warzonerat | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

15/08/2024, 17:09

240815-vpll3sxgpr 8

15/08/2024, 17:06

240815-vmgkcashqh 10

15/08/2024, 17:05

240815-vly31ashpc 1

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2024, 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

warzonerat discovery infostealer rat rezer0

Malware Config

Extracted

Family

warzonerat

168.61.222.215:5400

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/5464-646-0x00000000059A0000-0x00000000059C8000-memory.dmp	rezer0

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/3912-653-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/3912-655-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Downloads MZ/PE file

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe

Executes dropped EXE 7 IoCs

pid	Process
5464	WarzoneRAT.exe
1420	WarzoneRAT.exe
5832	WarzoneRAT.exe
4180	WarzoneRAT.exe
4988	WarzoneRAT.exe
5296	WarzoneRAT.exe
5584	WarzoneRAT.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
112	raw.githubusercontent.com
113	raw.githubusercontent.com

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 5464 set thread context of 3912	5464	WarzoneRAT.exe	136
PID 1420 set thread context of 5696	1420	WarzoneRAT.exe	142
PID 5832 set thread context of 4308	5832	WarzoneRAT.exe	146
PID 4180 set thread context of 2228	4180	WarzoneRAT.exe	153
PID 4988 set thread context of 3028	4988	WarzoneRAT.exe	154
PID 5296 set thread context of 1032	5296	WarzoneRAT.exe	162
PID 5584 set thread context of 5140	5584	WarzoneRAT.exe	168

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 485110.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:SmartScreen:$DATA	WarzoneRAT.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3772	schtasks.exe
3996	schtasks.exe
1696	schtasks.exe
2016	schtasks.exe
5792	schtasks.exe
5928	schtasks.exe
4900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
1508	msedge.exe
1508	msedge.exe
2092	identity_helper.exe
2092	identity_helper.exe
4076	msedge.exe
4076	msedge.exe
5464	WarzoneRAT.exe
5464	WarzoneRAT.exe
5464	WarzoneRAT.exe
5464	WarzoneRAT.exe
5464	WarzoneRAT.exe
5464	WarzoneRAT.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
1420	WarzoneRAT.exe
1420	WarzoneRAT.exe
1420	WarzoneRAT.exe
1420	WarzoneRAT.exe
1420	WarzoneRAT.exe
1420	WarzoneRAT.exe
5832	WarzoneRAT.exe
5832	WarzoneRAT.exe
5832	WarzoneRAT.exe
5832	WarzoneRAT.exe
4180	WarzoneRAT.exe
4180	WarzoneRAT.exe
4180	WarzoneRAT.exe
4180	WarzoneRAT.exe
4988	WarzoneRAT.exe
4988	WarzoneRAT.exe
4988	WarzoneRAT.exe
4988	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5296	WarzoneRAT.exe
5584	WarzoneRAT.exe
5584	WarzoneRAT.exe
5584	WarzoneRAT.exe
5584	WarzoneRAT.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5464	WarzoneRAT.exe
Token: SeDebugPrivilege	1420	WarzoneRAT.exe
Token: SeDebugPrivilege	5832	WarzoneRAT.exe
Token: SeDebugPrivilege	4180	WarzoneRAT.exe
Token: SeDebugPrivilege	4988	WarzoneRAT.exe
Token: SeDebugPrivilege	5296	WarzoneRAT.exe
Token: SeDebugPrivilege	5584	WarzoneRAT.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 4020	1508	msedge.exe	85
PID 1508 wrote to memory of 4020	1508	msedge.exe	85
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 4520	1508	msedge.exe	86
PID 1508 wrote to memory of 5100	1508	msedge.exe	87
PID 1508 wrote to memory of 5100	1508	msedge.exe	87
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88
PID 1508 wrote to memory of 4880	1508	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff40046f8,0x7ffff4004708,0x7ffff4004718
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5464
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp56A2.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2016
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2832
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8544978977659851668,15699531280678832760,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2600 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5672
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5E33.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5792
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1460
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5696
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5832
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp62D7.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5928
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp676B.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4900
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp678A.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3772
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3028
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5296
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6DE3.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2308
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4908
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4076

C:\Users\Admin\Downloads\WarzoneRAT.exe
"C:\Users\Admin\Downloads\WarzoneRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5584
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8DA0.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WarzoneRAT.exe.log

Filesize
507B

MD5
8cf94b5356be60247d331660005941ec

SHA1
fdedb361f40f22cb6a086c808fc0056d4e421131

SHA256
52a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0

SHA512
b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f57edc42a9cd677cc21fa0baabc56d57

SHA1
916eb60f7f52d9fe3172afedfec6688b8099292c

SHA256
e351f083f566d452b0e798eccbfbab52ade18e35901816076a684a69d851facd

SHA512
7f42b84e3b95a8a9cd06e90f2af2d240ff3ddd0b3ef2917b902e274722535fa1ce32c883b21545ba92c7bd779a4aceb00ff2461f10e0dbad34b7cc610dd7afd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a90b8daeb5624a684b7675ee3a5ee76f

SHA1
9afe6c6bc17ddd4ea74646e4c0a295a140898e40

SHA256
b41e62a74ad420918816d4757fddf9f061c7c1fc8a9c0aba19066a2319ed113c

SHA512
02aa881cfc771ccb7bf6c85c4b4d4f65285b00ab2deee06506de92785eccf7a61b1dc9e6e75f43ffd5061cd1be75877f654a0c7ed225e69e19c9855985716caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
cdf3386b15a5cba18d20c491daf8e998

SHA1
049dfa31b54d558a7c7d7abdd685e39b4a581275

SHA256
198505d629ef1ef7025d018103a0b4dbf611eeb4d96c4022cbb808680dc72a60

SHA512
65f3de0621e7cc919fcc5d5d8cc7a6b2449121e06937ae9ab27a12a623887ec9e69c6b2a18f7c1b50ea1b18344c0f233c49fd225d65c4896a95cc1723b81d342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
e0fbf689a88a26f0f21d6f7e04999a95

SHA1
8a8f05ad233099ff013a1cb986af0f51cd8473c5

SHA256
98e932c8d9923dd77ab0a88d36f7672ae2754e78b40125d2b12db24724b7f1e9

SHA512
29ff13c23673c668173ac893c12bf1bb7d1a4fc2210580ddc3f5d9c7b7cb50ccee7cdefdffbe92de4c7a7a7b22ba24500d45521904267e56efa4eb4b6db8c3f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
9eb18fe98cf25f47e34c39ecdf2e786f

SHA1
6df3fcee6265cc692b278da4e8b9024fa8776982

SHA256
f9ee8fe817718fc64ae137f03a4e64d47e27216283f53f1847e62a9654e60433

SHA512
736a1524a2d29fddb2be6b5f7607fbb71e6fec6dd24ca928731fc23c8ccbadf451f47470e58a172efa38d34058b5e4aca29a8e9a7be9267b5aa8104031c5c5e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
173229407c596a68a80491763d5d44a7

SHA1
ea1b249d641df0f4ce868f6cd046ea21be177994

SHA256
6262edf91ef40424a928320b00a36650c4bb6c53b5757363f047064afad1ce57

SHA512
1e8cd5d744177df20dcdaf67f4ff174c5a1b99da1b266f5237d6530da50d98e03c98db0ce8d333e7f0d7fe034361cfe99f53b45f49c1eed716adcf938e1f5d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6e86b7854bd0b579d338a8b72e0eac8

SHA1
72ff7b2c99f66ae66a80e695ed574504168753d3

SHA256
4cc6eca7dcdf27c6d41fdecf1d980cbe79802092daf643f38b6c75ca8dedc062

SHA512
fec8f2c02c7c662ecfa0ad0f8e8bb2dad4808ec6ca17a907481769897041c655a74c24600d39c49decb1e8dc6c2093ff344ed82a93a06c3af4d5c09d1d08a8fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a21fff1141513f7e0f0ea8985d3cbaea

SHA1
d2be3076543b85629e04fbefe6b7e10d33ba480e

SHA256
a2d494f79237aec275c6ee7894ada3c4f61c35a127edeed753a0a98adf4592eb

SHA512
26a07afecd89dc9d21ec3cd28d91049e3fd001592d38dc174e3b8b69faa9c6ef07d999ee6d690fe91c94aef939c499642cf109035e920e22ab13aa83f4b319b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d9ee0fd845291e6c01a0e9e19e46bd50

SHA1
4bbf1cdeb234a8d727da10dc74a6bbd15de25866

SHA256
da1cd46cea12d186646b47112e38d136931ce42c47459d92a7af5895310f4786

SHA512
54a8101882c3c78a11e6c7d7a5b9e82fdd3598a582c1ba90b20a20eba68233fb22b482ed5a80a3b4a62a3b7c914aea03e7614633bd99583310ee8658bd920a06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f5042e99c4c13d7b1c4683c7dee39b4

SHA1
01a0196f175d0cda73d07747b010db7c51b4384e

SHA256
3c05ea0441b774acf49e7593479082d03df8a8447130072fd501866945c048b9

SHA512
1d0a5990beb0178160b7ba854b8d953bfa982a87a30a851c805c5735f876ca47a9b11724de5b0920cbf0bbb4b4b182a0eb1f565d2378eed7eb45482dcdb76e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aba8c8d578aeed5d1c40d81e9f06a761

SHA1
bd64abf300716dced224fc929d8753b3b70058a7

SHA256
ac9c1e91eb212c076573b8de9b84a49e51e3f1a5d4d751091e38c9cda7f82195

SHA512
c6bd397252cf08ac1a7db21c1afbef1485ba982ef6e7810be882be2658f23533426e2da5313832c493b68305b6dfc618bc5d7fb65a6b435927743607b57764ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9bc3565be457730b687e962d14ccc8ed

SHA1
e516b3950d13aa5576709cd59ed98e6b5cc9ad06

SHA256
f0639b005083e7527529ee8dd684f758dc356810fca2567eda211f6e54e0d50a

SHA512
eedf3322da993eef649c478016057e2ea85d21453be07bcf4a6da7d9e287dafb2e91a5024d34c925aee82bbd09df9615b3f4ee00f06899a0bb8c525c3ff32a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
abcace1a11d2906338836438c63de0ce

SHA1
df4beabe8f449a36779583e72a7ec31dc79c966d

SHA256
3659446011d07901c04eae3686ed3f2b831878f1d4c5deec279a2e11b1558d69

SHA512
7d6453ee95f127df0e045c8acf6868add833ddfaaf24d05d79c65ba82dbbed5c8868d1cdbb8c425b2a5731271c6fdb669a892a23fcff66373dd9afc650c64421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2483664407c469430b5ec63e708d4c66

SHA1
12a6a25e2c8d7764838d1b6e0187192a0fa35c9f

SHA256
fafc79a3b1982fcf835f2e84b8c4107426ada8f06b486e9d1413dea9a542b121

SHA512
3aa01529c8e356da202ab7f91885c31e1cd223b8ff961238c24f555253395efe1eaa140e9d92fa62b9a387e8482d45fd5548aa017826660c3bd357adc8a3e4a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c535bf53fc14ff6eda9a6f06d91d113f

SHA1
33584a7efdb71093a028a53df68b46998dc5e0a1

SHA256
da450d96f3b15135ff6f33eff481241b18a7a8031ed35522bf9a27a83cabafab

SHA512
24316cf35ff90e57fcf6bf8a77be3a7b710e7bbcb18d614096500c3e64d6450b2f63e82ac8ea0f741ef207429a76f672ebccf887610bc4918a76ff6f64893c78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d90a.TMP

Filesize
874B

MD5
5fb165692d416c96733df2be01b75f0e

SHA1
86a45d271209a7b9e814c48ed7fe8e14ea319cea

SHA256
50c22b4d33629db869ea1819ab2333c51fb058bfcdda08146ba7668a5324df30

SHA512
f9d868112105d11fff738e028c8f5536442318c9537c1961fb225c833f5083e78f635a69f5b0d9fbabc6c5d99675693e9895a7a3a4d68a5d92532200717660b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aaa351c800904b0a66df47e8d728c366

SHA1
3a4e900eb39e227bdc8d2b596ebc439bed1c25a2

SHA256
db75dfb874c40db39ec7da1e93673bda99d75c3a03cb15212a2651deaf31aa3f

SHA512
1937f14f01bc9d0f1d717faef45f5606a2da479f919f159996fcdcdc86a59f2c8550f43d210be7b4823d72fcb633fd7a6152164f798013ea50556ee92f15129d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea644dc7f90bf0932fba7b83eff6c0a7

SHA1
19a1af55658dcd80297aecb8a5c22021e408d4b1

SHA256
b13da94f77a1ed677c2b7ccd9196dc4d8598d5ecd18b751474a27acd48857e26

SHA512
fce51d1203836488fbd274b1320a07243f70630beda7a00e15374533f44b737845ca75755825a3097c68841ede88a5c9a4640512278e1547fc3bfc2df1be7c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp56A2.tmp

Filesize
1KB

MD5
5493642e7b296d64631f01d8e009ed86

SHA1
c94e0ffa8d8197fc46e1832a656e58a94ff87a7f

SHA256
f595aa56975ecc91a910d7f29418713c1d4f24f7132a3e93d41576e357d15e85

SHA512
d2bfe7731995a983f1701ae8e675ebcc5b2436d642e5a7fa53e08ae5cb585f26860106796365713311453d4d2b08c5c82bd89bf3f50dc2691f7ea75703c54fd8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 485110.crdownload

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
memory/3912-653-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/3912-655-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/5464-643-0x0000000005640000-0x00000000056D2000-memory.dmp

Filesize
584KB

Download
memory/5464-644-0x00000000052F0000-0x00000000052F8000-memory.dmp

Filesize
32KB

Download
memory/5464-646-0x00000000059A0000-0x00000000059C8000-memory.dmp

Filesize
160KB

Download
memory/5464-645-0x0000000006020000-0x00000000060BC000-memory.dmp

Filesize
624KB

Download
memory/5464-642-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/5464-641-0x0000000000820000-0x0000000000876000-memory.dmp

Filesize
344KB

Download