hxxps://gofile[.]io/d/SumR83

Analysis

max time kernel
84s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/SumR83

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ZYwWBaAJnxrIYUOjuvi\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\ZYwWBaAJnxrIYUOjuvi"	map.exe

Executes dropped EXE 2 IoCs

pid	Process
3108	map.exe
2724	HAZE.exe

Loads dropped DLL 1 IoCs

pid	Process
2724	HAZE.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2724	HAZE.exe
2724	HAZE.exe
2724	HAZE.exe
2724	HAZE.exe
2724	HAZE.exe
2724	HAZE.exe
2724	HAZE.exe
2724	HAZE.exe
2724	HAZE.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
844	msedge.exe
844	msedge.exe
2668	msedge.exe
2668	msedge.exe
2440	identity_helper.exe
2440	identity_helper.exe
4324	msedge.exe
4324	msedge.exe
3108	map.exe
3108	map.exe
2724	HAZE.exe
2724	HAZE.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	HAZE.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3108	map.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4184	7zG.exe
Token: 35	4184	7zG.exe
Token: SeSecurityPrivilege	4184	7zG.exe
Token: SeSecurityPrivilege	4184	7zG.exe
Token: SeLoadDriverPrivilege	3108	map.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
4184	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3108	map.exe
2724	HAZE.exe
2724	HAZE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1208	2668	msedge.exe	86
PID 2668 wrote to memory of 1208	2668	msedge.exe	86
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 4864	2668	msedge.exe	87
PID 2668 wrote to memory of 844	2668	msedge.exe	88
PID 2668 wrote to memory of 844	2668	msedge.exe	88
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89
PID 2668 wrote to memory of 716	2668	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/SumR83
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b2d46f8,0x7ff82b2d4708,0x7ff82b2d4718
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,15313558060273581627,8362212525787163374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2804

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\HAZE\" -spe -an -ai#7zMap12848:70:7zEvent7873
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4184

C:\Users\Admin\Downloads\HAZE\map.exe
"C:\Users\Admin\Downloads\HAZE\map.exe" C:\Users\Admin\Downloads\HAZE\dragmeonmap.sys
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3108

C:\Users\Admin\Downloads\HAZE\HAZE.exe
"C:\Users\Admin\Downloads\HAZE\HAZE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2724

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\HAZE\logs\2024-08-13.txt
1⤵
PID:4972

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\HAZE\logs\2024-08-13.txt
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
c3215ddf07a2c0a553538510648ec4c9

SHA1
6d6b91014968699505a766324e8ec2968c6a6686

SHA256
b472c2ea809b3458e3354ce5f56a70fc6aa464ad9a098e5d4d61016dd003cfaf

SHA512
401c02ad8da1a3b9fb1bc1588c4c9e5dbf6358ccf26863179f9685c78b78c66f0f8a414aa7582e7b1e7d84392fddedcd1d01166fafb578660ea02f749564f5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
5f05b26e0caccbee54089cb0044220cc

SHA1
e76ead734684a93a820d05c76824d5445f28f584

SHA256
256bcc760870f0a18774ed0999652be257776a2049eba989bda8f359b1507dcc

SHA512
29ecfa0586aaf62f2e6a90d2623fb01c7bb156993f2ed00085d8dcc97026b48aad69f27855cf3231d6f3d5c388a81367ec9e27ea47cefd50c530d08862292dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3da75cac574177e1b03285f72faac97

SHA1
f3e8ec951cc9ce9723b5e7a6d22aa0e151e6acf4

SHA256
4bb60593ba688bc2a11b9642d38ce4d885284ba9ae4cc33e05fceb059282d74f

SHA512
25a8b7895d776cb0bd2bfbfa6a46802d8ab0262ca040616c33fcd9d8a2856cf1b0177a67d4374579e546d0f95e908428a77b3056158c0dcf6553769f0036a95c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ed4d8d0600e3f436e02aa0425bfd4d58

SHA1
ed0634123393e6a5fb8f4e5a68966c79a1c3a1a8

SHA256
d041a7c60844764f84a1a4a40e97c4743a59deec16c69e2d1a45587d65c747ab

SHA512
a42535b96f5ea30a177e490c28901ac5788cb329644696557f0cd56ae729e49ac717b51fca77a0d5ac858263d69f45c85b72cf1498c985115a5957cde691e159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2cbe2e9639a9737d4b63bb863bc8c15

SHA1
9d28476a48ba324dde30a89d658b16338efb4cef

SHA256
366f1a7da7af0624365030ec4ef1931c2923ef09dbf5f9ca7cddf978a0f66731

SHA512
20ce67ba29f4ee2323430009bfcf05fb5f3045b36e67dbe44a17c4f129c766046327d594ea7bb2ca8cb125bf7376f1068cfbd6a04e52bada5521b3305e852d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7ba02569557fc2618a0056d6106277f4

