dcrat | hxxps://mega[.]nz/file/iN9RXLaA#-p17M5OrKTA9uh2TWvKrD9IhOKXBK-AQl4spSERybEA

Analysis

max time kernel
44s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/iN9RXLaA#-p17M5OrKTA9uh2TWvKrD9IhOKXBK-AQl4spSERybEA

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\bridgeHypercomComponentHost\\wscript.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\bridgeHypercomComponentHost\\wscript.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\bridgeHypercomComponentHost\\wscript.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\bridgeHypercomComponentHost\\wscript.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\bridgeHypercomComponentHost\\audiodg.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\bridgeHypercomComponentHost\\wscript.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\bridgeHypercomComponentHost\\audiodg.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\mscontainerWindll.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\bridgeHypercomComponentHost\\wscript.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\bridgeHypercomComponentHost\\audiodg.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\mscontainerWindll.exe\", \"C:\\bridgeHypercomComponentHost\\mscontainerWindll.exe\""	mscontainerWindll.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5372	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5396	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5420	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5444	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5464	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5492	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5520	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5544	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5552	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	728	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	860	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5596	860	schtasks.exe	100

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
5980	loader.exe
3536	loader.exe
5240	mscontainerWindll.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\bridgeHypercomComponentHost\\wscript.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\bridgeHypercomComponentHost\\audiodg.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\bridgeHypercomComponentHost\\audiodg.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscontainerWindll = "\"C:\\bridgeHypercomComponentHost\\mscontainerWindll.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscontainerWindll = "\"C:\\bridgeHypercomComponentHost\\mscontainerWindll.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\bridgeHypercomComponentHost\\wscript.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscontainerWindll = "\"C:\\Program Files (x86)\\Microsoft.NET\\mscontainerWindll.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscontainerWindll = "\"C:\\Program Files (x86)\\Microsoft.NET\\mscontainerWindll.exe\""	mscontainerWindll.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCF0A426E3E11B40C0B1DA101471B9DDE6.TMP	csc.exe
File created	\??\c:\Windows\System32\lhkpi-.exe	csc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5980	loader.exe
3536	loader.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft.NET\mscontainerWindll.exe	mscontainerWindll.exe
File created	C:\Program Files (x86)\Microsoft.NET\015bd514edd902	mscontainerWindll.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe	mscontainerWindll.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\55b276f4edf653	mscontainerWindll.exe
File created	C:\Program Files (x86)\Microsoft.NET\mscontainerWindll.exe	mscontainerWindll.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
744	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	loader.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
744	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3032	schtasks.exe
5464	schtasks.exe
5492	schtasks.exe
5520	schtasks.exe
2524	schtasks.exe
1480	schtasks.exe
5420	schtasks.exe
5544	schtasks.exe
5552	schtasks.exe
4016	schtasks.exe
728	schtasks.exe
5396	schtasks.exe
5444	schtasks.exe
2820	schtasks.exe
5596	schtasks.exe
5372	schtasks.exe
1484	schtasks.exe
3256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
4732	msedge.exe
4732	msedge.exe
3740	identity_helper.exe
3740	identity_helper.exe
4260	msedge.exe
4260	msedge.exe
5720	7zFM.exe
5720	7zFM.exe
5980	loader.exe
5980	loader.exe
3536	loader.exe
3536	loader.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe
5240	mscontainerWindll.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5720	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	4176	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4176	AUDIODG.EXE
Token: SeRestorePrivilege	5720	7zFM.exe
Token: 35	5720	7zFM.exe
Token: SeSecurityPrivilege	5720	7zFM.exe
Token: SeSecurityPrivilege	5720	7zFM.exe
Token: SeDebugPrivilege	5240	mscontainerWindll.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
5720	7zFM.exe
5720	7zFM.exe
5720	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5980	loader.exe
3536	loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 3252	4732	msedge.exe	83
PID 4732 wrote to memory of 3252	4732	msedge.exe	83
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 4816	4732	msedge.exe	84
PID 4732 wrote to memory of 3576	4732	msedge.exe	85
PID 4732 wrote to memory of 3576	4732	msedge.exe	85
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86
PID 4732 wrote to memory of 4388	4732	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mega.nz/file/iN9RXLaA#-p17M5OrKTA9uh2TWvKrD9IhOKXBK-AQl4spSERybEA
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9105146f8,0x7ff910514708,0x7ff910514718
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,4124158179709239232,3230377599782636846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:64

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5552

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\NIXWARE PASTA.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5720
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO856E63A7\ИНСТРУКЦИЯ.txt
  2⤵
  PID:5780

