crimsonrat | hxxp://w

Analysis

max time kernel
274s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 04:55

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://w

Score

10^/10

crimsonrat lokibot agilenet aspackv2 bootkit collection defense_evasion discovery evasion execution impact persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Extracted

Family

lokibot

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

CrimsonRAT main payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000300000001dafa-1319.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	4072	cmd.exe	172

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

Processes:

bcdedit.exebcdedit.exe

pid	Process
624	bcdedit.exe
5880	bcdedit.exe

Downloads MZ/PE file

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
behavioral1/files/0x000400000000073f-918.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CrimsonRAT.exeCrimsonRAT.exeCrimsonRAT.exeSporaRansomware.exeCrimsonRAT.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	SporaRansomware.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe

Drops startup file 1 IoCs

Processes:

SporaRansomware.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\US8B0-24XET-XTRTX-HTFTO.HTML	SporaRansomware.exe

Executes dropped EXE 20 IoCs

Processes:

Hydra.exeFlasher.exeFlasher.exeFlasher.exeFlasher.exeFlasher.exeLokibot.exeLokibot.exeLokibot.exeCrimsonRAT.exedlrarhsiva.exeCrimsonRAT.exeCrimsonRAT.exedlrarhsiva.exedlrarhsiva.exeLokibot.exeCrimsonRAT.exedlrarhsiva.exeSporaRansomware.exePetya.A.exe

pid	Process
2464	Hydra.exe
4896	Flasher.exe
696	Flasher.exe
3832	Flasher.exe
2528	Flasher.exe
3804	Flasher.exe
4884	Lokibot.exe
3520	Lokibot.exe
1496	Lokibot.exe
2152	CrimsonRAT.exe
4940	dlrarhsiva.exe
1220	CrimsonRAT.exe
3028	CrimsonRAT.exe
1352	dlrarhsiva.exe
440	dlrarhsiva.exe
1568	Lokibot.exe
5828	CrimsonRAT.exe
5892	dlrarhsiva.exe
5952	SporaRansomware.exe
924	Petya.A.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/4884-1207-0x00000000032B0000-0x00000000032C4000-memory.dmp	agile_net
behavioral1/memory/1496-1212-0x0000000002A50000-0x0000000002A64000-memory.dmp	agile_net

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Lokibot.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Lokibot.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Lokibot.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Lokibot.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
109	raw.githubusercontent.com
110	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

Petya.A.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Petya.A.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Lokibot.exe

description	pid	Process	procid_target
PID 4884 set thread context of 1568	4884	Lokibot.exe	148

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Lokibot.exeLokibot.exeLokibot.exeSporaRansomware.exeWMIC.exeHydra.exeFlasher.exeFlasher.exeFlasher.exeLokibot.exePetya.A.exeFlasher.exeFlasher.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SporaRansomware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokibot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Petya.A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exe

pid	Process
5132	vssadmin.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{66DB62E9-DC4E-4346-BCD5-A8C9322750A6}	msedge.exe

NTFS ADS 7 IoCs

Processes:

msedge.exeSporaRansomware.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 269680.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 570008.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 114898.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 744376.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 364762.crdownload:SmartScreen	msedge.exe
File created	C:\b0362fa4-82d2-0353-75ce-45d6e1085895.exe\:SmartScreen:$DATA	SporaRansomware.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 99562.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeLokibot.exeLokibot.exeLokibot.exemsedge.exemsedge.exetaskmgr.exe

pid	Process
3256	msedge.exe
3256	msedge.exe
2232	msedge.exe
2232	msedge.exe
1840	identity_helper.exe
1840	identity_helper.exe
3296	msedge.exe
3296	msedge.exe
2672	msedge.exe
2672	msedge.exe
3384	msedge.exe
3384	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
1220	msedge.exe
1220	msedge.exe
4884	Lokibot.exe
4884	Lokibot.exe
3520	Lokibot.exe
3520	Lokibot.exe
1496	Lokibot.exe
1496	Lokibot.exe
1916	msedge.exe
1916	msedge.exe
4884	Lokibot.exe
4884	Lokibot.exe
2120	msedge.exe
2120	msedge.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

Processes:

msedge.exe

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

Processes:

Lokibot.exeLokibot.exeLokibot.exetaskmgr.exeLokibot.exeWMIC.exevssvc.exePetya.A.exe

description	pid	Process
Token: SeDebugPrivilege	4884	Lokibot.exe
Token: SeDebugPrivilege	3520	Lokibot.exe
Token: SeDebugPrivilege	1496	Lokibot.exe
Token: SeDebugPrivilege	4944	taskmgr.exe
Token: SeSystemProfilePrivilege	4944	taskmgr.exe
Token: SeCreateGlobalPrivilege	4944	taskmgr.exe
Token: SeDebugPrivilege	1568	Lokibot.exe
Token: 33	4944	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4944	taskmgr.exe
Token: SeIncreaseQuotaPrivilege	5516	WMIC.exe
Token: SeSecurityPrivilege	5516	WMIC.exe
Token: SeTakeOwnershipPrivilege	5516	WMIC.exe
Token: SeLoadDriverPrivilege	5516	WMIC.exe
Token: SeSystemProfilePrivilege	5516	WMIC.exe
Token: SeSystemtimePrivilege	5516	WMIC.exe
Token: SeProfSingleProcessPrivilege	5516	WMIC.exe
Token: SeIncBasePriorityPrivilege	5516	WMIC.exe
Token: SeCreatePagefilePrivilege	5516	WMIC.exe
Token: SeBackupPrivilege	5516	WMIC.exe
Token: SeRestorePrivilege	5516	WMIC.exe
Token: SeShutdownPrivilege	5516	WMIC.exe
Token: SeDebugPrivilege	5516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5516	WMIC.exe
Token: SeRemoteShutdownPrivilege	5516	WMIC.exe
Token: SeUndockPrivilege	5516	WMIC.exe
Token: SeManageVolumePrivilege	5516	WMIC.exe
Token: 33	5516	WMIC.exe
Token: 34	5516	WMIC.exe
Token: 35	5516	WMIC.exe
Token: 36	5516	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5516	WMIC.exe
Token: SeSecurityPrivilege	5516	WMIC.exe
Token: SeTakeOwnershipPrivilege	5516	WMIC.exe
Token: SeLoadDriverPrivilege	5516	WMIC.exe
Token: SeSystemProfilePrivilege	5516	WMIC.exe
Token: SeSystemtimePrivilege	5516	WMIC.exe
Token: SeProfSingleProcessPrivilege	5516	WMIC.exe
Token: SeIncBasePriorityPrivilege	5516	WMIC.exe
Token: SeCreatePagefilePrivilege	5516	WMIC.exe
Token: SeBackupPrivilege	5516	WMIC.exe
Token: SeRestorePrivilege	5516	WMIC.exe
Token: SeShutdownPrivilege	5516	WMIC.exe
Token: SeDebugPrivilege	5516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5516	WMIC.exe
Token: SeRemoteShutdownPrivilege	5516	WMIC.exe
Token: SeUndockPrivilege	5516	WMIC.exe
Token: SeManageVolumePrivilege	5516	WMIC.exe
Token: 33	5516	WMIC.exe
Token: 34	5516	WMIC.exe
Token: 35	5516	WMIC.exe
Token: 36	5516	WMIC.exe
Token: SeBackupPrivilege	2500	vssvc.exe
Token: SeRestorePrivilege	2500	vssvc.exe
Token: SeAuditPrivilege	2500	vssvc.exe
Token: SeShutdownPrivilege	924	Petya.A.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exeHydra.exe

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2464	Hydra.exe
2464	Hydra.exe
2464	Hydra.exe
2464	Hydra.exe
2464	Hydra.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe
4944	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Petya.A.exe

pid	Process
924	Petya.A.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 2232 wrote to memory of 1648	2232	msedge.exe	82
PID 2232 wrote to memory of 1648	2232	msedge.exe	82
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 1164	2232	msedge.exe	83
PID 2232 wrote to memory of 3256	2232	msedge.exe	84
PID 2232 wrote to memory of 3256	2232	msedge.exe	84
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85
PID 2232 wrote to memory of 2364	2232	msedge.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

Processes:

Lokibot.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Lokibot.exe

outlook_win_path 1 IoCs

Processes:

Lokibot.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Lokibot.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://w
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c68146f8,0x7ff9c6814708,0x7ff9c6814718
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Users\Admin\Downloads\Hydra.exe
  "C:\Users\Admin\Downloads\Hydra.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:2464
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4896
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:696
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3832
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Users\Admin\Downloads\Flasher.exe
  "C:\Users\Admin\Downloads\Flasher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1076 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Users\Admin\Downloads\Lokibot.exe
  "C:\Users\Admin\Downloads\Lokibot.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- - C:\Users\Admin\Downloads\Lokibot.exe
    "C:\Users\Admin\Downloads\Lokibot.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1568
- C:\Users\Admin\Downloads\Lokibot.exe
  "C:\Users\Admin\Downloads\Lokibot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Users\Admin\Downloads\Lokibot.exe
  "C:\Users\Admin\Downloads\Lokibot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7460 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2152
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:4940
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1220
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:1352
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3028
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5720
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5828
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:5892
- C:\Users\Admin\Downloads\SporaRansomware.exe
  "C:\Users\Admin\Downloads\SporaRansomware.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:5952
- - C:\Windows\SysWOW64\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\US8B0-24XET-XTRTX-HTFTO.HTML
    3⤵
    PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9c68146f8,0x7ff9c6814708,0x7ff9c6814718
      4⤵
      PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,14385215359452753358,3263661825232140040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4212
- C:\Users\Admin\Downloads\Petya.A.exe
  "C:\Users\Admin\Downloads\Petya.A.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4944

C:\Windows\system32\cmd.exe
cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
PID:2144
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5132
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:624
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CrimsonRAT.exe.log

Filesize
1KB

MD5
2d2a235f1b0f4b608c5910673735494b

SHA1
23a63f6529bfdf917886ab8347092238db0423a0

SHA256
c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884

SHA512
10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Lokibot.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
3fa3fda65e1e29312e0a0eb8a939d0e8

SHA1
8d98d28790074ad68d2715d0c323e985b9f3240e

SHA256
ee5d25df51e5903841b499f56845b2860e848f9551bb1e9499d71b2719312c1b

SHA512
4e63a0659d891b55952b427444c243cb2cb6339de91e60eb133ca783499261e333eaf3d04fb24886c718b1a15b79e52f50ef9e3920d6cfa0b9e6185693372cac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
40dfe9f3e652636dd931a0fec08c9175

SHA1
3c70a06e4f54814239a24705cfd898e1add5cd7e

SHA256
d63e71358bf8968233b6ee1d32ddaacd79edd239e5775503167ab90e375f1ef6

SHA512
42ca2709a80d37c6125038d2ea81d75ae23f4a742fa30c47344a2a757125a02747e7b7830261f58b2064041fe51a3313796088e1daf48884d10a7d9a5672be93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
37KB

MD5
1b6703b594119e2ef0f09a829876ae73

SHA1
d324911ee56f7b031f0375192e4124b0b450395e

SHA256
0a8d23eceec4035c56dcfea9505de12a3b222bac422d3de5c15148952fec38a0

SHA512
62b38dd0c1cfb92daffd30d2961994aef66decf55a5c286f2274b725e72e990fa05cae0494dc6ad1565e4fbc88a6ddd9685bd6bc4da9100763ef268305f3afe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
21KB

MD5
be89131819117173abec1e1a375f1ac4

SHA1
94537cc74677b671d9cf475b57ea11518f4c84bd

SHA256
e85deb52f4f7aafd50e84d48f26c6fd65dd58c42adfc0c6f7cd043d93fba2e93

SHA512
e2f033b4df28a245d3fe023db83ee4c3f9c64904ddbaf3880a0b429548ff6d7074f2bcaa0396042d361780c7f93a51e1f8a0de4154dbdf721cc6078ad9f29e5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
37KB

MD5
3ae7a1fc24a2fc360d0911d5074311c9

SHA1
b94f593d8789e38908e86e75bf5d4795fa14f4d7

SHA256
3e687d87510e90e494e83e1f064cc388577ff85bbf9798044ccb2c274b0ee18c

SHA512
c82aef8ad194a149f55549e7ac903bb18601ad765e63aae0550feabf6699bcaef604be165639979e65bc9bd1fc680d67a76ece63b4338148bb2ea6a5a731bbb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
24KB

MD5
e9085bbce2730ad18477a5e6b2a053e5

SHA1
81b04f132e7c01d796d1730cace6a922eed47c5f

SHA256
0d3da8c2f0f202ed280cfc0ce71a43264f3793e1f7d5a837822ebed5ee1af188

SHA512
80f905992a6be57b31da4e63f69674a2c9a3c3f0e8c182103afd12d60d689936c5ac76a32bc809b672c564b9b65f1608960be800e72ce058842c698d1bea9fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
59KB

MD5
d5da1cc03ddee197a316010d5c41df05

SHA1
39a2021e9daacf3c6f1f8146dc788a7968a3442b

SHA256
a114702bef93ef5d0518d242f5ea247ff4072ceb7eea451e5681e4b4e7387ae9

SHA512
5cc05a34e9eec5e901402477e41a7263f0f02a8f31fdc06b08e0453e7ad50f55717f230a5c992bd1dbef8168c8b69daa2d2982a29449329a0cb207d14bc8fad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
144KB

