agenttesla | hxxps://gofile[.]io/d/tcGqbV

Analysis

max time kernel
2517s
max time network
1859s
platform
windows11-21h2_x64
resource
win11-20240802-fr
resource tags

arch:x64arch:x86image:win11-20240802-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
21-08-2024 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/tcGqbV

Score

10^/10

agenttesla dcrat defense_evasion discovery evasion infostealer keylogger rat spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/4584-276-0x0000000005A80000-0x0000000005C92000-memory.dmp	family_agenttesla

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000200000002b314-234.dat	dcrat
behavioral1/files/0x000200000002b316-263.dat	dcrat
behavioral1/files/0x000100000002b319-282.dat	dcrat
behavioral1/memory/3628-283-0x0000000000880000-0x0000000000AA0000-memory.dmp	dcrat
behavioral1/files/0x000100000002b32d-562.dat	dcrat

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 17 IoCs

pid	Process
3524	test..exe
4584	KRS Client.exe
2880	RAT.EXE
3628	SavesHost.exe
2756	test..exe
4932	KRS Client.exe
4540	RAT.EXE
1480	SavesHost.exe
3204	dddddd.exe
4584	dddddd.exe
4952	dddddd.exe
1184	Test verifier.exe
2864	KRS Client.exe
1684	dddddd.exe
1284	Test verifier.exe
2224	Test verifier.exe
1884	Test verifier.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DCRatBuild.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Celesty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KRS Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KRS Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Celesty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Test verifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Test verifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Test verifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Test verifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KRS Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	KRS Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	KRS Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	KRS Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	KRS Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	KRS Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	KRS Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	KRS Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	KRS Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	KRS Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\MRUListEx = ffffffff	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Celesty.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\MRUListEx = ffffffff	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\MRUListEx = 00000000ffffffff	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Celesty.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\NodeSlot = "11"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Celesty.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 = 640031000000000015599a4910004b5253494e547e3100004c0009000400efbe1559994915599b492e00000017ab0200000001000000000000000000000000000000868d81006b0072007300200069006e007400650072006600610063006500000018000000	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Celesty.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = 00000000ffffffff	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Celesty.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\MRUListEx = 00000000ffffffff	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\0\NodeSlot = "13"	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Celesty.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0\0	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	Celesty.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\SniffedFolderType = "Generic"	Celesty.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Celesty.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Celesty.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Celesty.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4756	reg.exe
1812	reg.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Desktop.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 763290.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DCRatBuild.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
2584	msedge.exe
2584	msedge.exe
2440	identity_helper.exe
2440	identity_helper.exe
4216	msedge.exe
4216	msedge.exe
1636	msedge.exe
1636	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
740	Celesty.exe
2780	Celesty.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3628	SavesHost.exe
Token: SeDebugPrivilege	1480	SavesHost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
2780	Celesty.exe
2780	Celesty.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe
740	Celesty.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2468	2584	msedge.exe	80
PID 2584 wrote to memory of 2468	2584	msedge.exe	80
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 2764	2584	msedge.exe	81
PID 2584 wrote to memory of 3500	2584	msedge.exe	82
PID 2584 wrote to memory of 3500	2584	msedge.exe	82
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83
PID 2584 wrote to memory of 4580	2584	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/tcGqbV
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8ddf23cb8,0x7ff8ddf23cc8,0x7ff8ddf23cd8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,84543165222751131,3844054727741119285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1736

C:\Users\Admin\Desktop\Celesty.exe
"C:\Users\Admin\Desktop\Celesty.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:740

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\test..exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\test..exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3524
- C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\KRS Client.exe
  "C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\KRS Client.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:4584
- C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\RAT.EXE
  "C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\RAT.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2880
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Blockhostnet\H5gpvPLm1.vbe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Blockhostnet\sDYln7GCGlhFg3LCfaj5X.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3600
    - - C:\Blockhostnet\SavesHost.exe
        
        "C:\Blockhostnet\SavesHost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3628
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4756