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5980
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\bridgeHypercomComponentHost\u95boq3b7HFvqr.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  PID:6124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\bridgeHypercomComponentHost\AAJff1lG8RICXs2A4EYTaC5p7dZ23zLFBkqYwYWng.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5172
  - - C:\bridgeHypercomComponentHost\mscontainerWindll.exe
      "C:\bridgeHypercomComponentHost/mscontainerWindll.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5240
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5oc5wntz\5oc5wntz.cmdline"
        5⤵
        Drops file in System32 directory
        
        PID:3008
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A06.tmp" "c:\Windows\System32\CSCF0A426E3E11B40C0B1DA101471B9DDE6.TMP"
        6⤵
        
        PID:3840
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NvQdwyyzlp.bat"
        5⤵
        
        PID:3184
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3176
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:744

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3536
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\bridgeHypercomComponentHost\u95boq3b7HFvqr.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\bridgeHypercomComponentHost\AAJff1lG8RICXs2A4EYTaC5p7dZ23zLFBkqYwYWng.bat" "
    3⤵
    PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\bridgeHypercomComponentHost\wscript.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\bridgeHypercomComponentHost\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 14 /tr "'C:\bridgeHypercomComponentHost\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\bridgeHypercomComponentHost\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\bridgeHypercomComponentHost\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\bridgeHypercomComponentHost\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscontainerWindllm" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\mscontainerWindll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscontainerWindll" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\mscontainerWindll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscontainerWindllm" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\mscontainerWindll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscontainerWindllm" /sc MINUTE /mo 5 /tr "'C:\bridgeHypercomComponentHost\mscontainerWindll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscontainerWindll" /sc ONLOGON /tr "'C:\bridgeHypercomComponentHost\mscontainerWindll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscontainerWindllm" /sc MINUTE /mo 11 /tr "'C:\bridgeHypercomComponentHost\mscontainerWindll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ce5e0a52e79c20f5f519887cc009f1d9

SHA1
01edc09809ce667f86ac72120aa55a6f12e3b8ee

SHA256
e8e9f9b27115f0f110dcafc09f20a9333861f7de31140786de7459c9cef083ce

SHA512
2048eec438174017174f22353dcc46c2fa4e93f63ab6b5531a308cee11eb2b519260a5f8d57eba55c04154c38aec0961fbb6eacf429401b5c768ca34ffb816ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdf6ba7ce1edb44051e1bcc12dacef45

SHA1
01faa47f557829f9131c0d13d0eaf957c93b4e25

SHA256
fff504da9497cd051fd55164e03d393921efb5e20f6b1ab1efe32bc31d34b1d3

SHA512
7104e532730d13a86f1dee2bcb78d33d49ba48b3f3792af9d68f2c57e3d0d21f0064770bc1f75264cbbcb2aa80d32ebf5895ba56dae202eefc87b4aa80341cc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
69ea41ae01704936880053f4e7bbfeff

SHA1
1dc96b5d20b2979a06ebb24d04175c7dbfce4095

SHA256
ab0e765f91a41b0006ab5fcc6bcbb2557929e4dc328719678acde716c95b42e4

SHA512
cb06c74ffd7bfc1edffec63b478c348990b6b20fa5bedc80017849bb5171a71c167f44ecc8094dad09740d79a66d309a185fa2420bbe90ad07d7e91864504a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4fb4f776f5f2f36cb7b8429563c5735e

SHA1
2772dbced1a7f747839406600a23a2709059e39f

SHA256
d0c6b85ba7bc71cf537d02e757d602a8e7f127881fcb6f8d809976ee2195fc5c

SHA512
3ff5a14b94e5f35c303f07a9d01fdbc28bb8050a812211f37cf1fc06ba789821df56ba6d1c4fbe040ed3e53b500d2d9e53773b40ca5a7035b0ae63c75978fbf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
24c03abe394b8b6f881c5b7b66eda8ed

SHA1
0f18d65b63fcd19e387a9c89af909af84eafd1c0

SHA256
5e581430a8bfc931120229d3f60ff57a25dfeb5597ae778136c6b5d67a041ee7

SHA512
9c0525b105b18df1c8dc12cee712219ca7829ec9abf5a0352b7b02b196d76f0e02cc40fbe508193209a36b0fa4f3a87d5d4f5241fc230074ca23e931e4376fa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c90d.TMP

