warzonerat | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/RAT/WarzoneRAT[.]exe

Analysis

max time kernel
48s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/RAT/WarzoneRAT.exe

Score

10^/10

warzonerat discovery infostealer rat rezer0

Malware Config

Extracted

Family

warzonerat

168.61.222.215:5400

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/5432-212-0x00000000059F0000-0x0000000005A18000-memory.dmp	rezer0

Warzone RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/5860-223-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/5860-224-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Downloads MZ/PE file

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe

Executes dropped EXE 10 IoCs

Processes:

WarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exe

pid	process
5336	WarzoneRAT.exe
5432	WarzoneRAT.exe
5680	WarzoneRAT.exe
6064	WarzoneRAT.exe
6104	WarzoneRAT.exe
5612	WarzoneRAT.exe
5340	WarzoneRAT.exe
6004	WarzoneRAT.exe
5188	WarzoneRAT.exe
1088	WarzoneRAT.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

48 raw.githubusercontent.com
49 raw.githubusercontent.com

flow	ioc
48	raw.githubusercontent.com
49	raw.githubusercontent.com

Suspicious use of SetThreadContext 10 IoCs

Processes:

WarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exe

description	pid	process	target process
PID 5432 set thread context of 5860	5432	WarzoneRAT.exe	MSBuild.exe
PID 5336 set thread context of 5868	5336	WarzoneRAT.exe	MSBuild.exe
PID 5680 set thread context of 5972	5680	WarzoneRAT.exe	MSBuild.exe
PID 6064 set thread context of 4072	6064	WarzoneRAT.exe	MSBuild.exe
PID 6104 set thread context of 4576	6104	WarzoneRAT.exe	MSBuild.exe
PID 5612 set thread context of 5724	5612	WarzoneRAT.exe	MSBuild.exe
PID 5340 set thread context of 5720	5340	WarzoneRAT.exe	MSBuild.exe
PID 6004 set thread context of 6080	6004	WarzoneRAT.exe	MSBuild.exe
PID 5188 set thread context of 4004	5188	WarzoneRAT.exe	MSBuild.exe
PID 1088 set thread context of 4660	1088	WarzoneRAT.exe	MSBuild.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exeWarzoneRAT.exeschtasks.exeMSBuild.exeMSBuild.exeMSBuild.exeMSBuild.exeWarzoneRAT.exeschtasks.exeschtasks.exeMSBuild.exeschtasks.exeWarzoneRAT.exeschtasks.exeWarzoneRAT.exeMSBuild.exeMSBuild.exeMSBuild.exeschtasks.exeMSBuild.exeWarzoneRAT.exeschtasks.exeWarzoneRAT.exeWarzoneRAT.exeschtasks.exeschtasks.exeWarzoneRAT.exeMSBuild.exeWarzoneRAT.exeWarzoneRAT.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exeWarzoneRAT.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 790821.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:SmartScreen:$DATA	WarzoneRAT.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3708	schtasks.exe
5708	schtasks.exe
5924	schtasks.exe
964	schtasks.exe
5808	schtasks.exe
5552	schtasks.exe
5696	schtasks.exe
548	schtasks.exe
3752	schtasks.exe
3452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exe

pid	process
4420	msedge.exe
4420	msedge.exe
4428	msedge.exe
4428	msedge.exe
3212	identity_helper.exe
3212	identity_helper.exe
5224	msedge.exe
5224	msedge.exe
5432	WarzoneRAT.exe
5336	WarzoneRAT.exe
5432	WarzoneRAT.exe
5336	WarzoneRAT.exe
5432	WarzoneRAT.exe
5336	WarzoneRAT.exe
5432	WarzoneRAT.exe
5336	WarzoneRAT.exe
5680	WarzoneRAT.exe
5680	WarzoneRAT.exe
5680	WarzoneRAT.exe
5680	WarzoneRAT.exe
5432	WarzoneRAT.exe
5336	WarzoneRAT.exe
5432	WarzoneRAT.exe
5336	WarzoneRAT.exe
6064	WarzoneRAT.exe
6064	WarzoneRAT.exe
6064	WarzoneRAT.exe
6064	WarzoneRAT.exe
6104	WarzoneRAT.exe
6104	WarzoneRAT.exe
6104	WarzoneRAT.exe
6104	WarzoneRAT.exe
5612	WarzoneRAT.exe
5612	WarzoneRAT.exe
5612	WarzoneRAT.exe
5612	WarzoneRAT.exe
5340	WarzoneRAT.exe
5340	WarzoneRAT.exe
5340	WarzoneRAT.exe
5340	WarzoneRAT.exe
6004	WarzoneRAT.exe
6004	WarzoneRAT.exe
6004	WarzoneRAT.exe
6004	WarzoneRAT.exe
6004	WarzoneRAT.exe
6004	WarzoneRAT.exe
5188	WarzoneRAT.exe
5188	WarzoneRAT.exe
5188	WarzoneRAT.exe
5188	WarzoneRAT.exe
5188	WarzoneRAT.exe
5188	WarzoneRAT.exe
1088	WarzoneRAT.exe
1088	WarzoneRAT.exe
1088	WarzoneRAT.exe
1088	WarzoneRAT.exe
1088	WarzoneRAT.exe
1088	WarzoneRAT.exe
1088	WarzoneRAT.exe
1088	WarzoneRAT.exe
1088	WarzoneRAT.exe
1088	WarzoneRAT.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4420 msedge.exe
4420 msedge.exe
4420 msedge.exe
4420 msedge.exe
4420 msedge.exe
4420 msedge.exe
4420 msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

WarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exe

description	pid	process
Token: SeDebugPrivilege	5432	WarzoneRAT.exe
Token: SeDebugPrivilege	5336	WarzoneRAT.exe
Token: SeDebugPrivilege	5680	WarzoneRAT.exe
Token: SeDebugPrivilege	6064	WarzoneRAT.exe
Token: SeDebugPrivilege	6104	WarzoneRAT.exe
Token: SeDebugPrivilege	5612	WarzoneRAT.exe
Token: SeDebugPrivilege	5340	WarzoneRAT.exe
Token: SeDebugPrivilege	6004	WarzoneRAT.exe
Token: SeDebugPrivilege	5188	WarzoneRAT.exe
Token: SeDebugPrivilege	1088	WarzoneRAT.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4420 wrote to memory of 884	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 884	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4936	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4428	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 4428	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe
PID 4420 wrote to memory of 264	4420	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/RAT/WarzoneRAT.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa907c46f8,0x7ffa907c4708,0x7ffa907c4718
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,237123940063948487,562465681972189866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5224
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5336
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD997.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5868
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5432
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD987.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5708
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5852
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5860
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5680
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDB2D.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6064
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED8C.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4072
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6104
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEE19.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:964
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5404

C:\Users\Admin\Downloads\WarzoneRAT.exe
"C:\Users\Admin\Downloads\WarzoneRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5612
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCAD.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5724

C:\Users\Admin\Downloads\WarzoneRAT.exe
"C:\Users\Admin\Downloads\WarzoneRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5340
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp19FB.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5720

C:\Users\Admin\Downloads\WarzoneRAT.exe
"C:\Users\Admin\Downloads\WarzoneRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6004
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A18.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:6128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6080

C:\Users\Admin\Downloads\WarzoneRAT.exe
"C:\Users\Admin\Downloads\WarzoneRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5188
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3718.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5216
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4004

C:\Users\Admin\Downloads\WarzoneRAT.exe
"C:\Users\Admin\Downloads\WarzoneRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp47B2.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WarzoneRAT.exe.log

Filesize
507B

MD5
8cf94b5356be60247d331660005941ec

SHA1
fdedb361f40f22cb6a086c808fc0056d4e421131

SHA256
52a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0

SHA512
b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
566ac376d8cf88e31d3f6827d3092ce4

SHA1
34f5d74e14ef1a27629a7fb7525737a487c04f4f

SHA256
b0258bcf24f24fc3e18f7ba78a7c8caa588df3de1cabb24e6ba1092a751c419c

SHA512
da2f773b194520e6e4f5873431ea9ed6fedd04025eae349753e44ad70ab9218b99ed4ef8641e8144ae4092032fc96ce9e4ff956fbf9e0a08da89add1d81b408c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8fe95578e3bca155fc94e54d76a35a8

SHA1
b1bf562c9fa96e27c3985c2c6dfb5fe157b0d86c

SHA256
7bcdf908ff7c7bb7c6e475b64283d2da818b4fd16f93a418317ff19d7df6b7e5

SHA512
da7867aeb00d03098bf3cdc5c8db4829e52b68bc31f10d76f430b512196ac5e13098562541dc1426acdafb9e24b9caf0118035a372d8375563b167ef4f4cbb57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
08393f58f0021da4004ad5350f9308d0

SHA1
da0e08bda6edcc2793da5ec6374496c9f87a8507

SHA256
033de00275d01ea264d5d3b81d11a5a8d4f25c7f68d38fae1ca806afc68449b9

SHA512
63f50262103fac3cb61abc56bb80e8d3e3455704dac46f9176bc18bb4e537986756c6be7a89271215c396bcdc24d62efc11738ef1dc0ef74301c221b08d3d3a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b87869408191eee78714506593595ff3