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\test..exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\test..exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2756
- C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\KRS Client.exe
  "C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\KRS Client.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:4932
- C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\RAT.EXE
  "C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\RAT.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4540
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Blockhostnet\H5gpvPLm1.vbe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Blockhostnet\sDYln7GCGlhFg3LCfaj5X.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1648
    - - C:\Blockhostnet\SavesHost.exe
        
        "C:\Blockhostnet\SavesHost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1812

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:3300

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\dddddd.exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\dddddd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3204

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\dddddd.exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\dddddd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4584

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\dddddd.exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\dddddd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4952

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\Test verifier.exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\Test verifier.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1184

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\KRS Client.exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\KRS Client.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:2864

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\dddddd.exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\dddddd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1684

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\Test verifier.exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\Test verifier.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\Test verifier.exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\Test verifier.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2224

C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\Test verifier.exe
"C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\Test verifier.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1884

C:\Users\Admin\Desktop\Celesty.exe
"C:\Users\Admin\Desktop\Celesty.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:2780

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Blockhostnet\H5gpvPLm1.vbe

Filesize
210B

MD5
e1d2a2e20413ab149947d4b55e24c956

SHA1
e6ee9addcaaa218f9e8414b74f92e5767bcedba0

SHA256
832c9402bafb7a4b335e4c13c4b5fd75aa3eec66e8c69b8b01d5d513aae61435

SHA512
63676023bf5e22a359f302e524f8ebff92e457a9cf340f0348c278a1d6814e3ce3b9552913d87ff4b68ad7913b4b65d6cb35b3ee452ff87828e5bfa7a152979e

Download Submit
C:\Blockhostnet\SavesHost.exe

Filesize
2.1MB

MD5
7798e3c2b9ecc714d3801510f7985268

SHA1
6dfd6f870e8ec0b149311649d23ce93fd76c4b7b

SHA256
a313961b73fa04fef2d592e3f1794e4bf80c383c608b1b6bd058b65e59db0520

SHA512
64b3b381ee4a770c6e820420b0e6512e368f5e3ebd2dd82fc0a190eac0f46e8534b55f29fa2372261b388861f9a1802bce764bbdfdc5dafae26d61f7cccd9c94

Download Submit
C:\Blockhostnet\sDYln7GCGlhFg3LCfaj5X.bat

Filesize
143B

MD5
d91ae11e406fa945baadeb6255b61255

SHA1
363d5f95545a509c8201d868ab2bc938b31f775b

SHA256
37533cd17233105ba3704efc6b7df63adb8a720f0b79b79862022dbb780a85f4

SHA512
b54d439e4c2dd75fffa444d54f2762d2a22c31066dc90b4973a07bdb2d2efc4da20a39dd267b7e6a4dfc69a79d0211ff74b55346cbccc9182925b083ca80200f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SavesHost.exe.log

Filesize
1KB

MD5
ba188ab8514b037519a2ada3cdeb9a05

SHA1
518b6ee233a773b20230ebc226d741961b9bfdb1

SHA256
25effb7a46427c841cf727d6445ed5d8bcd128fdf767080ec1e10dbc8a40bee7

SHA512
fa2ea4f92834e14c5e09ff81c286c1ae7da9de68748a4dcc68da1ee214632386a24b204f4bd6ea71f17ec30d1e0fe8cb456c0c95ee65a07b87c2bef89c6bff08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KRS Client.exe.log

Filesize
1KB

MD5
ac45cc773216001c355992d869450b47

SHA1
1f19c3839b521e1bf1ec7928f32f45234f38ea40

SHA256
c9c03abe98c496376975747c9b617f5f6e1b50aec09aa8be31aa24e81254901f

SHA512
3d73620a59089bc05d60ae07f0811ddacd1661599eca096cd9927813f86dc9cebac1de221691373601c743250694de43e408a9e607e813fb28260b1509f84574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
33KB