Filesize
48B

MD5
a25954b9b7757e12fd4562b3fa509bdc

SHA1
ba446248ae29c79401b319f9ea2eb8bf98516594

SHA256
5935e786d4f36b4e85e6c00f79779c630cc8ee0202e83f4e31aa9baa8c41756f

SHA512
96a8568ed0b38907a0cb8006ce39eb349ae9df974e3d75ee012796b1397d2b083b0e701da3a87d7a3cece1079f5b8d8c7106d0ce245e38e4c13ce568d394d361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1658cff4acabe5da46e97d2068428cd5

SHA1
fd9d137c9a9ccec6a0487f560e6171768b1e704e

SHA256
b775d505cce18dc2f77f785ee2984ed220a4ab867666b617bc8fa118d6d8378c

SHA512
50acf375bf5a987765ced03f548ee384fd3de3b42dd087bfe5279cdd6678e3a7798137d5a4cdcdb1f6070ffbdf4c9d9473e108ebb8d01782af4fb2c1bcab11cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0cc9816c98c47c9ad9dcaa90c19d500b

SHA1
7dd099126ee9085e7e03428c85ee30eb8ddbff91

SHA256
e55f432d635c6a02edb00700b6abf9df83345e068f23deecdabc76d6ab83689d

SHA512
e9eb7f7a0d9355e13a3bf5bb5d59f7254ed7e4514e73e0f4a0517da22ca819a0a1f1faa7dc15c6a8008e96786b690c188dc5f6b87f9980bc53d71026c209c99d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO856E63A7\ИНСТРУКЦИЯ.txt

Filesize
153B

MD5
e5bf3c592fa0a8639cc9d6c3afcfe101

SHA1
4edd2164926a8726069f360a91a33725c34da48c

SHA256
bd8b97d57eb446afcdb4d046b44417daaa4380d052da59d036528b6ea9293d9d

SHA512
ca3a1fcd7b11741dd29b1244b5103f3ef7e182b312e9e237e158c87bb0e5720e19044f22e98385a8e6feb0b33ccd689cccf55756b1588151de48f28b97c761bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\NvQdwyyzlp.bat

Filesize
180B

MD5
6867529a896a7feb5f066996637f87ff

SHA1
9192c6c3a8e6b1cdcb7b459f783d221cb42ee219

SHA256
c2f8bb7b3866e117a1dc136070e0e1e869fce60cfb31b64219da4b4c9e166a86

SHA512
0cd542da035224230fb5252eb315184b45572f549b03cb670dde110158979b4e973ba9d2c4a1d736d3c07ba6808e97855fe39d5f113e020c8e428b3075d01450

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3A06.tmp

Filesize
1KB

MD5
aba72174b10a8a61ddf366323dbd67b7

SHA1
b6950851d40dfa015a3b13d628f61e20723ec3e4

SHA256
e82bf1346a6633ed036c6570bf637731ef80b3c91eb7ba23f6e58e62fe7ceeab

SHA512
c946d78540af825c32f1a2af707fcd7d88f9a191f111515a68de43f1e7a4631a65571591aadab13a8ec9177a15c7f164fb67d0d9f79f3a30dd714c2e5be8269f

Download Submit
C:\Users\Admin\Desktop\NIXWARE PASTA.rar

Filesize
2.7MB

MD5
2b2957e283af18531e63cab123079d3e

SHA1
a9f5c70f85becca9b7ca60ff6389ca3d023f858c

SHA256
bb107d0ce375bd8c74e1c57a4ee0e67ce80a3e8de84944048bde248d81f7ee51

SHA512
16c36326eb62ae3acb2e731de1b84844ff574a41b88d04ef8d185eb05bccc9f8dd67a5343960d41ca8e85f984e35fb9da3d6c5a1a26bec35d748fc45fca79dd2

Download Submit
C:\Users\Admin\Desktop\loader.exe

Filesize
3.2MB

MD5
8faa9e2bbcb1f98cb3971b94f9feda41

SHA1
ab03732cdbc58c752057f2dd3c39e164e222476f

SHA256
026825e9ca81fe52b1833a5e2c838336bc645778da89ff5c266c65c9d750a490

SHA512
5a660bddaf58c15503861663d018e3444c40fc9a62cc2953a60e41c78561014db4911d4f1da80f70a492d6ff912765d93e08c3c39fce921580b034dfcc47d358

Download Submit
C:\bridgeHypercomComponentHost\AAJff1lG8RICXs2A4EYTaC5p7dZ23zLFBkqYwYWng.bat

Filesize
108B

MD5
836fc705ac99bb9e9c32457cd334e13e

SHA1
ebbb2cfd6a3260e482447d1c7871391ea8c75551

SHA256
e0446f377405745b3712c210adeda645441bc9f6b987756b53aa05ed167fbf9c

SHA512
ae2915671fee13ce19947eed0733d3de5b462ca8ef55b422259814004cc51df54a1ea58a6659a36a886103e84191f93fee5d7a134a50439a81c856645f88cc90

Download Submit
C:\bridgeHypercomComponentHost\mscontainerWindll.exe

Filesize
1.9MB

MD5
5a7bf976e09d1835a65809093075a1bc

SHA1
d2de32c02c3d6e79f185b6b5f91e95144ae5a033

SHA256
20ea6e36a40896c99a0549118ac01b9508dd72b484050c9b2ce4fb5ac805a950

SHA512
60c6f582e29415186d2fef58a469a6bd87e84daf084d8705f09605f331d015abb1a825d06343a797532561915e754015692e745de21c55ed6e52cb5ba47129c6

Download Submit
C:\bridgeHypercomComponentHost\u95boq3b7HFvqr.vbe

Filesize
246B

MD5
a672021e4678a1cee46a924baa63411c

SHA1
c4c27bf73768a3cc97d070e3d560e4f45affe9b4

SHA256
65a576bed74898f83fd527be9a715aaac80609066d01e8b16a691c5287bd15b5

SHA512
ea08511f0859767abdbc080e7dcbad20bced260cfb2b58ba51cc8d48d544fb36256f56887c25763f25d799fa225674d487d6f5826f835fb8462c0c6441c64b67

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5oc5wntz\5oc5wntz.0.cs

Filesize
374B

MD5
5119deb54ff5c3405984fcd173adcde9

SHA1
7a86e0381edda70f38e3eb126913b84bd481e54e

SHA256
634a67f2b855992074fcf5b6e6edc06f16d4ac75b33fe4ff69ae9ecf48d59177

SHA512
36520de11e41f96479b8040317acb3d40f8cf63ad6b12d3076826cafa8e0faede307c3e5db5c50c275eaeff2c69229d71bb7d4fa7f2238fce6ed1938e78e02ef

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5oc5wntz\5oc5wntz.cmdline

Filesize
235B

MD5
5a5f6c193c6af57fffd7dcd4c2b47434

SHA1
b10c36fe1ea0e45f757408ad28de4db019d2b248

SHA256
5d7bb0d64fdc377279de63691223a994ba3ea21b84d07b31f32e1cd7851a4607

SHA512
7badf401610814c785cfa2fb50455962fe0e0c4cb0327ccb8491fa228be9acc3d4a74d65f242c7c0c23e69166154894ef3f4c7d2bb50b210219a94f3a45f12e5

Download Submit
\??\c:\Windows\System32\CSCF0A426E3E11B40C0B1DA101471B9DDE6.TMP

Filesize
1KB

MD5
75e32610d8ef6143201c7c28465fcda9

SHA1
b2bae99fade2dda07aecbe1659d184be0fc4e7a6

SHA256
97ee1cac3965d9cc55a60f20206f384719431f19ac96bdc52b93a98de51a639b

SHA512
b303fb99586efd19a08223ba93472fa6d33fcf9198bbf42fb16ba61001db59e5fd5835ea7696ed34e4004d23fa60697e724e6085d1269d788204bf95dfe46abc

Download Submit
memory/3536-327-0x0000000000820000-0x0000000000C16000-memory.dmp

Filesize
4.0MB

Download
memory/5240-332-0x0000000000670000-0x0000000000856000-memory.dmp

Filesize
1.9MB

Download
memory/5240-334-0x0000000002930000-0x000000000293E000-memory.dmp

Filesize
56KB

Download
memory/5240-336-0x00000000029A0000-0x00000000029BC000-memory.dmp

Filesize
112KB

Download
memory/5240-337-0x000000001B510000-0x000000001B560000-memory.dmp

Filesize
320KB

Download
memory/5240-339-0x00000000029C0000-0x00000000029D8000-memory.dmp

Filesize
96KB

Download
memory/5240-341-0x0000000002980000-0x000000000298E000-memory.dmp

Filesize
56KB

Download
memory/5240-343-0x0000000002990000-0x000000000299C000-memory.dmp

Filesize
48KB

Download
memory/5980-324-0x0000000000820000-0x0000000000C16000-memory.dmp

Filesize
4.0MB

Download
memory/5980-313-0x0000000000820000-0x0000000000C16000-memory.dmp

Filesize
4.0MB

Download