raccoon | 29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514

Resubmissions

24-10-2024 19:39

241024-ydfs8s1hqn 10

22-10-2024 18:15

241022-wvzassxhmc 10

Analysis

max time kernel
598s
max time network
601s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-10-2024 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
Size

916KB
MD5

507d8b23a93c2f5832c2585f1a6b602d
SHA1

657ccb76cf81e45114364e8ee287dce0257bc835
SHA256

29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514
SHA512

f7a3aa549267e6d84d0664ad152bf46ec87c606bc74e29750f2a5725a8fa0aef23f87362eee11cf9c6c7855d30c3592baa77f38975d47ab351d04ff64c6528ac
SSDEEP

24576:pAT8QE+kEVNpJc7Ycw4Th7k16ThM5dJ5Om46EYjdnx+Z3:pAI+bNpJc7Yc7dXUxOm46Fnx+Z3

Score

10^/10

raccoon redline 5 5076357887 76426c3f362f5a47a469f0e9d8bc3eef afb5c633c4650f69312baef49db9dfa4 nam3 discovery infostealer stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

176.113.115.146:9582

Attributes

auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

http://193.56.146.177

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

http://45.95.11.158/

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
behavioral1/memory/2660-98-0x0000000000030000-0x0000000000050000-memory.dmp	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
behavioral1/memory/1000-130-0x0000000000AF0000-0x0000000000B34000-memory.dmp	family_redline
behavioral1/memory/688-145-0x00000000004B0000-0x00000000004D0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe

Executes dropped EXE 7 IoCs

Processes:

F0geI.exekukurzka9000.exenamdoitntn.exereal.exesafert44.exejshainx.exeme.exe

pid process

1084 F0geI.exe
2728 kukurzka9000.exe
2660 namdoitntn.exe
696 real.exe
1000 safert44.exe
688 jshainx.exe
948 me.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

48 iplogger.org
97 iplogger.org
3 iplogger.org
17 iplogger.org
30 iplogger.org
36 iplogger.org

pid	process
1084	F0geI.exe
2728	kukurzka9000.exe
2660	namdoitntn.exe
696	real.exe
1000	safert44.exe
688	jshainx.exe
948	me.exe

flow	ioc
48	iplogger.org
97	iplogger.org
3	iplogger.org
17	iplogger.org
30	iplogger.org
36	iplogger.org

Drops file in Program Files directory 9 IoCs

Processes:

29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exesetup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241024234113.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\me.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d78aca59-d8d8-4bdc-868f-5dac7f32d237.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4824 1084 WerFault.exe F0geI.exe

pid	pid_target	process	target process
4824	1084	WerFault.exe	F0geI.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

real.exesafert44.exejshainx.exeme.exe29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exekukurzka9000.exenamdoitntn.exeF0geI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	real.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	safert44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jshainx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	me.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kukurzka9000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	namdoitntn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0geI.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4032	msedge.exe
4032	msedge.exe
1968	msedge.exe
4824	msedge.exe
1968	msedge.exe
4824	msedge.exe
3576	msedge.exe
3576	msedge.exe
5172	msedge.exe
5172	msedge.exe
5256	msedge.exe
5256	msedge.exe
2208	identity_helper.exe
2208	identity_helper.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