MD5
521af33c55174ecf75a05833f8109ff6

SHA1
897f21eaffb962d3c805576d06f07c820acd18b5

SHA256
a3c75bd51b37662153258f638dee394ec4f7be139bf3844e9166f937aedd6324

SHA512
88b44345081129b9c9a4b81a6a83fdadf93f4ce9fa236f8befbc172fecb649ade758466e2c44be30f987915477a9f4abfcdbd1baa67932821b861dfc6f83e682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
20KB

MD5
e81e6ee2a2437491435d0be4f4a6bd6d

SHA1
5070881fe9886694f92ad5db9ef4a931d5444ccc

SHA256
2176a2d4851cc89a9924514ce5d7a0808d5c009bcde0f4c97c03f3c9c073097f

SHA512
af6b56725f125a25f36e442317b0cf68ecc44eee34c3955c0f5c21cc023ac036942f8e4a89b9b1c04796e8304ba43598dd5fd643abc9c06f47d558ea5c531e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
69KB

MD5
23f3fe977c11ed9c6a8763950d58c19b

SHA1
bdf5fde1dd97e7a6d426081dbdb4722d3c595bef

SHA256
0304e350ef79b8dac8e841d9a4b5e1796d1d3a71d50831937a55ff12e9d0def7

SHA512
ec656d70675b717eab7bbd1043a731cff1481f2a83221de8c6ad523b35b25ea11614af1558e56c0f804ddb3f2be61ae788fb3f0ae5628ad770df98177c12ec52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e76a644cedd50e7a227b91ef5006da41

SHA1
84da7a61a1ffb1497707185daf405f98201428c5

SHA256
892cada405bdd6cb2dd7512446ccf67a59e14c05d9e72354d5c9a32cf5789356

SHA512
fa969c282969fbf1e6447fe77831374ef9401b443bd4f3a2be552aa24b189c35625a5c0843a2f4a20876ec69a176925ce1838347cfe949f33a2d0c54774b757c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
a16b4227e55883194cc1f1d5eefaa9eb

SHA1
993caf38722314ce6a891d69d371e3160eff6a9b

SHA256
3bb744ca4b4f49b6c9ce54ef0fc1bcd4777b5d41e6f878ebdc4d306b0730e018

SHA512
53129a1ff59af8b4e63258bc7755aa12cbc56f9bf6908773235de2714ed901791c5390c512fce71d6ee59a39d57f66ee6992bfd41cdf7dae136b805233cb0db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
867B

MD5
dddb9949b5fcf8a7b9ae8c08a11febcb

SHA1
a9968a4b5e64747ac99820a3c2901bd19650cda8

SHA256
34a24a41741183e20e899be03919dabc6e81d7b58b1f2afd6e78922c9c9bdc6d

SHA512
e6b79c6026929c1ffbf47e4de190c293e6e48f81d3cef9be2da066232249545fa7b8457b8a9f5db4b0cc8ff03ea69611d8743c74228cadea54fe8d46a496148a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cc6b6ced2838fbf33df2e43ce814406a

SHA1
b0cf7e618b601a535b9cd6e87a686ccb135e0a0f

SHA256
ceb6c34e1ee6a55192a3c4fa40a7ace4914ebc9bbb254708f3b2219cbbd906da

SHA512
5219643380aceb3c9766702493469f5d1338a93114488370959c996bc1d88f852a4f85fe31083053d572f7ec1824121ecbfaa20107b380a4627e47c3990838b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a4c8dca6e307283a3c9480a6b5668485

SHA1
31646a0f7e88d698f9b554066075d7803d35bc9e

SHA256
33e9e4c16c97e2dc377a34ac041ddbc1178c0d1e886315731afd671a1c3f5d4a

SHA512
47f4c677df2b1e6d564465e4e39504e6d389fbbd88be15315b66f0d8e62deaebcdf3425f41271a6ffd3ff840d1c5377add293ab0dad8588fc3eff4c38993728e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f54daae1a8b9ecbd38de8d2aef21cc39

SHA1
e288240789f592a344887fadd00f41c727530db5

SHA256
68a03c20cb9297c8f58314103e1efeb12443ba4a0825e04a8edf66ceb8496fac

SHA512
032ff182a290fc83b3d82413291b81fd1a928f1fcd533ae5734f2ae863c1c616f71d3152cba7e3dcaeb9741b590f91511bb284d325505944c13a5b2044d493ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a7f210890c3a79a334cabda020516d4c

