc89

SHA1
cbd99101ada3cd9bfbe39bdf4f674af420f07011

SHA256
022bd590b940cd029d2a0b20dc91f695c55655910187b631e32ce85c78aba93a

SHA512
7a5bf04e770e7fb89f404753a2715391bcfdab67381e95fc09024f134321e1786a96756d533fd6af0fe67fde8a667a46f6d2be8347cddbcf2cc2adfcc37985ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7caf077c1e3d1187acfea859ef0b2994

SHA1
266701d284d21090ded587ac01fa6f8dcb83fe37

SHA256
04deb4cdf525b38ab91f14d3ef55d5c8cd6e000b38676f919b4ba4f29ce02d9e

SHA512
3c96709acf7835d61ae9bba2b83024b9ff359500cf00eececfd2491280c8d6406b1a5b483565d07c09a73273a9a692d46aaad13f71ddad647431abc2a5ec002a

Download Submit
C:\Users\Admin\AppData\Local\Temp\32.exe

Filesize
1.2MB

MD5
568d17d6da77a46e35c8094a7c414375

SHA1
500fa749471dad4ae40da6aa33fd6b2a53bcf200

SHA256
0da56126ffb57acb5bb1a3ffa1c4c0c2605d257988b2d2964344b8f23173f615

SHA512
7beb044f8bd366350b267c0fedc8466d2c5fd80b0f791f5697ce4577edced36b668401fd48df90b6c4ced05247d990c5e739e7232a2dcfc059dcc0c6a79d9427

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\rig.exe

Filesize
2.4MB

MD5
570a9cc9fd20159e92707abe69676299

SHA1
864cb610c0c80cf8ff00fd4aaae9b05fa63fd990

SHA256
ba52bd426e17cf8902ae05eb8caea7e0510d668db97dedd2cabcd1dc5a06063f

SHA512
ba11d2e1888f736d1934e78db6397ae04ea49422beb7392575422ea51cd459ac9b0c8a274397ab828792728364d145c16fc2390242a17a56a8ad02fa4c580f92

Download Submit
\??\pipe\LOCAL\crashpad_4180_NAHMPUQQQRSHCQLU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1908-35-0x0000000002160000-0x0000000002179000-memory.dmp

Filesize
100KB

Download
memory/1908-36-0x00000000007B0000-0x00000000007C0000-memory.dmp

Filesize
64KB

Download
memory/1908-34-0x0000000002180000-0x0000000002199000-memory.dmp

Filesize
100KB

Download
memory/1908-30-0x0000000002180000-0x0000000002199000-memory.dmp

Filesize
100KB

Download
memory/2004-0-0x00007FFE318B3000-0x00007FFE318B5000-memory.dmp

Filesize
8KB

Download
memory/2004-1-0x0000000000510000-0x00000000008B2000-memory.dmp

Filesize
3.6MB

Download
memory/3164-60-0x0000000000F70000-0x0000000000F89000-memory.dmp

Filesize
100KB

Download
memory/3164-63-0x0000000000F70000-0x0000000000F89000-memory.dmp

Filesize
100KB

Download
memory/3512-53-0x0000000000E40000-0x0000000000E59000-memory.dmp

Filesize
100KB

Download
memory/3512-57-0x0000000000E40000-0x0000000000E59000-memory.dmp

Filesize
100KB

Download
memory/4028-42-0x0000000002190000-0x00000000021A9000-memory.dmp

Filesize
100KB

Download
memory/4028-38-0x0000000002190000-0x00000000021A9000-memory.dmp

Filesize
100KB

Download
memory/4028-64-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/4760-71-0x0000000000450000-0x000000000099D000-memory.dmp

Filesize
5.3MB

Download
memory/4760-46-0x0000000000450000-0x000000000099D000-memory.dmp

Filesize
5.3MB

Download
memory/4760-43-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download