3576 msedge.exe
3576 msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 2548 wrote to memory of 4720	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	msedge.exe
PID 2548 wrote to memory of 4720	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	msedge.exe
PID 2548 wrote to memory of 3576	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	msedge.exe
PID 2548 wrote to memory of 3576	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	msedge.exe
PID 4720 wrote to memory of 380	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 380	4720	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2252	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2252	3576	msedge.exe	msedge.exe
PID 2548 wrote to memory of 1104	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	msedge.exe
PID 2548 wrote to memory of 1104	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	msedge.exe
PID 1104 wrote to memory of 2368	1104	msedge.exe	msedge.exe
PID 1104 wrote to memory of 2368	1104	msedge.exe	msedge.exe
PID 2548 wrote to memory of 2720	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	msedge.exe
PID 2548 wrote to memory of 2720	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	msedge.exe
PID 2720 wrote to memory of 2452	2720	msedge.exe	msedge.exe
PID 2720 wrote to memory of 2452	2720	msedge.exe	msedge.exe
PID 2548 wrote to memory of 2136	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	msedge.exe
PID 2548 wrote to memory of 2136	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	msedge.exe
PID 2136 wrote to memory of 2920	2136	msedge.exe	msedge.exe
PID 2136 wrote to memory of 2920	2136	msedge.exe	msedge.exe
PID 2548 wrote to memory of 1084	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	F0geI.exe
PID 2548 wrote to memory of 1084	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	F0geI.exe
PID 2548 wrote to memory of 1084	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	F0geI.exe
PID 2548 wrote to memory of 2728	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	kukurzka9000.exe
PID 2548 wrote to memory of 2728	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	kukurzka9000.exe
PID 2548 wrote to memory of 2728	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	kukurzka9000.exe
PID 2548 wrote to memory of 2660	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	namdoitntn.exe
PID 2548 wrote to memory of 2660	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	namdoitntn.exe
PID 2548 wrote to memory of 2660	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	namdoitntn.exe
PID 2548 wrote to memory of 696	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	real.exe
PID 2548 wrote to memory of 696	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	real.exe
PID 2548 wrote to memory of 696	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	real.exe
PID 2548 wrote to memory of 1000	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	safert44.exe
PID 2548 wrote to memory of 1000	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	safert44.exe
PID 2548 wrote to memory of 1000	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	safert44.exe
PID 2548 wrote to memory of 688	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	jshainx.exe
PID 2548 wrote to memory of 688	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	jshainx.exe
PID 2548 wrote to memory of 688	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	jshainx.exe
PID 2548 wrote to memory of 948	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	me.exe
PID 2548 wrote to memory of 948	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	me.exe
PID 2548 wrote to memory of 948	2548	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	me.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 3100	3576	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
"C:\Users\Admin\AppData\Local\Temp\29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc577446f8,0x7ffc57744708,0x7ffc57744718
    3⤵
    PID:380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12036433323060480401,8769660909096780363,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12036433323060480401,8769660909096780363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK4
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc577446f8,0x7ffc57744708,0x7ffc57744718
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x1e4,0x254,0x7ff7f71f5460,0x7ff7f71f5470,0x7ff7f71f5480
      4⤵
      PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5572 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17415168431616022777,15343760509669993429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x138,0x13c,0x140,0x108,0x144,0x7ffc577446f8,0x7ffc57744708,0x7ffc57744718
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,9755912286393124869,6175819385666751129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,9755912286393124869,6175819385666751129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc577446f8,0x7ffc57744708,0x7ffc57744718
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13477563917126437647,14336045451505375077,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13477563917126437647,14336045451505375077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nN6Z4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc577446f8,0x7ffc57744708,0x7ffc57744718
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5855665860827140158,376144295482417792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5256
- C:\Program Files (x86)\Company\NewProduct\F0geI.exe
  "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 1280
    3⤵
    - Program crash
    PID:4824
- C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
  "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2728
- C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
  "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2660
- C:\Program Files (x86)\Company\NewProduct\real.exe
  "C:\Program Files (x86)\Company\NewProduct\real.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:696
- C:\Program Files (x86)\Company\NewProduct\safert44.exe
  "C:\Program Files (x86)\Company\NewProduct\safert44.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1000
- C:\Program Files (x86)\Company\NewProduct\jshainx.exe
  "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:688
- C:\Program Files (x86)\Company\NewProduct\me.exe
  "C:\Program Files (x86)\Company\NewProduct\me.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1084 -ip 1084
1⤵
PID:5480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe

Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

Filesize
669KB

MD5
b5942a0be0b72e121dadb762044f38cc

SHA1
885909607a9747c11eac6cc47b775ad947980c5e

SHA256
c565dd409f6d17997285f6fcecf851c56ddc3129c2a777529e8470290565ace1

SHA512
d2a916738fca01b6b5a27639fbefcc7406e79f8493d8f69015c60d07d0341ab8aa8e4e3ab50208161b7398bef62b9837e11524ffefc502b9f09efc011974e3e7

Download Submit
C:\Program Files (x86)\Company\NewProduct\me.exe

Filesize
274KB

MD5
2eee4c301ce357df8f235957fcb774b3

SHA1
f9fd1eac58b5f40475269a1e8eb1675227e2389c

SHA256
66cc79df9054fda09648b64a230427d4a574f8349de871e922fbd20432b431f1

SHA512
590589c3f8ee16f12539b943ba04402771372fe7748fb689c03b5681466ec8d3f3778007224e0a7fac1413f188aaee59a754cad2d0194af1130a8ad3191466fc

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe

Filesize
275KB

MD5
a2414bb5522d3844b6c9a84537d7ce43

SHA1
56c91fc4fe09ce07320c03f186f3d5d293a6089d

SHA256
31f4715777f3be6a4a7b34baf25ebfc7af32dd9a2aae826fc73dca6c44fda173

SHA512
408ebb002b3bdb77dc243ced28d852801e68e5ff0dbfa450d3e91b89311fe6a3e8473e749619c285c1a5427d8a117350a3798435ed38b56d1a230f0ae270ec60