SHA1
0a1357336d538b6c5cf18a58ff74cb0fe4a98fe7

SHA256
4bfca578f3ae6a8b3f69af96acf639a33742506461da4ed8ce6b1982f898b8c4

SHA512
773f9e1f2e4b82047a5c8fce03e7dd4f572de9c5597b3eecf9e8a49e867a2966dc1808aac8175dd22cf9535767cedd24565bcae788293caa8cd15f29caa2a490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1806a887c60a06b524b6d705d0569b9f

SHA1
5458d1c32e222e6fb262b53a7094c663532cf372

SHA256
51d79bddebe3d50d9ae016a124920e30e22eb46581eb606d7bc4229e8763e86f

SHA512
ba4793a783312dbf08b6c4ab2233151ba51879010e012b22ed235fdee838e29bb977d3a6552823bcbf45d3c688737e90528d5e4fd1c9b0f3fe7038efd2ed9254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581c2e.TMP

Filesize
1KB

MD5
6309777f71288fbd11c3793fdd69303a

SHA1
e40aaea9db616569f73dd2280b44fb55a1185f9f

SHA256
5f46409163945f23b164170a1adde86708dbbb378a6634406a629346c720d362

SHA512
3249b9ea1ade713093f726517ece7ca28b8a7092b5f2e569386f1e492b2c7305ebf53d7c7ffed08dafdfaf0c47b93837c5672d76520a3766c3766acc07406318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ed680083da71f847508da885661a6ef9

SHA1
b4612ac2433d63d2b26b02ec0651f01f06834eb3

SHA256
25b0fd94a1539aa3e125266c7852649c252f421599c83a032f48c9e8d9309790

SHA512
7e7d7d2265388555a41e35b5f3195e466cca7a95e1756285d33d0ef3158cd60ca9f3013a1cdafd08766c6a642acfbf5736ef2a4f56575fef60b71fb5f1484208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c5857fa247665cf91f2bc6dd0897f1f5

SHA1
9aca4306ba845f6a2d9cab6fd7cb66d238eec71b

SHA256
8ff5c6a809248eb8b7553482a6d55cad69737d50fea2996e5c558c5253f06cb5

SHA512
55b7fd8990657ca7345c1771a3a1b9ada8100dddca2405d08ec69e15d6977bde744fb0e61a9d9991b40522bc8146f0c9faf0620f80d171f390d87cf14045db97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9f4634ce7dc0bb2547c843ae13d96ee3

SHA1
b870ea76e9555fd70de5b95ad73422c3ac78bf09

SHA256
7fc1f8a2e3a4cd7cc0a29ba1cd7cc2aaab94a44e5ea033350ca6d7fe8b5823cd

SHA512
5dfb8288718d05768cca3efae5856ccef59593e7685ab54ce808fb00ed4b88faccb0b5d2bfccd5a3c5b9742f1b8f7335ddb60cc2dea86b40499ddb167acae305

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD997.tmp

Filesize
1KB

MD5
3cca813999bd537c04d6f3216c0166db

SHA1
6f10b2a79c98a2352a7f30aeb7d1a7ab4be7b167

SHA256
d79aad3271d5b5677498bb4a31ab3c1d37f2d27351afd1e978ecaac96c89c567

SHA512
5a2a24fb8cf95b7cfe34f7cbe1b9be79b16ba51a3ab63c08c22f60374d3aee35a90373f90b626be334a16c0b19aa19eca2dadd7e18b71a5aad18ee913a016a6a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 790821.crdownload

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
\??\pipe\LOCAL\crashpad_4420_TXVMVGWFHRPXJQZU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5336-210-0x0000000004F70000-0x0000000004F78000-memory.dmp

Filesize
32KB

Download
memory/5336-209-0x0000000005170000-0x0000000005202000-memory.dmp

Filesize
584KB

Download
memory/5336-208-0x0000000005540000-0x0000000005AE4000-memory.dmp

Filesize
5.6MB

Download
memory/5432-211-0x0000000005A90000-0x0000000005B2C000-memory.dmp

Filesize
624KB

Download
memory/5432-212-0x00000000059F0000-0x0000000005A18000-memory.dmp

Filesize
160KB

Download
memory/5432-207-0x00000000002A0000-0x00000000002F6000-memory.dmp

Filesize
344KB

Download
memory/5860-223-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/5860-224-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download