asyncrat | hxxps://github[.]com/intelliroot-tech/Mutex-Vaccine/tree/main/binary

Analysis

max time kernel
145s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
16-08-2024 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/intelliroot-tech/Mutex-Vaccine/tree/main/binary

Score

10^/10

asyncrat defense_evasion discovery rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2604	Malware_mutex-generator.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
33	raw.githubusercontent.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Malware_mutex-generator.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Malware_mutex-generator.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 185466.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\mutex_names.txt:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Malware_mutex-generator.exe:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3484	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
3612	msedge.exe
3612	msedge.exe
1688	msedge.exe
1688	msedge.exe
1132	identity_helper.exe
1132	identity_helper.exe
4448	msedge.exe
4448	msedge.exe
4888	msedge.exe
4888	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3104	3612	msedge.exe	78
PID 3612 wrote to memory of 3104	3612	msedge.exe	78
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 3676	3612	msedge.exe	79
PID 3612 wrote to memory of 2476	3612	msedge.exe	80
PID 3612 wrote to memory of 2476	3612	msedge.exe	80
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81
PID 3612 wrote to memory of 4428	3612	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/intelliroot-tech/Mutex-Vaccine/tree/main/binary
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb016e3cb8,0x7ffb016e3cc8,0x7ffb016e3cd8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,9091336530946436529,14176799474190831113,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:32

C:\Users\Admin\Downloads\Malware_mutex-generator.exe
"C:\Users\Admin\Downloads\Malware_mutex-generator.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2604

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\mutex_names.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14a0756d-907f-45df-9479-a6f64b827433.tmp

Filesize
1KB

MD5
039baf1001308ee62c5b0d6421814c00

SHA1
8135e7da169dc24462f1a33713700041b35c38d6

SHA256
21e611db6363dcb72b238eb922d6b64bf360175ce21617caaec3c07942648b4d

SHA512
3cc5f2798b8f675b339afd20d40b32067cdacb87b7313f60cb2bd311f69c103bda71ff2fbad6538b893205c419e1935b8fb3a72f501b0b5ae9e15077107859bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0aa7896ffc25eeb249b4480b4fdb5a0b

SHA1
518f37f4062e9e189a8f884423c3b20ed739bfa7

SHA256
6d7ba53a8801fa0c943cb162dac73ee237436c49a21e4bb0ad1f4dece1bdeb9b

SHA512
8ff1a3d4767a65f17fed4d1d825a12c49d26e1d60bb41a71ae71dffdef341b05708336f3458a778353bcfcef0e0af4a2fda3ec9a65114bda2d5833734dc748a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
c4897aa78d9edac4710b6abd9081210d

SHA1
82fff6d6a6c64af2e1e64a0a56c46cfc2a3470bf

SHA256
1c2dbad9b7fe623f7907fe8875ae1df241de6ea09e8dbb063b885983420fc005

SHA512
207439940f16c3a029f465c4f4b6d290f15deea00c5d46365d2bbe5a27c48371315a7a5e39366638a4d256c843470b6e9acd6fc7c0b85aac10dde6176aba026c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
ed5f4213c17629776cd75510648fc019

SHA1
ebfa685dca9b7c920cd5ad521c03e4ad0ce435b9

SHA256
e969795f0e63ec8a35cdf34d5bc43867ca0825bebfed9734943e69b34ed2ad87

SHA512
71bcc166ae5a48f7a79aa5de7ecc7e10dce22c39240ca9ffe9d0f9340f40fc2a2429529cfee8b2b5d7082efe94921fa7df3454852d5313ff4093bfdffc189627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
167392c4767b33bde963e3ffc2398073

SHA1
ddc83d602634bb31e65ce86343e08327f21b5eb3

SHA256
40548101cd602d2dd2d6001ceb0ce32ad4989f1c619342d996de0ee870c63fcd

SHA512
a2a913d446e901ea727a20a6f08c0e2c9dc4157c1caef14b17186fca796150bfe93eb31d96fefafd8d6339214f7862b68f75e8e8ff1b4179d4435ae13c7368c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14a1fb73fe4d162a5ae140921c8cd80d

SHA1
03ad0cc118f513e068b1f06c25bd16d666df16a9

SHA256
c119f2c6b5399c4ad76c0a4e5d9e37e6f79ef45c14229ac7d4fef99ba1f79005

SHA512
0bde4625d7fc90d78c0015a28457c771097a6e16d0fa4257fb36646c581a74b0b625065357bb22531706a07790b46f5d541bddebfe682b5c296147aef479f1e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
607dbe7d1437d945f23a67c684128dbb

SHA1
06686212f379cf6834955fc9a176b2b7e2a1ffcb

SHA256
9dfbc9bf37443828681acf42e7e6d8ecda78c502d490241933cf9541a23912b8

SHA512
6841ec2f0985c18bed26d828be82b4cfdcec92105ec342d2e3ad95a7d02072afff5b50317f7fd27d8cd50e643535d9a22ea820ab3bbc4b522388cf1e1936f83b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e867.TMP

Filesize
874B

MD5
e9a9bafc5fad408f33066105a045efe7

SHA1
f03b081770158643df4d51cac9989784792d48d1

SHA256
52ba0d3dcd992261651b88b3bf8d40e9121219cd20318963d7a70f93d2c2e46a

SHA512
efca97c0d913b339b419d48b396f8946d831c6350deac25fc269040431279d7bd2a63039bf5238a14773ee4e22bd7c1fc612588550231c8c6fe62c9359afdcd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b1a32a3a184428dc94b6088e6410107

SHA1
8b830a7075bbbe17c90cd94d84c8af6e6dafc372

SHA256
91bb962cf5ecceea9646035f31fcf7876e91518328fae4ae3e93c84a625a2c88

SHA512
9697321e1d8268fbffe2f41f377e68ef7f71fc386de5a476ebf25a07f163aaab32deccdfcd3de97db784a5df5741c9c88c63b2b5f6b5f1c261bccea3ab040cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
18ca2999778f093df8b591a54a6ec4b6

SHA1
5ed687544aaaf6c8af875da0643267c039f31ad7

SHA256
47baea1bdcd945085ec8fc76d64a19408ed7a84e9517035dce064e63e9475e08

SHA512
5e2e2caf4aa1988092399082bb60b9763cb86db1f660aefbd5b4ca94c9b3223f2adde8f8c9fc023069df43e32e05fe03009e8f3723a186f5b1bda7aaf84b052b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c09708a46d840083f9f81b0516eaaf20

SHA1
bfd37320edafff0595f1ee891c6d40c4e0ff2877

SHA256
d111738e02b153de902c03f74c46f4abd7136abcacd2797516a33c2057e43438

SHA512
498b0979b8381f1b00e41f47f622810bcf36ac1bd2592a705bc24b5b047c47aae1b125f6bba9815a5bfa25a7e58a3d3c21b046c447bb248e11adff9ca58ea373

Download Submit
C:\Users\Admin\Downloads\Malware_mutex-generator.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 185466.crdownload

Filesize
32KB

MD5
ca0dbff4b708bc347f002544657e7d00

SHA1
edb56ffed7cdc1cd4adfcd5fe53b3a2457cc84fd

SHA256
d49d35acd590173bc1e2e79ebfa65209559ec6019dcacfcae1d7d457121a3836

SHA512
2856c5056dd0dea69bdb0c1315d97e119f99581c5ef2cb206b0a39e896b776371cdcf4df9e0b4af1c70788b48b606391050a730245f56377187b134d7d82a231

Download Submit
C:\Users\Admin\Downloads\mutex_names.txt

Filesize
52B

MD5
5085a0e808b32bb698509f655a87c1d4

SHA1
9588284eb258cd052e325e29ced7316f5cf2e9ef

SHA256
f6572bfb79e9340d777047086f68425ed8b9faa4f70cc72f9ca29bffdcd70cd3

SHA512
47924ce3ef6d6c9e5ee768fe586b8ae51eaf78784768e725da862aa7e7d72f48a78d5659e6a970fb0e1b21cce1b90e23d1521f7d615f55b2293ee187b7749a84

Download Submit
C:\Users\Admin\Downloads\mutex_names.txt:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit