agenttesla | hxxps://cdn[.]discordapp[.]com/attachments/1275831833887641681/1284459565454462976/WaspLoader[.]rar?ex=66e80730&is=66e6b5b0&hm=bb48a332c8c74253367dddf7cf5041defca851083d1e455aa9129d6862bb9dba&

Analysis

max time kernel
36s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1275831833887641681/1284459565454462976/WaspLoader.rar?ex=66e80730&is=66e6b5b0&hm=bb48a332c8c74253367dddf7cf5041defca851083d1e455aa9129d6862bb9dba&

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00090000000234a5-177.dat	family_agenttesla
behavioral1/memory/3396-178-0x000000001BC60000-0x000000001BE72000-memory.dmp	family_agenttesla
behavioral1/memory/3396-179-0x000000001D1D0000-0x000000001D4DC000-memory.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

pid	Process
2656	inject-c.exe
3396	WaspLoader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2656	inject-c.exe
2656	inject-c.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WaspLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	WaspLoader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	WaspLoader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
4084	msedge.exe
4084	msedge.exe
1524	identity_helper.exe
1524	identity_helper.exe
5028	msedge.exe
5028	msedge.exe
2656	inject-c.exe
2656	inject-c.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1248	7zFM.exe
Token: 35	1248	7zFM.exe
Token: SeSecurityPrivilege	1248	7zFM.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
1248	7zFM.exe
1248	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 3344	4084	msedge.exe	86
PID 4084 wrote to memory of 3344	4084	msedge.exe	86
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2500	4084	msedge.exe	87
PID 4084 wrote to memory of 2156	4084	msedge.exe	88
PID 4084 wrote to memory of 2156	4084	msedge.exe	88
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89
PID 4084 wrote to memory of 4024	4084	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1275831833887641681/1284459565454462976/WaspLoader.rar?ex=66e80730&is=66e6b5b0&hm=bb48a332c8c74253367dddf7cf5041defca851083d1e455aa9129d6862bb9dba&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc538f46f8,0x7ffc538f4708,0x7ffc538f4718
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1968,1600349045754153792,268200920303383057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3220

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\WaspLoader.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1248

C:\Users\Admin\Desktop\WaspLoader\inject-c.exe
"C:\Users\Admin\Desktop\WaspLoader\inject-c.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2656

C:\Users\Admin\Desktop\WaspLoader\WaspLoader.exe
"C:\Users\Admin\Desktop\WaspLoader\WaspLoader.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9caadec417fc7f7311d8f00e19af49d9

SHA1
e02c92648a456286f32ccc430e3db4c83bf7cfe1

SHA256
6a7221b61b5d3d41491c8648368f81037272d8bf69dec64898b88a826f8690fd

SHA512
8864aa76451f31ac4cf48926bd6d1393cfa654a01f8dcf933443f12b9cb973a0aeaabad920e18b0570d1e81646b576591eee55d03198e28da5850def9cd34a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7dbe22ec5343b5b57111ffc689808628

SHA1
996c4d4fa08b1c0a0de9b06ca59222f1cef95e66

SHA256
d39ccf3927d6692ca348eb6cffbbc6164f504a2084a266f47123d62b5c49bef6

SHA512
0ccf65682b7a5cbbe976fc450ca555027634f450bdbd7f077cb8ec709de9725189512b626690e1fed10eb7ac006b49066227fd5cf5cdbd7b640d6e2603374ea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a13fd226917d18006a72019de992e07

SHA1
714c85f9816f201d873c129c9605df15900f566e

SHA256
8d003d6f27d6ad086ca5c884bda854cdf302c5ed44136305838e884288e88e9c

SHA512
16ffe9bc165881ade4c168f6e4a9c8e0672097fb3adf6ca175c8c2d836008be5af4e8ca475c8c9d88083b23a379211cfbd081f862e7fb80623d23fa77035d77c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b6f75759beb4ade3b310f50d908e1d00

SHA1
bb3ef465d05b3e092722a25a969699768570a6ed

SHA256
7cdb3b2c788b5fff02cc70dd2e83592e87e9cae28d4e242d8c068a231756993d

SHA512
7ea36f3fd22389dda319acdd49c47ee618f9f8e91d8036b0634bfaf1e14adf3a63c744123c23306c3eedc39074a201ddf9b636f2d54afb10a8ca5d1e5d5c42a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a99836a95c7ad711c1dce04701246a51

SHA1
77b93c996995affbe5b0b3f0605519c3633d0380

SHA256
52766e38ccce312ea1c30d680c248feb40c00ef0a3df49dfaa59fba093fdb4c1

SHA512
5a1499a9feb41ee2f605a31adb4ab31533feb2ac8941a49181fdd493cafa4695901110597f2755bdbaf552221d6aa603bb3d763d2737ffd4b3d676b0f6d050fb

Download Submit
C:\Users\Admin\Desktop\WaspLoader\Guna.UI2.dll

Filesize
2.1MB

MD5
70bbce41447ba33a3c7e8dc99d3e6175

SHA1
295ca6d304dbe2532b4ff27e283834ded38d78ef

SHA256
4a641ea243f6e8943cbad387e5730d9eb92ce4bcfd5d9d096a547927503e755e

SHA512
6ef6f383a2623ba16dba08fb31afd4e980981886653737274df84e5ffde322f560d1ffe71edd0829ea24461c5ea488bb92be751019b44c921bd919207e5fcdd2

Download Submit
C:\Users\Admin\Desktop\WaspLoader\WaspLoader.exe

Filesize
1.7MB

MD5
ded7171654d9f359e3f920bd97eea82a

SHA1
211ae6a3d881adc8a88e2ae625ae783342b2d572

SHA256
fbe79d5be3c54c322b4417a1633fa98fae73da97e30da6e22647aaa8ea47ec3f

SHA512
8bf30b9316f02fc9deaa808c7d47eaede9238242aa38f78954297ed3348d7e2272cd2c26160a6d0a841eeef1d532ad63734e77888926ba0b25b6e253dacfade2

Download Submit
C:\Users\Admin\Desktop\WaspLoader\inject-c.exe

Filesize
12.2MB

MD5
e6333b1e880f784228ebba74fcb76a88

SHA1
0ded82ee467b4012b45eef9878402f50b7be17c4

SHA256
c40fe901f365043c08b3053830e4bef1b496dbec93e6ca33c891f58f14006aff

SHA512
1c5bbd9b6cbd0418133186f5e977c7a66915ddd128e3a478acbc92042bcf8a3ee2b2f93ea23849caab1730a329adf96dfacb5d1d9453ccdd86266ddf8442fef6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 679373.crdownload

Filesize
12.9MB

MD5
1f57b31be0f4e54672397d5c4f46de9b

SHA1
e781ba218978944cb3fad89ec9507a1e985598ab

SHA256
f2d5a1669bdecee17615cb12cce91538fc0509fb729ad75484b53aa924d588da

SHA512
69d68b48ab2e6c33e618a74312ec2e419d82fd253827fa127514d6a36e005ad1050f8c9a72c42106095a81ec8a6c7fb1b230b985f15bf05165a2c79caad76ac7

Download Submit
memory/2656-171-0x00007FFC61ED0000-0x00007FFC61ED2000-memory.dmp

Filesize
8KB

Download
memory/2656-172-0x00007FFC61EE0000-0x00007FFC61EE2000-memory.dmp

Filesize
8KB

Download
memory/2656-173-0x00007FF7B1140000-0x00007FF7B24B2000-memory.dmp

Filesize
19.4MB

Download
memory/3396-176-0x00000000007C0000-0x0000000000980000-memory.dmp

Filesize
1.8MB

Download
memory/3396-178-0x000000001BC60000-0x000000001BE72000-memory.dmp

Filesize
2.1MB

Download
memory/3396-179-0x000000001D1D0000-0x000000001D4DC000-memory.dmp

Filesize
3.0MB

Download