MD5
e039a23ea465d2de0388937695a7e724

SHA1
68e95d5b4060761fc2b0b58a593ebe7d661c52f9

SHA256
bc3b9c09bf69ce51b930e86a23c6f249f9cc6dc98a84fd278d4131c9ddd78f43

SHA512
5fedf2fbff555599108ae7bdaa86cb9d22537e46ecda50cbd7a25199338fba4bef35bfa813eba76b1b367fb8b93e2c1ee9952a55deff9f49daa189f22b5e0336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
50KB

MD5
84952f98cccb079b3f36f29c0f2f7d8d

SHA1
92a207064b6cb9cb6104bd8b3dd1e1e3e789b26c

SHA256
d9a98b67c7edffef7138d578788a1c25310cd3561b94d8bce6999f40b0073186

SHA512
a052abb5bfeb8ece88ce62b46ecc920db7db71467f1433d96fdc13072ec4dc4a67f13853f4d14e8f5794d9fbc58cbe1bf94e9f3a2afb7dfbdcecc2af2046bc37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
93KB

MD5
06cb502613f99040e534fec65fa725c7

SHA1
03006f32792e033497e9ca68373b6c3386305933

SHA256
e1172d3a0a208cf01dc066f0abeaf17f00264a966159a69f71947d6edcd4935f

SHA512
734faf4aff6d9c64b87f3c1320114f71d099d10c0ff9a4de3ef65e009918a5b8faecabd0e7e56b2630e1de58a5e3c2c82c9c6120241feba750f2dfc12723a8fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
190KB

MD5
16b20908101acc6624cb9446fcac64a1

SHA1
b7cd57a4fd6a1fae6126150f427ef217397293e4

SHA256
2933c96348a4eae7cbbf8f280ca0981586a9b5c097ef952b996cad7d28f2fad0

SHA512
b22c1efe85cc8528c60b02e7fac72b68f396ac9c4795480c04c65774f7b64e7937234c771120a82f3ed66793531fa499af2c0c63e3c1d5c8f2a89e63025b823a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
18KB

MD5
ef2fa694e64f0f30991f6ef31df083f8

SHA1
ccb1d5e39a8a896d0e26820325eb58b7bec13e7b

SHA256
b61f934b22e57d2adcff5fb7f44fc731bb3baf6d61a9c6007ad59d3b167ecf00

SHA512
2079f97097948e5a5232b3e8e6be43efcdf81469cd0f300153d0e130829071920608b615bd08c58ce99297f97171ff322e9e4f14a0f1afcaabd2e164e2b835fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
09992d14ea2043fb9c0d5654220c9131

SHA1
99281339ed1d5b70320298fd22a4730dac83466f

SHA256
9f3faa853ed440273700003943db69d23c6b2835135d6d785b2c9cea6a5a4a40

SHA512
30e3c0581ccfade48e7cfd902044baec64c6567452eb527d9b7022ed12a6c2512ee03ffa61da6c478df1c33e7039a5cfb9b444a97056eed49c204fb7a51360e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
c980219d1bd133f3a0bb4a33351dc062

SHA1
737134ad8af30a0cf9fbb85c20ba8f66c6daddcd

SHA256
ec56d3ed9a561a686492711e395007e99880c89d26fb01a997580af76667c73c

SHA512
c992b49a8148e1d0898cc0df0f00cf94a394503833c72abbfadd49a8142f0c878615c7a57aac5ecb4bf4c41e3cb049b8f7790d24e6f0d79a540e2a0408b2472c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
75e18f715fb240b29432e7302e48880f

SHA1
afcae1709403effd2c52f644a7bbe887348c0678

SHA256
20f8245ed1422e3336d51a75e88f73a824dfc5eaae5e537de473e4ff06b022eb

SHA512
fe05a9250023e866750e54333b8e6ab09be752d97aa87f74ff822b529fecd3b057a57db0cdecd736cf02477a8cb483e42bc00ee48d1d1b842b8010b964f0d316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
7c73e4a2b51b0aca7f107ac93231ef3b