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe

Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5488f187-0f66-4624-aaef-eba8bb07cad1.tmp

Filesize
3KB

MD5
36e3793751af7c9ddcd5fc608bdecb83

SHA1
195ba8175092f45baa4326c0eeda5d119398bdd3

SHA256
acc1cd70d3e373aee1e6fcdc16ce0c38ac337c7f65a9d41074dd3a3b7cf47137

SHA512
c5cb4ceb5d965442ab689ae698ab054a590dfb60549cdd16ceac2694e5d678391cf2ae82ae3959fab021f68fb1e5936a4e6327db060e28890c3b181fc43e8af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef84d117d16b3d679146d02ac6e0136b

SHA1
3f6cc16ca6706b43779e84d24da752207030ccb4

SHA256
5d1f5e30dc4c664d08505498eda2cf0cf5eb93a234f0d9b24170b77ccad57000

SHA512
9f1a197dccbc2dcf64d28bebe07247df1a7a90e273474f80b4abd448c6427415bace98e829d40bccf2311de2723c3d1ad690a1cfdcf2e891b527344a9a2599d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39191fa5187428284a12dd49cca7e9b9

SHA1
36942ceec06927950e7d19d65dcc6fe31f0834f5

SHA256
60bae7be70eb567baf3aaa0f196b5c577e353a6cabef9c0a87711424a6089671

SHA512
a0d4e5580990ab6efe5f80410ad378c40b53191a2f36a5217f236b8aac49a4d2abf87f751159e3f789eaa00ad7e33bcc2efebc658cd1a4bcccfd187a7205bdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fbdec13197e8603945c69087eb128dc4

SHA1
46646010a6fbb74506875c62ca7575fc5fae24cd

SHA256
14b863289d40fec5a8f8499ca50c1a9f1b8facccc4862f3b44094dbae593a3ba

SHA512
012a75ac7eac29a7de0ff42e307dc7c99253725c693da120670b557551e5e030122cc2d72f9f92c48b4479bdd6efb53f776f37da970dfae56d6bc720dcba96f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d4c4de70b4a6d1b70c1d3cc46cdf1c0

SHA1
d26918757f79cba3c579e1f34423efd8937e5a9c

SHA256
f9496451faabf410fdad0463a3e94be1e33c8e77fe9a4c468f0085a709c41896

SHA512
9a10f7043f5b922485397fb8c3293158e2b07635b7d302112861f890ecec6e34918c8023d70b96a1eef08827dc301e2ed385bd5f1bde592a3f5a8695ec555a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60d82bd601d64fd00bb0373f5ecd65b8

SHA1
0e8bde426270dfa3ea285c2c5b7282ab37771d4c

SHA256
bdec91a5061c6a400ef33c2dca5b1d0c16c1fe9e464f8ec99a72442b752e6a97

SHA512
5ea1b33784438acd246c02c95716f72c78293bc8d8e8e6d71aeaab370ae9fc2063ba8ffa443bbfc26c96e45a95549b62894b846a459c986531b34a110d0be38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
2cdf3bade3f9eec7d1d4d8772ce465b6

SHA1
bb0bb60d7c45550db20671ec3f428da31e30e3c5

SHA256
be46d7a9ec6c233b2e7edec76f0cdf377feb2149e9b046637e682d9605be6749

SHA512
cfc25b5bf1d0227333a6143dd545d9bd841fa315ebcfa63d12fc8eef054ff56db5e02bd51b2adddad9f68df0a54e39524d1fe8631f43ddefa5bb728ae65179b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
fa05bc72653335fdc87096608727e7c1

SHA1
3edb10580046c542c11e4be6bccf6bd8aed653f4

SHA256
7f770d6069b8384ea68d028491f016c5961969b94f978d074fe57787834666cd

SHA512
6f26871f21aa1849b18c7b12cd4d96e209bc57d4dbafd0b54c6861eae42d5b55756968a4746bbc70323aa2aee4175a29d202e7b0af9aa1d95386c6032cfa257c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
6e4fcf4525877277de4fa7904e685c20

SHA1
6b45ab552a687f5c88bf92e269c6c96d41588575

SHA256
02a9eca91ca8e7e291c570717745ca200ebb8f59a00ea0ab72e34739aa038d0f

SHA512
60c0b10d69c455cfa99926678afec83489aa643578a197fb483482b7a3e9e926c740e601e5511e4c8ede17a8d4196f6e67ec76aee3b52300215b1ee2a7e003db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
593b9b7b73f42bfaa30c05a6de716c8c