SHA1
6ae6d270ffa7b9716baf20da08ab17df7f150c45

SHA256
af9290cc62acf25fce91f59a53110161e4202c89199e9fbf0cb4509dd9187171

SHA512
1fa942d3585b4781e79943473f38be0b8a4a1b5ab0ea2d6ad0db535a22c5cdf7962d49aaaa6c424c52ec41c4efc4ed8075e0e08504fd29c672ba1803fc1e8fd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90240feb922ff7764018cc15811f2db9

SHA1
46589be70098ee674ba52f1865bd2fd4193ddcbc

SHA256
a9868476248e2ecc510d4a938514e4b0e161ae8b447546849535f3f9e8e3348c

SHA512
7bd14d609b39653602f43c5cc0a77ef39ee9d1c7b67e15d7f2f534d6a7c78f2d697cd35bb3eea80e65def9f6ed135ba43c065301d0e2689262ed1cc0b143021d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35787fb2e1b8d28e1c0917c05748d87b

SHA1
7b80123f8cea44a8980b6b2ef76803d8cdb9c3b5

SHA256
1f9c687c5327af504bc59496f6ca804c9a5d67aa2a9366d95e60c0b1e6afc494

SHA512
b9f274dc2e11705f04c54bf4c5ca99a9edccabf221ad1a4384b0a65f540c7dfdb8ced18d4ddda5ccbeb137201cf21dc830eb85f0a9ea37d562dad48d9d5854b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8a37d38ec30220c75f894a8e627cd44

SHA1
48468b58b7c661cec44f5dd41811eefba591deb0

SHA256
bd7a3eaad7f4d78f038918b40d93f80f84d6970445517af608eb4bbb774f1943

SHA512
8d24ebbb55fef591da6c19140d57631e43f33ec8d787c5e8f2ec71ba509b878c475fd3548e3b8974bdcb4ec2803a8601cc3757b0f41bf17994a0c9495395617c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa538f64048da3ee31db29261006b434

SHA1
07a9d5b8b3f095afdd7eb986f8e8bc369adf33c1

SHA256
cbfd4996c0d96d80658dddfc30e2d25655ebeea4a80f0dcdd097a4d21acd0f16

SHA512
265bee36ca78cc6e2a7e2d0f437c82b6d50c450ad85c64b3ed25a8c84e6d95d0900d856e86ff18bacbe3f172254633fa7d4041e7ea9555ccb38e23092505159f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d1acf085ff1663c3516178e3647eba8

SHA1
bc73d6b3f1236611493a8d96205ac2e034965e89

SHA256
da3f8a7bfa5c7e3f22928a5203c4fa3324a0a0414356f8dab4c211434ddad77b

SHA512
9d4b72f25a28b3a71104033fb1e28d355164caff465105d95ab7effc8af9a7b1c968a89135542c099fe8d7f674a0ce4e43aba6280d794a026c429e676041c2c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9ba81491605a84176c1d3287143133ef

SHA1
9331684f10bbec2362b0c1ec19ee43adcbe7d66d

SHA256
96d952c2f8e979690dd7c6305bfa73911657fa9d8fe948a9fe5864c696df0e46

SHA512
d07753029d17ee8722f6b984ea728386741d3af04c8d7eb852f5c035f35366739bae556e4ba751dc6fd6ddbb2317fb20e174b7b66e8b8f2235fef455ff3bff02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
65e1ea4833856a8aeaf8c361b5aec029

SHA1
baae501695d5982258b07d6780ae854f9fc0d00b

SHA256
11ddfa55ecc3ec909f5ed4062201f68933a2f3a21ab8cd1d4328d78bd4459b4d

SHA512
6498da7f3c676f1ea1b6f0fa483383f311e12557ffdc713d32084d0761d896d27a72a27b4775c244ba5f33cf6ef373f92185716fd04989f07186019624af62cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1648d5e545f01bb073963b01e5bc0de3

SHA1
47eb42b34e1bb45e853a89ab890490261d2337f9

SHA256
69621e1fba2d5ba1fb4343eb7a32aed6d6b5872db2971e631198a1b7e9d03bd7

SHA512
1993bc06ce3b27e31f054371d82d2f015b1ba3c0897db2f72ef402909b5bca789d81104200224174e53cf50f6d61d12f5aa04766b89f1383d4aa4fc5a2445b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
89955842c38401c815550c5c3e9663fa

SHA1
871a2d3daf8751cbbd85f5747354698339dea277

SHA256
a20400bc4f9ced4237a449bf3ba204277a7de26bab9ddec5356afbdc3e77f0c1

SHA512
8c6cfd1cedfbe4bdb94dc553e48260e48e8e50fd7d532b8eb6e61f2684ac3e4cbd3eb0c398612f2a9ddb01d0ca2a518360a5ff43d526c49b517b51ad73728fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
58cb7e156a43dddc49ecbaa049a9231d

SHA1
b0ad0fb35645cf2f42910658768a812e08aba3cf

SHA256
8b170d4a239847460e90e434cdc0e6bb3359db34c43743647ead6d4a8230f973

SHA512
5cd508404b59ae777c8e62e86c5e1b14cfabe66cd51e9a7a29aa44fdb797a9070dc8be94daa7844597059f25d0026589ebf748f646efeb093c0e2171a9786481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c3e0de47b95b6ca41cfc24acc99fb391

SHA1
9f8a79d040fbf4dd9a70e3239ccb6d3012cde540

SHA256
65f8b4bb8e3ff2d03f6605378ae8dff97d267926525f113df887a7b9de4d8ea6

SHA512
449f80440a907ed02c458a990f3219fe6390a7df306dc5c3be4cf09b754370bc61845a6fa07df49242d5aff1960e258e00fc53a841788965c5d70451af12636c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eeaba2e622dc161cd5b74f3f6779213b

SHA1
1bea87ee9803c244e520b8c33ea9c411fe0f9307

SHA256
b64c57a5e4211b80903b5223f5242f5e03f4337c0d4f4025316a89e4a7f1d2b0

SHA512
edd23ffd50d609aa8ae4133348fdc56d0e90599e5a1ac3563e7840c0cd32bcf3ccebb46597007445d62b7eaccddd4c13b4195979e7978f1797c1a9054796d5d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
743ff4b6adf61fcd7d953961b73fa996

SHA1
9a14d7db803476e8f7728a9ad5b855e686510132

SHA256
5944bd3dd14fb96e93eec490edab7aa4ce3503af8bbe6ad24e9a79202e82b22d

SHA512
af8b26839d927f8d0eb13c299a866ad3004842778da5cf0a77df99769b0fb889017b472ecf27ddfc3d553359976c45bc875826f3ec4f69b99d2ea2de7084ec1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
afce7332777b2b5f25b867e734851a07

SHA1
26c28212c92f10b6f6673fe04a46ec58039cdbda

SHA256
c40d014286ea19e26502d50804ff972674b8feab77ec0281744eb5517a614506

SHA512
dffbfe7e6054203a653918c4e99d9df9c8bc847ab6c5bff1dfb4662144821d406aedf50f008e86eafc086e5ef2a76e95078bad9d5d81bbe83bd43aaffa17e708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c95643c8e5b00a233b11b6f56f1327db

SHA1
e43ed7b72e08ddcdc6de45798932bdbc8264eb90

SHA256
4cae1732678e4c806a9face42e98976cb51559739895d14a9fc8e5c15feb1d7f

SHA512
516c9adf56dc6ea0de7707ee988e046365a5666dd52ccb17b408f0e48c26b262ce58d7f349437b0b0790ca66be6a5d4788bda421a4b8090faf44ad42044a47dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7fdcfad2d84ba5ce62d7a9c838503ace

SHA1
07e4eb7fce773179ba6ea9fe1e1ec879ac6e8fe4

SHA256
f55ac2ff160363c9dc67535c3bcb7bd533050949039355cf0131ab2f5835f312

SHA512
865dc0b92899bb7c1b3a62dbad89bd4ab59c05eec30dc06b40829e1dd52d3075c8e69472a5ffec8cd69aacdb9223da91fd1ef7b996d24af9a0bd2f9b6ff16f78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588b63.TMP

Filesize
538B

MD5
ba020847c2ee60f000334e775d6ba8d3

SHA1
e2007364b3ee658846c09bfb400a582ed721fda9

SHA256
f2a8e46e6d5f5aa6cc74120abb8bc947eb7e7c893b8d129cc520f971671ea964

SHA512
3e3576a136b56f54cf4000853c8a867e2cdbf0838040c58febceab9861dd78d0bd0bf4215962b231ff14ec6e531cf2d7be3e1df035edbce70b8edee28f4b0a94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed2adb9b4bb98a982745427ca50ef476

SHA1
a598abae7efe3b4c674f4be987143ad67fdc1a97

SHA256
69dfc475854f18dcf0ec76f72584c11c7c90686ce6b70073945a2596007ed70b

SHA512
020b4d60be1dd920f356b31d81e12980bdc220b57e133118fc9e6224f5fc326b6f850f43620ce9c7a37006d806bc9e3de46802f5208c4328f65149f77b2a6650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8fc71c30d21628581ed53c8a0d9d37f1