SHA1
065a251e39841736d376a300466338a72bfdecb1

SHA256
3b1f0e276fd037d6eff131c0a857f225e53ddc090e44835dabe81320d40afbad

SHA512
97dde813021959a5a2bdde092583767ce6972587c0253a63b6d057c982a90707e52a24fa25a5074842d0cd824a3cc57527cff07f722c401bbaed58e5fcd4957f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
466B

MD5
4905ad78331abeda14f6dd6915cff989

SHA1
c25ad81282d8a7d521b380fbcd8afe28b52162b9

SHA256
087fcc87ab11f9a8cb78155ca21ab0f90690fb128097fe369e97b989608a3785

SHA512
4d46634fe7569b04338661d49b99663be60713bc9b3bdd289190e02e7253f0cacf26ec0561bf2d80233da732f6732240831741c032ff4be3c0db1e18238ccda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b155249469ada4a30370fd8d6b3b2ff4

SHA1
4740f1c916b4b6f719e269204c4f1307b2705991

SHA256
4f3d721a8a28e43cf939dca5d367c790befba7e7889054fc15802dddc5b9d6d9

SHA512
497f54a2eb24ca562f82743349e7f08df8f36792814c666daf72156b8985d9b11a99a228194cc4dcac0c0642374ae0b83c5903f34207d694a39ab976533c4439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
024cfc6b46ee418a58096b7f67692b64

SHA1
1fd85754c8699e45b8c8624b5bce410a4a5ec5ce

SHA256
1630c8dae02d6b5dcdbae5df5b1558ffbd5e75c94dad466c1b13358b1cc28aee

SHA512
753262c557a98c186f783394b2c8a97504784a20a87e53af1164dc6a89b856c41db320b0cff0bee474642fbcf158e6166172452bd91dcaec0515fcd4db4f1beb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c2205f792ff3a2c4b0bf6db595a558c

SHA1
94f9df3ec2d5462b5628683756d725ee67da6562

SHA256
69234262248efb4ab2461e7b53cc2f9911b3458e362f2fe9716788bb6f614af5

SHA512
9204b53673266da2017098b9f23c3df752ec2cf3cdf6a0060e4dbf098fbcc527eeffcdef279a0aeeec33a6030c62559b25b9017ab763aa105d98d5ccaccb0d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4563b75a8d41f1ccb40518390cec6954

SHA1
fdc79be74f43fa7fb1685f26a7837c02c8ea36f1

SHA256
05f41d120359c65ae8189450f1f276c21ac60aa736072cd0bfd499d744ae6bed

SHA512
e528359ae713ebe7a8e10065d78272d843e8c47f527c3955869df109ec642b49122325e3c20f947f0221ef11dbea280e7d5eb6895180df1dd7b4c530a782a4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f7b162923066a562b2b99f9b4d2b1c0

SHA1
98b128ccf9a14d0250c2e49794f04d0de9cd9f8b

SHA256
58dd532455c76f9d05f93fdbcdfdf2d49a2dd2f436ca4051e3f8bf15fd05a776

SHA512
97f5d9f2992671e8880f837a2e4bf523f8cc60806249d3d67c7abfa26583f1e72862aa885f386255fb95598eb8740d4cd4ab402814cf873736f074ed50483015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa5514d0b6e73467da122158d75baebe

SHA1
c072ee5d3a39d8d3b83af003b27d803972fa7d0d

SHA256
e948645ea2cb20b8f520da9d3844b110ec17b574a9bb1462d7dd10350c20f66e

SHA512
aff71aeb7443d7d99305d44bf1e5c1399d5521cec4eafcaf2d969026662b6fb21c2e3f1e6d2badb27c89dcd75af4ac5a330deec24eea6f17453b3b35733fa421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
658823981dfd30b5911f5711324275ac