SHA1
1b5678b6ef677af475233e85a862934059eaf9b3

SHA256
b9f4e6d3836f54deaa9d148d1ec0006d17f381cead24f0d78b45479515ed0681

SHA512
594bc0f54312f259c18893ed3da628a2b960ef15c269be732ad88b972578c70fa71e28364384cc604498226daf7eca5ec5b3caddcc9ffbe2ff936dcc75a39c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
483e4dca5d0ae2559f19347221096abe

SHA1
9b413b628e16fa5c807182d21298f0a6535a0933

SHA256
0dbd3e863b979017968d3a029b8a0416b5b4035b99b91b040cf7f1e00d40bb96

SHA512
660ca09d6cee72abfe771dafde4ca4f989ef39008920f2ee7a3460025177eb6e7e9c9d42cfedb23ae1b71ee40348f13eac3ba792d0b6ac94a1c90d986d59ba0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
687ee1e36d207ec52c9dfd1531433166

SHA1
7791f453ed5a7347b1c0745f9cb3932e5aba013a

SHA256
ab4f83ce15e0e5b9f1d2a24c0b1a1397cee8848fdfdf203a2af250d84148016d

SHA512
3b4270b3a20c615cbe9f7fecff098fd4bc431b498bb57d5a5f1eed2bb84f2ded3235e12e52f5e591fd5d89453f5ca06be32af5fe05657a998b6a329566e76a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
d877c6c127d4961d6ac0a9c7d2ed283a

SHA1
a25bf9981083aa0d316206921e91d85ef5b4409e

SHA256
f127861747eee2acec48d615571dd33bf9d838d75ee65450bcaf6a38f90ccfb2

SHA512
5243ef75438dbf4bd5cd51377c7d6a80962ee71b0942555d5a48a2a90830548d7ea0707756d3059b7809a605cdf2bc2e4823cdac76c6eebe583b418738789481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
34c1a3589f54158c55c39816346c5cde

SHA1
583551044fa613af277faaf1fe324a63a1828c84

SHA256
1bb8ff7124f3772e479622edc1187d000674f4aec1be19b2aca949e48cf93e30

SHA512
d4eb1fd74d05b241d0152b0b1c4791236706de406584f0c0266b5147b0fab8f70824fe3eb919d30bd33b08898f7b41b30b07d86217952b448102081ce270fb72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
ceb20f2ac857087b8515d295e924374d

SHA1
b01ea722faa85e73f909c38215b99deb3bb85b8c

SHA256
2915441641a3bb0129bef102d5c37c22a53db5369151f2b3701e761eb53452fc

SHA512
1b11c8a1293cf7d6f0f5d918bb9a7d35e7a4cf2ad120a01b44d6af213a6b7b78fa50568f4812c4753bf4ec59a33677c5752fa65c65c690707094e0897e863c58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
c8084696b40a6ac8b9308b5f37d6d1da

SHA1
243fa660415a142c71d61d02aad1a82dbc408dc5

SHA256
d71661942992aa30061e4763417db65111bee367911ad6e8867bed4f58f41bc4

SHA512
5f254779df683789e66ef890b9752043eec44af704b1566c2636b7854538040473b5ad3f8a8b825c6500b293d408ef520ee31eb427ab6f1d131ec9d158c4a616

Download Submit
\??\pipe\LOCAL\crashpad_3576_PSNDTNJRWRFHOPVG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/688-145-0x00000000004B0000-0x00000000004D0000-memory.dmp

Filesize
128KB

Download
memory/1000-131-0x00000000012B0000-0x00000000012B6000-memory.dmp

Filesize
24KB

Download
memory/1000-130-0x0000000000AF0000-0x0000000000B34000-memory.dmp

Filesize
272KB

Download
memory/1084-379-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2548-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2660-163-0x0000000005040000-0x000000000508C000-memory.dmp

Filesize
304KB

Download
memory/2660-141-0x0000000005010000-0x0000000005022000-memory.dmp

Filesize
72KB

Download
memory/2660-144-0x0000000005B50000-0x0000000005C5A000-memory.dmp

Filesize
1.0MB

Download
memory/2660-150-0x0000000006F00000-0x0000000006F3C000-memory.dmp

Filesize
240KB

Download
memory/2660-132-0x0000000005420000-0x0000000005A38000-memory.dmp

Filesize
6.1MB

Download
memory/2660-98-0x0000000000030000-0x0000000000050000-memory.dmp

Filesize
128KB

Download
memory/2728-292-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2728-97-0x0000000002C20000-0x0000000002C21000-memory.dmp

Filesize
4KB

Download