SHA1
cefa13a8310d4968f40ae7b9f2c6bf87db8a20db

SHA256
e9d494ec7ba79eccf66f9c55905909e62ecaabf1adcbf1e5a56951f64191f897

SHA512
023a70e0fac5b9e40184bdb02cb62abde561c71315ba0e655372d26230604bcd1932d75c0c79654cf55934e557525ed7d00f4219eae7f330f69bc856e6fafb26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
32339b3dee519913251d804a94fddf36

SHA1
b4a8943400b4aafe13fce020fe1af69883f0e60d

SHA256
6ba50a0d38191f49c93106c3f669fcaa8b8b1176e490d159e11879fa9fad464e

SHA512
6b16b3351867dddac8ac5efbbc92d5a67b4999ab7fc06e13bada393676da775c141cead9ccc7cded7f1b736f1fa94a6bc841c03b63dc9824433d72328ea4a5cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cc3d98e9b1deb6cdadac5870aa97c49e

SHA1
dac57460554a04975e6eba434d0d298e4b43cfa1

SHA256
e574acc5054219db5448825d968c2ee86823a2860cfdc4df9fb5612baeb132b4

SHA512
581ece9fc5f03bd016c2eeb74bb9bf8a15d188ae2f130d3f48265647c4244561028a65479418a44907efe3622b5283c26fbce70b3a932e8f72abf34240d676fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fbcc79dce015d17196e0200fb8831bdc

SHA1
894921d98fee27b60b256ce485ce3020d0022b2c

SHA256
285d7cd1b760fd0c613509550736b123c8f78fa4b39854a8a30e592b2cec59de

SHA512
9371c4815bd313bf4b6f14b6a1882db61bc5597d0bf349d38018e85b9c8175ea5f02a80d478300a350df3ebc2c06313a9808fabe2507b551c51279d2c005e8d8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\0f5007522459c86e95ffcc62f32308f1_a53bb4ca-6113-48bb-9609-441860fdd0d7

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\0f5007522459c86e95ffcc62f32308f1_a53bb4ca-6113-48bb-9609-441860fdd0d7

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\US8B0-24XET-XTRTX-HTFTO.HTML

Filesize
8KB

MD5
f17dbc0257703ecea9d0e774cfcaf464

SHA1
2c583ec6f9e512c8691ab05f8c6c787667cf6675

SHA256
4a5b1d9461723296f22c53854934df6d76a38eac165b1878070f4303663b2860

SHA512
99d2cea1bf5548c2bd773f6cf2386feed9c17370fb0977cdc69b65812e3ab8ca8babbc37bdb01608fe253db159873b34313d39d394783af68235b06063e677ff

Download Submit
C:\Users\Admin\AppData\Roaming\US8B0-24XET-XTRTX-HTFTO.KEY

Filesize
1KB

MD5
bc49276c77fcea0b3c2f5de7f1b39641

SHA1
ce9466394615832e2cd73f6499c2ed2bb39ca664

SHA256
66f0e7cf273156342c5f255f96e1499960c3a1ab594c412161c4b4a722b18b53

SHA512
a7f678cf715b7e1d6b0a8047ecc3b287e4d8723e24a74849f4212a50ee96bebb0b7c1f4d30a14ee7e91c113960036e107d5f064bd3f77c801aab176e70e8229f

Download Submit
C:\Users\Admin\AppData\Roaming\US8B0-24XET-XTRTX-HTFTO.LST

Filesize
3KB

MD5
ad6d8de1cbe6f0f159257de7fb319b7a

SHA1
b05e2026f11b6cd848014b805efd60e10dce3098

SHA256
8c38c1c55f8e9f3492888883f8d90db854014c2a37366822b3175bfb4139655e

SHA512
365ad7dfaf88134b1887adf0daa08635214c48d79c0f85ead1ca1046258a1223848458761ba92dc8ef6531a90bfb239c7d34d8194f969d22e27f2c458fd99d08

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 114898.crdownload

Filesize
300KB

MD5
f52fbb02ac0666cae74fc389b1844e98

SHA1
f7721d590770e2076e64f148a4ba1241404996b8

SHA256
a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683

SHA512
78b4bf4d048bda5e4e109d4dd9dafaa250eac1c5a3558c2faecf88ef0ee5dd4f2c82a791756e2f5aa42f7890efcc0c420156308689a27e0ad9fb90156b8dc1c0

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 269680.crdownload

Filesize
43KB

MD5
b2eca909a91e1946457a0b36eaf90930

SHA1
3200c4e4d0d4ece2b2aadb6939be59b91954bcfa

SHA256
0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c

SHA512
607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 364762.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 364762.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 570008.crdownload

Filesize
246KB

MD5
9254ca1da9ff8ad492ca5fa06ca181c6

SHA1
70fa62e6232eae52467d29cf1c1dacb8a7aeab90

SHA256
30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6

SHA512
a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 744376.crdownload

Filesize
24KB

MD5
4a4a6d26e6c8a7df0779b00a42240e7b

SHA1
8072bada086040e07fa46ce8c12bf7c453c0e286

SHA256
7ad9ed23a91643b517e82ad5740d24eca16bcae21cfe1c0da78ee80e0d1d3f02

SHA512
c7a7b15d8dbf8e8f8346a4dab083bb03565050281683820319906da4d23b97b39e88f841b30fc8bd690c179a8a54870238506ca60c0f533d34ac11850cdc1a95

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 99562.crdownload

Filesize
225KB

MD5
af2379cc4d607a45ac44d62135fb7015

SHA1
39b6d40906c7f7f080e6befa93324dddadcbd9fa

SHA256
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739

SHA512
69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99

Download Submit
\??\pipe\LOCAL\crashpad_2232_IXSIIRQRZEMDGNAM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/696-1169-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/696-1015-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1496-1212-0x0000000002A50000-0x0000000002A64000-memory.dmp

Filesize
80KB

Download
memory/1568-1385-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1568-1382-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2152-1296-0x000001BAFED60000-0x000001BAFED7E000-memory.dmp

Filesize
120KB

Download
memory/2464-953-0x0000000000D00000-0x0000000000D10000-memory.dmp

Filesize
64KB

Download
memory/2464-954-0x0000000005AA0000-0x0000000006044000-memory.dmp

Filesize
5.6MB

Download
memory/2464-955-0x00000000055A0000-0x0000000005632000-memory.dmp

Filesize
584KB

Download
memory/2464-956-0x0000000005670000-0x000000000567A000-memory.dmp

Filesize
40KB

Download
memory/2528-1175-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/2528-1051-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/3804-1194-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/3804-1054-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/3832-1174-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/3832-1050-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4884-1206-0x0000000000F10000-0x0000000000F62000-memory.dmp

Filesize
328KB

Download
memory/4884-1224-0x0000000006820000-0x0000000006864000-memory.dmp

Filesize
272KB

Download
memory/4884-1223-0x00000000066A0000-0x00000000066A8000-memory.dmp

Filesize
32KB

Download
memory/4884-1258-0x00000000066E0000-0x0000000006702000-memory.dmp

Filesize
136KB

Download
memory/4884-1222-0x0000000005E10000-0x0000000005E18000-memory.dmp

Filesize
32KB

Download
memory/4884-1207-0x00000000032B0000-0x00000000032C4000-memory.dmp

Filesize
80KB

Download
memory/4896-1168-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4896-1014-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4940-1332-0x000001FA43070000-0x000001FA43984000-memory.dmp

Filesize
9.1MB

Download
memory/4944-1397-0x00000200FE930000-0x00000200FE931000-memory.dmp

Filesize
4KB

Download
memory/4944-1386-0x00000200FE930000-0x00000200FE931000-memory.dmp

Filesize
4KB

Download
memory/4944-1387-0x00000200FE930000-0x00000200FE931000-memory.dmp

Filesize
4KB

Download
memory/4944-1392-0x00000200FE930000-0x00000200FE931000-memory.dmp

Filesize
4KB

Download
memory/4944-1393-0x00000200FE930000-0x00000200FE931000-memory.dmp

Filesize
4KB

Download
memory/4944-1394-0x00000200FE930000-0x00000200FE931000-memory.dmp

Filesize
4KB

Download
memory/4944-1395-0x00000200FE930000-0x00000200FE931000-memory.dmp

Filesize
4KB

Download
memory/4944-1396-0x00000200FE930000-0x00000200FE931000-memory.dmp

Filesize
4KB

Download
memory/4944-1398-0x00000200FE930000-0x00000200FE931000-memory.dmp

Filesize
4KB

Download
memory/4944-1388-0x00000200FE930000-0x00000200FE931000-memory.dmp

Filesize
4KB

Download
memory/5952-1465-0x0000000000400000-0x0000000000407200-memory.dmp

Filesize
28KB

Download
memory/5952-1631-0x0000000000400000-0x0000000000407200-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads