raccoon | 3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
Size 929KB
Sample241110-keclbataqr
SHA256 3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93
MD5 0b4df70b068c231a06bb8fcc5a256e34
SHA1 29ecfc8234162b43674d90e137546a4ecd4f65d7
SHA512 603a19c3c084bd71dbeda26d34d3d179d1c7f1eb23f4f411a83cbb4d365482885794763fa0d9711dbb6a383a32e60e8ec50aeacce7b87c859b70bf8998ff958b
SSDEEP 24576:pAT8QE+krVNpJc7Y/sDZ0239GhjS9knREHXsW02EhY:pAI+wNpJc7Y60EGhjSmE3sW02EhY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon redline vidar 4 5076357887 76426c3f362f5a47a469f0e9d8bc3eef @tag12312341 afb5c633c4650f69312baef49db9dfa4 nam3 ruxarr_gg discovery infostealer stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

vidar

http://146.19.247.187:80
http://45.159.248.53:80
https://t.me/babygun222
http://168.119.59.211:80

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

RuXaRR_GG

insttaller.com:40915

Attributes

auth_value
4a733ff307847db3ee220c11d113a305

Extracted

Family

redline

Botnet

@tag12312341

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Extracted

Family

redline

Botnet

31.41.244.134:11643

Attributes

auth_value
a516b2d034ecd34338f12b50347fbd92

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

http://45.95.11.158/

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

http://193.56.146.177

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Raccoon family
raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 10 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023cda-160.dat	family_redline
behavioral2/memory/6192-183-0x0000000000BE0000-0x0000000000C00000-memory.dmp	family_redline
behavioral2/files/0x0007000000023cde-190.dat	family_redline
behavioral2/files/0x0007000000023cdf-200.dat	family_redline
behavioral2/files/0x0007000000023ce1-238.dat	family_redline
behavioral2/files/0x0007000000023ce0-275.dat	family_redline
behavioral2/memory/6788-271-0x00000000009D0000-0x00000000009F0000-memory.dmp	family_redline
behavioral2/memory/6552-231-0x00000000003C0000-0x00000000003E0000-memory.dmp	family_redline
behavioral2/memory/6684-276-0x0000000000100000-0x0000000000120000-memory.dmp	family_redline
behavioral2/memory/6420-214-0x00000000007E0000-0x0000000000824000-memory.dmp	family_redline

Redline family
redline
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe

Executes dropped EXE 11 IoCs

pid	Process
6124	F0geI.exe
5424	kukurzka9000.exe
6192	namdoitntn.exe
6276	nuplat.exe
6340	real.exe
6420	safert44.exe
6552	tag.exe
6684	jshainx.exe
6788	ffnameedit.exe
6824	rawxdev.exe
6944	EU1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	iplogger.org
8	iplogger.org

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\nuplat.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\tag.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\rawxdev.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\EU1.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6460	6124	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0geI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nuplat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	real.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EU1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jshainx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kukurzka9000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	namdoitntn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	safert44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffnameedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rawxdev.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
2660	msedge.exe
2660	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3908	msedge.exe
3908	msedge.exe
5384	msedge.exe
5384	msedge.exe
5660	msedge.exe
5660	msedge.exe
6732	identity_helper.exe
6732	identity_helper.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 3152	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	88
PID 1092 wrote to memory of 3152	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	88
PID 3152 wrote to memory of 4196	3152	msedge.exe	89
PID 3152 wrote to memory of 4196	3152	msedge.exe	89
PID 1092 wrote to memory of 824	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	90
PID 1092 wrote to memory of 824	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	90
PID 824 wrote to memory of 2504	824	msedge.exe	91
PID 824 wrote to memory of 2504	824	msedge.exe	91
PID 1092 wrote to memory of 2172	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	92
PID 1092 wrote to memory of 2172	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	92
PID 2172 wrote to memory of 220	2172	msedge.exe	93
PID 2172 wrote to memory of 220	2172	msedge.exe	93
PID 1092 wrote to memory of 3528	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	94
PID 1092 wrote to memory of 3528	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	94
PID 3528 wrote to memory of 2232	3528	msedge.exe	95
PID 3528 wrote to memory of 2232	3528	msedge.exe	95
PID 1092 wrote to memory of 3872	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	96
PID 1092 wrote to memory of 3872	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	96
PID 3872 wrote to memory of 2268	3872	msedge.exe	97
PID 3872 wrote to memory of 2268	3872	msedge.exe	97
PID 1092 wrote to memory of 2216	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	98
PID 1092 wrote to memory of 2216	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	98
PID 2216 wrote to memory of 2924	2216	msedge.exe	99
PID 2216 wrote to memory of 2924	2216	msedge.exe	99
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100
PID 3152 wrote to memory of 4292	3152	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
"C:\Users\Admin\AppData\Local\Temp\29ecfc8234162b43674d90e137546a4ecd4f65d7.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AbtZ4
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:6252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
    3⤵
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7180 /prefetch:8
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7180 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9288445970124044161,13464886598644891499,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,9288445970124044161,13464886598644891499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,759312144821282861,11773360664901332303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11131353105756689473,10856757942902454085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1naEL4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4013138193463525660,348595571231074699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nhGL4
  2⤵
  PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A3AZ4
  2⤵
  PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AUSZ4
  2⤵
  PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:5932
- C:\Program Files (x86)\Company\NewProduct\F0geI.exe
  "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 552
    3⤵
    - Program crash
    PID:6460
- C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
  "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5424
- C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
  "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6192
- C:\Program Files (x86)\Company\NewProduct\nuplat.exe
  "C:\Program Files (x86)\Company\NewProduct\nuplat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6276
- C:\Program Files (x86)\Company\NewProduct\real.exe
  "C:\Program Files (x86)\Company\NewProduct\real.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6340
- C:\Program Files (x86)\Company\NewProduct\safert44.exe
  "C:\Program Files (x86)\Company\NewProduct\safert44.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6420
- C:\Program Files (x86)\Company\NewProduct\tag.exe
  "C:\Program Files (x86)\Company\NewProduct\tag.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6552
- C:\Program Files (x86)\Company\NewProduct\jshainx.exe
  "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6684
- C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
  "C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6788
- C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
  "C:\Program Files (x86)\Company\NewProduct\rawxdev.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6824
- C:\Program Files (x86)\Company\NewProduct\EU1.exe
  "C:\Program Files (x86)\Company\NewProduct\EU1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6124 -ip 6124
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EU1.exe

Path C:\Program Files (x86)\Company\NewProduct\EU1.exe
Size 286KB
SHA256 2f7a5ab1ce00d00b1196b2cd815457176467928a47a8c652b8af41e6bab8772b
MD5 eaa8eacd3c59ed71b7f68ef7a96602a3
SHA1 9b35e7b6cd147a4a729d3f6b1791e774a754c589
SHA512 c19934e143dcf1242f2f1584baaad4cebbd2e06d048c2ef9d347683ef0d77e2791c364608957e8ea4c1b9613450c3c2e4112bb56280ee12a4b1b1a63c714d83e
SSDEEP 3072:SKVC7oLxctmeDksO7GTIG3gvF+1Bd4Cdf3ZnKvAbMAg0+bpJHaggzgLOJHNR/ONN:SKVCDaqzV/4IPFqAb7GxVgzdDGTdD
MD5 SHA1 SHA512 SSDEEP

Submit Download

F0geI.exe

Path C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Size 339KB
SHA256 f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b
MD5 501e0f6fa90340e3d7ff26f276cd582e
SHA1 1bce4a6153f71719e786f8f612fbfcd23d3e130a
SHA512 dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69
SSDEEP 6144:Y7v3qLsCqxXXFaNOq7trETZdZjPLUQxIAi/9xlNtQ/3N:Y7vbfQOkrETZdZjPv10RNk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffnameedit.exe

Path C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
Size 107KB
SHA256 713eeb4e9271fe4b15160d900ad78498838bb33f7f97ad544a705ab2a46d97cf
MD5 4bf892a854af9af2802f526837819f6e
SHA1 09f2e9938466e74a67368ecd613efdc57f80c30b
SHA512 7ef9d8cb4daf6be60c5a41439dab4e7384676b34de2341ac52cb33815645fbb51a4b78725ea97479d287a8d7a0a61b4b337b1ad49cce2a23c9192fd9b7678d44
SSDEEP 3072:zcvFBYCY+piqI+Tg6h4MLkKUQc7b9fDWhB4EASNB:zcvmvI4MoKtcJWhB4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

jshainx.exe

Path C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Size 107KB
SHA256 84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665
MD5 2647a5be31a41a39bf2497125018dbce
SHA1 a1ac856b9d6556f5bb3370f0342914eb7cbb8840
SHA512 68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26
SSDEEP 3072:9cvFBgCYKpi8IVJFKQ6OUxuvQc0ZpDHh64EASNh:9cv+t36jo4c+Hh64jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

kukurzka9000.exe

Path C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Size 491KB
SHA256 8bbc892aedc1424ca5c66677b465c826f867515a3fea28821d015edcee71c912
MD5 681d98300c552b8c470466d9e8328c8a
SHA1 d15f4a432a2abce96ba9ba74443e566c1ffb933f
SHA512 b909975d0212d5a5a0cb2e2809ee02224aac729cb761be97a8e3be4ee0a1d7470946da8cf725953c1b2d71fb5fc9dc3c26fd74bce5db5cc0e91a106f8bded887
SSDEEP 12288:uhUQ3jSNiEU7pWQZmMmmr1omuSxvB+HTPA7G:qU4jp1WQZmM5s2QTPA7
MD5 SHA1 SHA512 SSDEEP

Submit Download

namdoitntn.exe

Path C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Size 107KB
SHA256 1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e
MD5 bbd8ea73b7626e0ca5b91d355df39b7f
SHA1 66e298653beb7f652eb44922010910ced6242879
SHA512 625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f
SSDEEP 3072:NcvFB4CYHpiVIlf0By1C+4IQclHbTTh/4EASNB:NcvGt91Cdxc9Th/4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

nuplat.exe

Path C:\Program Files (x86)\Company\NewProduct\nuplat.exe
Size 287KB
SHA256 e080161f57d4eaaad9173b63219ba5a9c2c595324a6b3ffe96783db40839807b
MD5 17c42a0dad379448ee1e6b21c85e5ac9
SHA1 2fec7fbb4a47092f9c17cd5ebb509a6403cb6d69
SHA512 5ddfe9af625c54e417452fe582041cdd373b52d4ededbcba71a88050fd834bc8af822257f7ad606e89db3fde15be98f58c1d8ff139dac71d81a23f669617a189
SSDEEP 3072:YqQsGJ88a/x8IZC7QK+7fieyqBuJV6H+pUJcJI+6UVLGqFwFz5e1pJHaggzHRuNK:Yq7337fiaAa8SyMUV9nxVgzxuUmkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

rawxdev.exe

Path C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
Size 287KB
SHA256 cdd49958dd7504d9d1753899815a1542056372222687442e5b5c7fbd2993039e
MD5 3434d57b4ceb54b8c85974e652175294
SHA1 6d0c7e6b7f61b73564b06ac2020a2674d227bac4
SHA512 f06fa676d10ff4f5f5c20d00e06ad94895e059724fea47cdf727bd278d9a3ba9daec26f5a0695cb74d87967d6d8020e14305e82725d5bc8c421c095e6704d9aa
SSDEEP 3072:sqQsGJH6KGxIdbwsgYOUGWeo2Rq9/YzulXcWh011KX4iLTBe1pJHaggptbRuNmTC:sqAJf0WeAJtV/I1KrLTsxVgDFu4TGN
MD5 SHA1 SHA512 SSDEEP

Submit Download

real.exe

Path C:\Program Files (x86)\Company\NewProduct\real.exe
Size 286KB
SHA256 975457ed5ae0174f06cc093d4f9edcf75d88118cbbac5a1e76ad7bc7c679cd58
MD5 8a370815d8a47020150efa559ffdf736
SHA1 ba9d8df8f484b8da51161a0e29fd29e5001cff5d
SHA512 d2eb60e220f64e76ebed2b051cc14f3a2da29707d8b2eb52fb41760800f11eafeb8bb3f1f8edcfca693a791aa60e56e263063f2b72abe4ad8784061feee6f7bf
SSDEEP 3072:dKVbAU1xp6UMi5Ag/aX0XqG0heHp8hc5++ieQEkv9wgpJHaggpd+iRgDLyp+R/+a:dKVbdiLwi25ieQ3BxVgpd5w2a
MD5 SHA1 SHA512 SSDEEP

Submit Download

safert44.exe

Path C:\Program Files (x86)\Company\NewProduct\safert44.exe
Size 244KB
SHA256 86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709
MD5 dbe947674ea388b565ae135a09cc6638
SHA1 ae8e1c69bd1035a92b7e06baad5e387de3a70572
SHA512 67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893
SSDEEP 6144:up3Ja5x20VGgvErTAGx+v8ZfOmCWpbR7xVn8fvu3mRYGg5xibAq:upZlOvGTAGx+v8ZfOmCWpbR7xVn8fvu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tag.exe