SHA1
0d7d8f0adcfaf90ce4b57d7d24efdf9819a756dc

SHA256
17e0fe6bb0a5da9c48ef5efc6cf22341f5875f1fd6849660cfec105dea8146e5

SHA512
cd9065f20550d54205405190ab9f80924dde5346fcbb72aac79b6788781ef9ef3931719e6099e7f06b9d43d1651ae821e4c192abadbc03b128efc6e633862ca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
a7f8faf91b4449ada40ab25ddfb125b1

SHA1
de44b41612de632bbbc384e4784882d73230aada

SHA256
964ccd5f8b802163d3ef880b88166d1e1cb8627c2422d8070cca01ec9415e7d7

SHA512
d9c9d639793d01e811eab9650dad246c995b90664ad7bbed16658d882f044ac72738f1c8fd2385a4399b90573392a22cd8df6df8159eb9f89d83e5f8e4d8ba42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe63062f.TMP

Filesize
370B

MD5
f70fefea2194ba8d0ec8cbe559266764

SHA1
c39f1fcb873563a46d67d37498c4f1f650f25466

SHA256
7997f838f7030e176ffd9c3e31eb56a8d78414c956eb0805435bfa92ff04bc7b

SHA512
f76f71c13cf7721820dd41257f7686b0ff3dad0adac0c5c3750ad748599526172679084beff78fd92a1affff1fe7f2bef35f978ba26c12b4f0b6888a4eb1bc2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
76ee1063d36e080288ac0cf2433f3059

SHA1
1564b417fa296ec8ccf1c0940fd55127baf84bf5

SHA256
d6be60486e6e5a6248427dc2a806cd51c771496ccd0462b69e99fffc067a23db

SHA512
429398f672b9cb8867c9853ceab41c7f4157ec06aab1800c87f6b8b1fee50478dcd90da798050ab8a9b795828a207b41b9e97cf6467911d71e7f1900e353606a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
094d1f9ca481f39e7df6b2aa92320ee1

SHA1
2b8891b67bcc2a004f52f33bca56160b950250e1

SHA256
3f1316b1b806a744edf781022ab357cb13d03817dcbaa8f1340aaaca5b9ae002

SHA512
db95ad91b54fd0dc0db7bdd51a5a90c9c477fb3f0c1fd347c0dc241e11854ed11007c15681a9bb3abb6c1a8b65e6989ee3e2361c95cf1256180f05ca48985ae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5791105e6b8901a086d7345aaa8cd401

SHA1
b0c859fc8d6466bd72bf2e89092f179e225b7208

SHA256
6ae4ec2e4e633e8b7166f8751322cc059af6ea68510f3371f3dfa2c6f63c34be

SHA512
a00a77fd67dbcc24cb365a8db8f6da7036e78bc8b59cbf00335dd807736afc910cf17112552c0da5fff29167beb9b99c4950cb07fe23dc6f25f68ee6535ac9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f7450fdbd93748af70f69726305ddd56

SHA1
db2b3437272bd84d3bf952590ce13562bafc03f4

SHA256
974193d614d21bab7bca0fcca68392edf50050b3a5c61e37f441001d2caff6be

SHA512
b897da4e05acb23cd36bbbc7247a715dbbd5b3fb2d6ca5848554f65cbfc7c286341882d76138c34cf6f6159fef1aab2a5710e627a029d699a9cdd48c25d7c58d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
11KB

MD5
4240de59f2bb56600b7a6bbcd7625c07

SHA1
b13d1d7d7d3e6d615080be0c16fbd8eea41b9786

SHA256
0153dde74e68323e6b64cc0c70916c150807e019e6d7aff44761191dab0f9eef

SHA512
e7e07bc79bc02807ccf3617db2156ee19d5c6b3a6dbb98e157552a0dd8bc002fa89631b435cafe725f0938f60d401b8179e0a5cf3f0e6c4023e8f0906349c5dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
12KB