SHA1
4d716ba2d2869ae801cc1494516a44e7d003981c

SHA256
632c46639fe6001ba671496dea17c9d948da86127b8855d768da2b0661e01476

SHA512
f5ea0f85df826820adfad507a5d2aa8765b25d6e9f38a3dc0bcbb1287d0a6980cee76edef3035d0b859673c929bf8066683fb88dbb98d975f5e183c2ec694563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab55a5a37c9f72f77e2297436f2028d0

SHA1
274787ac5662549065a7b14e0e9a32f2dc6c32b2

SHA256
2a3beeefa793257f0db86700c3dd7d2f73d962c4c4799bc71c78a100294932fc

SHA512
d14de9767f7a78dc2cca3df8586e5cda72e7144f42d287bfc7d9266f107b00be20ce6a5aa2c018884ce8b4aa6c1c3066789b02cd7424799b987008415e1da7d1

Download Submit
C:\Users\Admin\Downloads\HAZE\HAZE.exe

Filesize
941KB

MD5
849cbc1102addf6dd5c4d0e636723228

SHA1
7737fdcf51b5dee308712905846916bd715caecb

SHA256
f66d67a1d69fddba1b25f1d7583d6994acdb6f7a495b74c3515ecbf1a7dedee2

SHA512
572e535824306db161c8f653eab899f130f72a125d9305934c30dcac85df4ff7d2d65a9aa41c737299e25253ff2d65015772722382fe3923f39d859219285371

Download Submit
C:\Users\Admin\Downloads\HAZE\Sentinal.dll

Filesize
3.9MB

MD5
cf5fda1890a753824da748c79eb3866d

SHA1
c12f394cb6ae7ca05574eadfd460ea2c73e5e11d

SHA256
a8731ebb223fee40d6629fcf09df88829853f916ca48a190fd9069294e263615

SHA512
4a18cc36ba6155cb1d0b95cec71ffa69fcdfe51311fee5cfd8a73034bb795b72a9808b4ac130cf13331b37e96150a7c850be3ee580fabdcb117cbcc2f459b89d

Download Submit
C:\Users\Admin\Downloads\HAZE\logs\2024-08-13.txt

Filesize
97B

MD5
cec39d9873788a7c2b479bec95aa42fa

SHA1
0840f28f12553afd706dfcb45c0ae2d1d6261fb9

SHA256
9dbbd40a1cd31efe24bc2657c69dce97c452cbc2bba9c1428fed7fb3df53f115

SHA512
02d9497cea6882c5b6cef7b1dc2e2840dffa8850ba5ad5ff81ef2f61792f46e29a508cf6111deddd8d9d8b07cf4a2efc56268a121bc437885e10f7287615ea79

Download Submit
C:\Users\Admin\Downloads\HAZE\map.exe

Filesize
143KB

MD5
7c7a7dfc50c8fc83b4124ff4a624bfe6

SHA1
d0b1ab52b2e10fd282ff60fcba015d694b27477e

SHA256
6cc854c5e4a8c6d9d0af31db0b6b267b3cbecca9520989e0a7a2eb5d861a18ca

SHA512
9eaf8af7dce8103933503a935434eafc20bd288a44c86c3e71fc4489df5bc52dac640c117ead7ea6ae46a13f4ff61cc13e810ad25ecaa5dbbfab00773fbfa414

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 181521.crdownload

Filesize
6.4MB

MD5
3a98192661cca70f90c620bc46cc0d63

SHA1
f8c1b013a083d81d622b13b2cef99a2d3f7861f2

SHA256
07161578e74527f75992bd004a13558cd694c69044b08e287d56dacd0c8837cb

SHA512
a883b83a7eebb8d636beda0ad4a57e6cdd074d5dffc09f5c6c0d195ff7d0ec0f61053aa9eaf906e4d63bc2f48ebfe48ef452fd3fbd32062ee03ffe0347c9e5da

Download Submit
memory/2724-235-0x00007FF819020000-0x00007FF8199F5000-memory.dmp

Filesize
9.8MB

Download
memory/2724-240-0x00007FF819020000-0x00007FF8199F5000-memory.dmp

Filesize
9.8MB

Download
memory/2724-239-0x00007FF819020000-0x00007FF8199F5000-memory.dmp

Filesize
9.8MB

Download
memory/2724-238-0x00007FF819020000-0x00007FF8199F5000-memory.dmp

Filesize
9.8MB

Download
memory/2724-242-0x000002CC89050000-0x000002CC89053000-memory.dmp

Filesize
12KB

Download
memory/2724-237-0x00007FF819020000-0x00007FF8199F5000-memory.dmp

Filesize
9.8MB

Download
memory/2724-241-0x00007FF819020000-0x00007FF8199F5000-memory.dmp

Filesize
9.8MB

Download
memory/2724-236-0x00007FF819020000-0x00007FF8199F5000-memory.dmp

Filesize
9.8MB

Download
memory/2724-243-0x00007FF819020000-0x00007FF8199F5000-memory.dmp

Filesize
9.8MB

Download
memory/2724-245-0x00007FF819020000-0x00007FF8199F5000-memory.dmp

Filesize
9.8MB

Download