Path C:\Program Files (x86)\Company\NewProduct\tag.exe
Size 107KB
SHA256 8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89
MD5 2ebc22860c7d9d308c018f0ffb5116ff
SHA1 78791a83f7161e58f9b7df45f9be618e9daea4cd
SHA512 d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e
SSDEEP 3072:bcvFBgCYCpieID9L27lqeI6QcEhpTFhM4EASNz:bcvOfYlq9zcqFhM4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 180B
SHA256 f90fcadf34fbec9cabd9bcfdea0a63a1938aef5ea4c1f7b313e77f5d3f5bbdca
MD5 4bc8a3540a546cfe044e0ed1a0a22a95
SHA1 5387f78f1816dee5393bfca1fffe49cede5f59c1
SHA512 e75437d833a3073132beed8280d30e4bb99b32e94d8671528aec53f39231c30476afb9067791e4eb9f1258611c167bfe98b09986d1877ca3ed96ea37b8bceecf
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2b97968b028ad37a1923b13a8493a94b25c12a14b1405031728393e6c7a2af1d
MD5 aeac524614430126336990f5be820806
SHA1 0efd0996034b4951505183e9ce2c3177851cfd99
SHA512 f80d9f272ebf2c6a8e4b29cdb0438445c09a292613fade54f0b3b193fbe6c24d02af9d8048cfe2398f6bbe21be09a91a6bed9a93f31fcf0d2734a2341466ccc1
SSDEEP 96:n3kAn1Zv9wpvWMoiVmdeHqZfypcUUWQyV+VDCziEwb:n3kaz9GWMXYQcUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 66ed7b43c2e414c6aae05106151cbbe01d6e1959c23c93ba9e5f0cd904292dbc
MD5 ff0f07566747b8d864b224d74022ded4
SHA1 92cc4cc1166023f25d918e51bff905fd637a3c53
SHA512 bef84ff08d2386f518c1719b84476848f4db4e7de94f70d6bdf710393a3ba073caab8b55e52749c9e2a37dcdab4e52c8564a034b808be4bb5a95d6f0d3b26ebc
SSDEEP 96:n3kQn1Zv9wpvWMoiVmdePkyW2yqNIpcxtUWQyV+VD7AiEwb:n3kqz9GWMMyWzLcxtrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c881d1a761235e0028473592ebfcfdf8e9f47d3b203fe79a8fd6d6ad372b20c4
MD5 97a7d68a82f00f1c0aa7df6a82b99ff4
SHA1 b04ad4e7d584697afbd9e03905a26aeb8336167e
SHA512 b65002343e80c9c006f7ecb4110bfcafc1e27e16ea6bd913a3b2258356e208b1981acfd31bbd8f26f3d6a70f32ec70cf3e616feeb66092881d604f085e8aa641
SSDEEP 192:hoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXWWlue2RUJcemSpTpu:d9iIxuERzA83h09RZxYXWfgpptu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b62d223895d6e1e0c31cb18bec9c0614aed5495aa2827112115c383f311e430e
MD5 95c9de5a410cfd25aca945779d480a6a
SHA1 2e23d06cc1b1b680f1465fde635589fb2d2495c8
SHA512 9effd0522c6538fc17919e483a961d8dd56994ce698f83cc4fd3cb711bb30e700012136059d26b231ea619b5b9f994aecadee7663f02911f658361be0483ab27
SSDEEP 192:hoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXWW6ue2RUJcemSApu:d9iIxuERzA83h09RZxYXWwApsu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d8323f82aa391b7aa8c401f333a6b330118476dae52886b93e1ea33d0345ee34
MD5 a797b0de427d979faad0d15e6d284c3f
SHA1 ee030c1f4f5315725812ce828440cbeaf6e4bbfb
SHA512 a854fd9b4b6df2217cf06a1c2af5a7ecf99687513602b06ee24003bf262e242dc4d2fbfec242aef38865041b40e419ea5cae627b89a7280fe786ff2c3b67e425
SSDEEP 192:hoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXWWZue2RUxcemScTpu:d9iIxuERzA83h09RZxYXWL0pctu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c20b5e68950de0a5754e90103f44f7c7ea1e8c69d8da7af66e142490177c791
MD5 a8f6188b33651f71a9584441a39f4bb8
SHA1 13697136d90d214dfff3fdd11d2d67b66c118753
SHA512 e32c666e7741ebe07f1777bcbc82ecda5281c57c46511352b1413822071e33e636b5175b333fe8f2d47d1f46b486089fcc97ed5afe102b99d5726fad6e138ed5
SSDEEP 192:hoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXWW/ue2RUtcemSBpu:d9iIxuERzA83h09RZxYXWt8pju
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 0511f4c12058a2a0d1a5aa6a689304b56b2f008f68070ccf0f3020896ad16e21
MD5 c07cda70b2b1b3549254ce3e559b7163
SHA1 7eadcd46f5e983a24a04eb697d7f954cc0569270
SHA512 0e12ea83fef38e62e33a87e4b8e0a2cdca459d5bacb0f4e68111c869a5bcc628b6cf88dbc84ee21a3df835a15f3f08061a51e9f7b0d2137f7b52f98ee7bee5b1
SSDEEP 192:DoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupvWWoe2RUSUWmSeHqRUx3Gu:j9iIxuERzA83h09RZxYvWv3ZphSFGmxn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 1ed24dc128959b8203267c173f640e68126f577d0976bf674cfed588f7742561
MD5 d595a5da7a0f2f9f3735c48149d8ab38
SHA1 ce33fe9abf7888e4c1a6b37adc9b0076a298c27b
SHA512 6bbc9b126f5c7acb77131987ce80b19fc6535fecdaa9ca5119be4e5efb862c9f919f20e5458a54cc358b44479e4cc5704129dd61f5ac4efe071c89a95011890b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupvWWoe2RUSUWmSPHqRUx3Gu:A9iIxuERzA83h09RZxYvWv3ZpiSFGmxn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1092-281-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5424-347-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/6124-298-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/6192-233-0x0000000005F70000-0x0000000005F82000-memory.dmp

Download

memory/6192-232-0x0000000005FE0000-0x00000000065F8000-memory.dmp

Download

memory/6192-234-0x0000000007970000-0x0000000007A7A000-memory.dmp

Download

memory/6192-274-0x00000000078C0000-0x000000000790C000-memory.dmp

Download

memory/6192-183-0x0000000000BE0000-0x0000000000C00000-memory.dmp

Download

memory/6192-261-0x0000000007860000-0x000000000789C000-memory.dmp

Download

memory/6420-214-0x00000000007E0000-0x0000000000824000-memory.dmp

Download

memory/6420-235-0x0000000000FA0000-0x0000000000FA6000-memory.dmp

Download

memory/6552-231-0x00000000003C0000-0x00000000003E0000-memory.dmp

Download

memory/6684-276-0x0000000000100000-0x0000000000120000-memory.dmp

Download

memory/6788-271-0x00000000009D0000-0x00000000009F0000-memory.dmp

Download