MD5
28b1972998eb310c2f77b7acd82ada18

SHA1
a761b414501e623955f35027da0c43dbce015151

SHA256
6c4a843ffe2bf89effa97d4c0961a17d0fc0b455173217488f96b4b2a3992257

SHA512
6b3ba1738147312afb0d1be9ab33a17232a6ead2d5aeb960dfedb945f6ebfea994b35d51e0fe5d9fb7859c0af20a5a2d03a4c82642d5661a7b1a703f3d6e220c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
12KB

MD5
7e31b6b595147315e9767dcd668dc3a3

SHA1
c45df511301b559f471b24346079726b5326dd8e

SHA256
bf897603c7edbd122a374de2b8750f60788e97f56fead8f7d626fb9b7cf07a90

SHA512
467a0dcce5b0de9a5356b81fa8b17af559f07b590ea20668db0e6e01187f9ade891ae45eb7deedaf514a56829a0fc474f72cac55e6d9baaf32e0a47ebc6ddd07

Download Submit
C:\Users\Admin\Desktop\config.ini

Filesize
25B

MD5
12f195edc7081dadca20430eccedd7d1

SHA1
d526d2d6a160015bc45d4a87b028f94e8efb35cf

SHA256
1c1f22d04fb8a8c5c579760b804c1e4b907dbcd7164032f3b6b348c68ba0d6d8

SHA512
31f080fa4abb764a1b5aa961b2d3a8730e9e3a75cb3130b013cf9b426a7f0fb6d3a460e0097d24ee90c178cc065f112798eb266a049214d0aa23403a77e7e5fc

Download Submit
C:\Users\Admin\Desktop\krs interface\dddddd.exe

Filesize
53KB

MD5
098062dde5741b0b42e73060a1b95db0

SHA1
803e9fd3f740cfebb06333a7e056e6b6dbdc10d1

SHA256
63e2cb9d0bfc79659e24fb3b119b249691dc79c5da7c42f7e79a9dcdd8ccd611

SHA512
69a18ec7f7fc8e49c2ef9f0ffc62020bd603f6874ecf6cc2c16351aaddad4a3ef37a7575c6f44065aa1cf606d2ad85275a003105cbe4527d9a9b035d6bfd678a

Download Submit
C:\Users\Admin\Desktop\krs interface\dddddd.exe

Filesize
53KB

MD5
45cf48c7da779ba3375a4f2a14446126

SHA1
78fbe32ae9f5695ea48643a4e1f69773dc100438

SHA256
da5b3512224d9df67b2ab4b07d1977fd3fdeea034243dbd8b604f23855e77f56

SHA512
2c63ef40fefe5de2502943a4829c570a7b681f41a7914063e9696b844beeef7343a26c6f05803626cc21393460fc5492c375c8e75ac17a1754c0b1e1a1d42194

Download Submit
C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\KRS Client.exe

Filesize
152KB

MD5
bc18b8acb28b2596260c913851fb5215

SHA1
be4c6d63fdd5ba230d68215b9339aa1bb0861aa5

SHA256
babe6866df180a3c6c2c96b13e7e7ccd5eb06244d4b74c3f5ff92ac1675f9fbd

SHA512
a758a91477fbc4627b88bf03509473afdc110fea200f82afa7b68cb78d1f801702b3dd23f59f3b6bc1c538edaaeb01dfc6c436498c94dff116bcb6ba5c370ab5

Download Submit
C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\RAT.EXE

Filesize
2.4MB

MD5
415baf46cbb1e0062ac996729d96a91f

SHA1
1ce3519f001285e11b81cd324410900b26bdf11f

SHA256
4ed407bbf867a3acf041900ee9561b3de4b2c13c6293b64ce04b71940b14a9af

SHA512
a0798447406d9bac4a64c6ef51b7596f65170bd8a8ffc51b05d86cdfbef381d82fe914dea4f02b4878e394de13168ce5d9bd4de9abd4f53c120eee03176aa796

Download Submit
C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\RCXE461.tmp

Filesize
53KB

MD5
ee54865a72ab617edcfdb2b1a1aa5de5

SHA1
c35fc07a02cfed1c3de539d41ae9af1c764a8e90

SHA256
56f195d94c4855475538b8e5c7fdb8eb7e4316f0e672f5c9ccde227a49911a80

SHA512
ac8a4d9efeb30a598f5fb24ff8c3ecf6b5fda0f1d4c827c4e47e740e5ab859623dff0db013cd9633f3cb875f3ad7ea72e9fd9fb65e33d7f7440ba069fc86d693

Download Submit
C:\Users\Admin\Desktop\krs interface\vulnera\bin\Debug\Test verifier.exe

Filesize
53KB

MD5
ed529927e57dfe82f7b1263364f312e7

SHA1
570ed7b60dafb2b040d8d233698f273b34fa1600

SHA256
73fd7801d6077bcc2e19e05cb925ea6d4c6a1b6840385b86b866381f3536aea2

SHA512
81d263794aa6f733c21be2ed87caf8c9b22efeb768ff73e70db24e217d289df7d45638c8b60f863c784e6405fb4c8d0ab5976aeb6145193307ee34759ba008d7

Download Submit
C:\Users\Admin\Desktop\test.exe.exe

Filesize
2.6MB

MD5
0fba178c001ed042a060385764f45f1e

SHA1
771cb03c5c918a681482e19826113b98bc36bad5

SHA256
c80ab710e5acbf81c3308ed06b3797bb49af5cca09c3a91729a31d05c7ecdc3b

SHA512
81e9ff216e6ff51d1914c958a06f8d9157ecc43b1446f927557c6b51ae4a1e1d8a075a5e72c519a1a46a3aa6a42953ba0de719b7c44ea05d3c445338677faaff

Download Submit
C:\Users\Admin\Downloads\Desktop.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 763290.crdownload

Filesize
2.3MB

MD5
9ea97b9229b329c980ba37516512ac46

SHA1
113f8cba2bfc522459636bfb2eec9a78131ec7c8

SHA256
5ff9c1bd1e899f6509a39421eedbf6ce3e62f3fffd207c1369b96574aa4cc2e9

SHA512
6c3f3905a0a01075a99156d76ddfc94dfb03bcd9e61d4f09b11c2efac9a9dac1429428e1303a09783b08b375eb6b0180b7541d4892008d4d1b7c59d1083f0943

Download Submit
memory/740-301-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-397-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-291-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-292-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-293-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-294-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-295-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-296-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-297-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-298-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-299-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-300-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-289-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-302-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-303-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-304-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-305-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-307-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-308-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-309-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-310-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-311-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-312-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-313-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-288-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-335-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-287-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-338-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-339-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-340-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-342-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-175-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-358-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-359-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-199-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-363-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-200-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-278-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-290-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-201-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-408-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-409-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-411-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-412-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-413-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-414-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-415-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-416-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-417-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-418-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-419-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-420-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-430-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-431-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-432-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-202-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-204-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-208-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-211-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-212-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-242-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-241-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-223-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/740-222-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download
memory/3628-283-0x0000000000880000-0x0000000000AA0000-memory.dmp

Filesize
2.1MB

Download
memory/3628-284-0x000000001B5F0000-0x000000001B5FE000-memory.dmp

Filesize
56KB

Download
memory/3628-285-0x000000001B600000-0x000000001B60E000-memory.dmp

Filesize
56KB

Download
memory/4584-264-0x00000000002E0000-0x000000000030C000-memory.dmp

Filesize
176KB

Download
memory/4584-272-0x00000000052B0000-0x0000000005856000-memory.dmp

Filesize
5.6MB

Download
memory/4584-274-0x0000000004DE0000-0x0000000004E72000-memory.dmp

Filesize
584KB

Download
memory/4584-276-0x0000000005A80000-0x0000000005C92000-memory.dmp

Filesize
2.1MB

Download
memory/4584-277-0x0000000005220000-0x0000000005278000-memory.dmp

Filesize
352KB

Download
memory/4584-275-0x0000000004DC0000-0x0000000004DCA000-memory.dmp

Filesize
40KB

Download