hxxps://www[.]google[.]nl/

Analysis

max time kernel
69s
max time network
70s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
29-11-2024 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.nl/

Score

7^/10

bootkit discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 5 IoCs

Processes:

mbr.exenoise.exemousedraw.exesussywaves.exeBitBlt1.exe

pid	Process
1596	mbr.exe
2624	noise.exe
4068	mousedraw.exe
472	sussywaves.exe
5320	BitBlt1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mbr.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\729F.tmp\\mbr.exe"	mbr.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
109	raw.githubusercontent.com
110	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

mbr.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/4728-524-0x0000000000400000-0x0000000000644000-memory.dmp	upx
behavioral1/memory/4728-596-0x0000000000400000-0x0000000000644000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\33bcded3-6b22-4f5e-adb3-20543966b267.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241129131617.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exesussywaves.exeBitBlt1.exeChlorine.exembr.exenoise.exemousedraw.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sussywaves.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitBlt1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chlorine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	noise.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mousedraw.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

Processes:

msedge.exewscript.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
2068	msedge.exe
2068	msedge.exe
4904	msedge.exe
4904	msedge.exe
2836	identity_helper.exe
2836	identity_helper.exe
3124	msedge.exe
3124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

msedge.exe

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description	pid	Process
Token: 33	5088	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5088	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

msedge.exe

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Chlorine.exe

pid	Process
4728	Chlorine.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4904 wrote to memory of 1592	4904	msedge.exe	81
PID 4904 wrote to memory of 1592	4904	msedge.exe	81
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2704	4904	msedge.exe	82
PID 4904 wrote to memory of 2068	4904	msedge.exe	83
PID 4904 wrote to memory of 2068	4904	msedge.exe	83
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84
PID 4904 wrote to memory of 4892	4904	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.google.nl/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9949e46f8,0x7ff9949e4708,0x7ff9949e4718
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6f1985460,0x7ff6f1985470,0x7ff6f1985480
    3⤵
    PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2251497689503354323,12023718596185724331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:5228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:412

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4516

C:\Users\Admin\AppData\Local\Temp\19d05cc1-b170-453b-9dd6-d357c22c70d3_Chlorine 1.0.zip.0d3\Chlorine.exe
"C:\Users\Admin\AppData\Local\Temp\19d05cc1-b170-453b-9dd6-d357c22c70d3_Chlorine 1.0.zip.0d3\Chlorine.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4728
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\729F.tmp\72A0.tmp\72A1.vbs //Nologo
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\729F.tmp\mbr.exe
    "C:\Users\Admin\AppData\Local\Temp\729F.tmp\mbr.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:1596
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\729F.tmp\mbr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2336
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\729F.tmp\msgloop.vbs"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\729F.tmp\noise.exe
    "C:\Users\Admin\AppData\Local\Temp\729F.tmp\noise.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\729F.tmp\mousedraw.exe
    "C:\Users\Admin\AppData\Local\Temp\729F.tmp\mousedraw.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\729F.tmp\sussywaves.exe
    "C:\Users\Admin\AppData\Local\Temp\729F.tmp\sussywaves.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\729F.tmp\BitBlt1.exe
    "C:\Users\Admin\AppData\Local\Temp\729F.tmp\BitBlt1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x4e0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
63716c70d402b580d244ae24bf099add

SHA1
98a3babcd3a2ba832fe3acb311cd30a029606835

SHA256
464f0f2ca24510abc5b8d6ca8240336c2ed1ddf5018fbadb092e18b5bf209233

SHA512
dfe1a5831df6fa962b2be0a099afba87b1d7f78ce007d5a5f5d1c132104fdb0d4820220eb93267e0511bc61b77502f185f924022a5066f92137a7bb895249db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0f09e1f1a17ea290d00ebb4d78791730

SHA1
5a2e0a3a1d0611cba8c10c1c35ada221c65df720

SHA256
9f4c5a43f0998edeee742671e199555ae77c5bf7e0d4e0eb5f37a93a3122e167

SHA512
3a2a6c612efc21792e519374c989abec467c02e3f4deb2996c840fe14e5b50d997b446ff8311bf1819fbd0be20a3f9843ce7c9a0151a6712003201853638f09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
19KB

MD5
50a7026c53a6b63010a7ec964d989483

SHA1
3628a5b13b2807bdf682903fa7da4fa6a3c66256

SHA256
3c18a536e73af296be340b30b869199edbef34cc4267a6d9920fca900059dd3a

SHA512
d57ec868606400c3d774b5497f81257bcb1bd8e21a92746121cbcbb103088f853c2bb572fa0cfece879ea0f487b718e35c75c9aef2e8dda7d52edd75081121fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4fae4f68a00b27a5d9cc7f3309fd8adf

SHA1
2a3bbe7ac6ce7169d9ae902eb014596cf1ed5d6b

SHA256
810df576ae42c0ff3b9d6ddb8a0bed12b42a0006c20fb51f9c32648a46fd6d0d

SHA512
690a150111df590d617ee1408697c4044fc1e8805f1cb125cc5e22529465b039b026718ed3ee832fc033104f77249f0ce4bf7c0dd561ebd6a8056b36ef49df3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
2409504a66206c3c7c99d4e22ea1c0f9

SHA1
d02a730942edd9d0b45c687cd30e94c9d559b8aa

SHA256
7fe0adba2eb12ef628aebb610225053f41f001823f484e6da61f9f32a750a4dd

SHA512
c4a214acc834451494b9bab977d1c848d2e5c4989de870e82edbf29cea296545ceaa82f774a7cc31148819755b61fd1f863e9ed720bf78ef82307370b4ffe82e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c8fc75e0219aced56be872e9cef7d808

SHA1
d9c60b96e3fba6f079f23b31d73cd14941cbd7c1

SHA256
1b0f520f08c7da3520d9963041dbbdc91ed33d111f7dc68bdd3bbf0dc163649a

SHA512
9f0e43d542822c2f742cf818953d2415b6705e4ad8b9151e4c755392aaba83b46925592d802c7e389595bc12ee7c42664025232643e2beaf1714dd6c60817c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5fb9c9a87fb7bfe7748891c4b454e5d

SHA1
3ed943aba6d7c20e20b967408813ad7049e2eb73

SHA256
4b0f5d83fae5508e5873be7ca31d7d7dd9bd853b1a86f447aa5a8ee5e1e0235f

SHA512
5b8e258b12a9a50ad39b0ffdd2fb10f39aa406cc6b1032472373cc1fd7b6a8fc975fd484a873f5f2c716ce43e7234f5156767a8b6767f2c02ce377294b2dd1b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
485d82a4d15cd219eec502193759f14b

SHA1
c6041e1379c53f8d21d2a5c45286ae128d0b897c

SHA256
f40d23d6a46e68321b7b69fe2f053b6c62846ace647efe6ffe07edf359b8a27d

SHA512
4d8a411c0042682fcab90f3ad731b09c8246182678a584394c9d309abc568d83e9a28fa1953c00479314109761033e40c8bfff3b1ffde25860db731813781a53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6bb9cdd8e348727fb2aba76ebb2dd905

SHA1
c06cb06d6189cf2d2eada766bf822330a9b23e79

SHA256
994ee433e393ffcdb25e05062cdfe27606fdb1f3193da92276a4382a2d5d1539

SHA512
c1d8cbec7b8455a7c3adb8ff399ffc2fa9f6cdab5f2c7e9a06457031d223713cf352f79c3382b3c699fa37a49e4238ca4401eecdf0bec459b3c5fbe4208ed5d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15d48f6af4d6e36d8921a09930408ced

SHA1
0074d679a3505f7d6b4871635d307e40565706aa

SHA256
3578a67e1fe624ffcd65e1bbafea285d1571e8446c7c6be5cfdd2afc1733b71b

SHA512
6eb616b1c873731a388d936408b307d81373809d4bf5e225d113f6151b582f46d28f63ebe1eb5cded9386e96d07f4f90ff9073975b4c8714e969c527fd197f78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
aa10f656cc16d036a580048ba0bdac0b

SHA1
52c15a55cc3b56bd1bf5dd0efcd2b66413b7044c

SHA256
166d97573db5472f64c5d066f2b07e6fbff2f1f9d5858fd7757548e334e9220d

SHA512
748fc7d5155285784ecea52d01af8168213210231a698073945b30b4989ae28463a7fee01e24792fd33b17744cd54587f801c5e836c926d700724171bb0000e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ee8e616a03201ab31e032c60a6d81b15

SHA1
4fa72ee1a3ed74f7798b3b58cabe174c675adc12

SHA256
2d77f4c62538359ca9c795a3be97c3817adb7954e004fe4b85cfffbf216f64c7

SHA512
97640f1aec0c917ca0bdda6f0228eff1d4274d2d681c73206be660697d3a7fefbdeeda23d6e3fa853228be633b4988e543a41f84bd027493c7d633089c863151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e6aa7e75f0abda9c6ca012acc789551

SHA1
bffbbd6350e8623a07a5e04a5b7b2432d68791fd

SHA256
c5596094f8a144916646dbc80f6554ee54b64b7791a7da23b7c406148758c0bb

SHA512
5f44d9e9cc0051447444d4a18eb5f6090e0bcc2ddd7d418ab9b73f4393c99231d49a5fc3ef96c432f54e43bd70814ad3df0a70bf4bd92f15e33de719ba29d45a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ee5ebd4e17fed7bb823cd002177c1d09

SHA1
c7e395d36c0b14fdffb87fdbe89e2abfa3e57638

SHA256
f866b9dc1d733f26bc34c1850a6a62777dedf5d86cb47ea8b61ee10a437102fc

SHA512
28f6a4f5d59c8f711de3cc55083be940c9e3ab567dc1d2535a7c172a3302aa48270e580b7da4b0cd200e83986453eabbe61d2f3aa7651f8ce97050cfb01918eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1d642daa22876a0df77c380233e0a900

SHA1
86e7caf636de2f1bed40a00a196e493185be4433

SHA256
59f30c24c91efaa9f5b21e2773e2a4612ca06cf282c361054fa7ba2495a61f7f

SHA512
cb69daad568e7716bb02a0753009164d047963bcd48e010568edd131d64aad3292b9ccfd6464fbab4bd6a355cc413472b69c5011cf1ed6b6c8bdcef40dc14f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe612644.TMP

Filesize
538B

MD5
3e6b82b2063ac3a27884a2f77e1bf942

SHA1
2479eae57f7c5b0310ccf795f2c3a54b72ba8cd8

SHA256
fd85a66f06b89be1034156cb043cfbc9e36bd914beccd5c6d8919724ac978d5a

SHA512
9070370477cedb243351a1cadc9ef951d1bb68d2e8aa824c68d6c15c392b3fbeb30856fcce9860d43f5bd6f4c93a4a9803b8cbd129e1b425c4cad4af5c472066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
e992dc4900166d2a834693077c061779

SHA1
5a9f3d665e3b78a81c7b0169c7ce09b25a189afd

SHA256
0f9b97494d3e0c9390bb4c1530474ebad7178dc7c73ddc2f6f0e1004702006e4

SHA512
c30d6003dc68af1128ec08b2ac4b0f06643d5c977c89b4bfc85bceecc8079bbed6b61afbdcd2d05ebd7dbadd93fc9439f6a8e4c74997007da6bf1d99c9f96ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0948a567188285d854e336f7905358cf

SHA1
795461285dc5d83387343f8295ed6fa94bc1a574

SHA256
ca9d25807fc18dadf8e1bee8c275767c07f81c5d0df12b90e3dc369e7e321a8e

SHA512
bb1acee6621aa19d085af53cbbb2b46f8e1145a59cf48b0a08275fada7a88fa14c2cc107357284a6aea325dc203c9211cba2149e32ae31dc89f8f58cfda586be

Download Submit
C:\Users\Admin\AppData\Local\Temp\729F.tmp\72A0.tmp\72A1.vbs

Filesize
1KB

MD5
3696d36bd5d04261791f69d16fd88ba6

SHA1
803c42f2ca4841013438064ca4ff97bd3ff702a4

SHA256
cc5a747294dc7709dfdf2cd3ecf90ade84cdf40ef0c33dc3ca118f942e250e1f

SHA512
76ff202871bd6bd31ff21bd4d18cf22362e856b3a855112d33202342c570376b86dc90e869330a45d24594db5337b36461bf51b40d59f926ab9e5da78a2b64e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\729F.tmp\BitBlt1.exe

Filesize
105KB

MD5
19a8a16e2a0d3225d1fc390c0a11b5dd

SHA1
ca235475f7a767e10c81426e013ee59106deb306

SHA256
8d6452b5a2dacbf6a1e064fc959f16a5ec13b5986a2687e70b5458eefdb60573

SHA512
d470d61fa9b19c34cd9ed916f9a6b44c821ed47082393212c17c743a764d2eed4dea2aae31f37d984f3c359ca646b34f0c6486f5f473d940c675974deb313ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\729F.tmp\mbr.exe

Filesize
101KB

MD5
0bfd9ea5b537b3661c261baabe650093

SHA1
9e47176814f63c5afbf004a4bf760f9d30eb61ea

SHA256
6e37fc407f408b608592129cb92dbd4472408d834cf813657cdfbb778d47e3f1

SHA512
71a684b7a5538f55630af088d8ff048b1b876b75a485521af790302bed558099cb00f592588cc631a0c1c2e28a2e2815c01affe2f592c8f27c99953407e5c73f

Download Submit
C:\Users\Admin\AppData\Local\Temp\729F.tmp\mousedraw.exe

Filesize
104KB

MD5
f7db0edd465e545dcd947f4beef32779

SHA1
a02d2dcbe4ea1146b726a6191354340f8dd41f6a

SHA256
9bbce9c9e1b513084b8a206e935b2512a341fd81688e71735ef27511d0378d47

SHA512
6d40cf365a30277328f9103083e939ac8fedf860ffef6d0c5bd80d708e0f73d606f456d37aa1fa5e69964ac2e20c263fbaa755a9c28eff962395e3509a7a4e25

Download Submit
C:\Users\Admin\AppData\Local\Temp\729F.tmp\msgloop.vbs

Filesize
336B

MD5
d95b234c9cef8f7f398d758564bf5821

SHA1
cd499485f7b128d2b475bc92311a45cd8c8b6de7

SHA256
33923a07189189bcb897d6617457ece2a93c0fc9f5de8a786c39c874af9a0630

SHA512
51dfccb4975eb385d20cf58af02ed4e19d954777fdcc289a00409d94611d177efc20307312d42fc8e03590d0afc02bf78802830847bd8f0e8a6485bcb9ef8154

Download Submit
C:\Users\Admin\AppData\Local\Temp\729F.tmp\noise.exe

Filesize
102KB

MD5
e085b3f83050eddcfc7caf7e9c09af6c

SHA1
6d4ee550146066eb46b1458fc6b181d0138ded2e

SHA256
de1f597d1b8c96fca15b33a13cb530f52dc140445526db61a01aceb6406df56e

SHA512
9f878aec1adc51ac2ed92c134118beca95704a27235c85eb86350953a6f5639e65c8dabccbbaf427c62b12612d1eee602f433f03a57a04167334fcb3496e6c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\729F.tmp\noise.wav

Filesize
1.0MB

MD5
cdc6c78486f27876fca2f9ce090fe2df

SHA1
5b2655c058b1a0415e00c207839113b863b0a750

SHA256
31be0f1ab83ae8bddccd657ca78c57ee26e2ac3b3a87637e3adc6405f018b399

SHA512
3f80524dbcfd2f1e756710f2f21cb498268da7528077833ed01b4f2030aa0df0f0528a69a6b516ad1e5988174d1395ae189981e707127bea0acdfa6be0477f2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\729F.tmp\sussywaves.exe

Filesize
105KB

MD5
632da6456dceea4819027bad982ab3cb

SHA1
9a5da49ddc3458b72fa3eae77332cac643508ad3

SHA256
13304570c6ccb706114aaae4602be5c85fa1862e1ed0200b3f0de514b14fcd41

SHA512
cceb677651a8f7df59c8a22a076a69be31bc3a72992fbce6373d6908a33a0e2e1b7c669f664a9617933197ec7ff1b6e96fcc8613329b750dc143273f90991a55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
6697641d221862c018b0cf3a74006ef5

SHA1
5ca6ab85f448a9d77e57c4aef88f4a2a547a556a

SHA256
78d226aefe86fa27aa99f96fbddc248d936a4d400b7d42850b00d3b7f63d3d86

SHA512
4e1625e419a7cd6a68eb547478dc38a9e6dd929ad847f49f599fe240ff38a5eb6be3e28b36a3d191dac7e7873e3bd3059f9627ab2bc594903e7ee4a603c4c713

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
159502943759b33317da9f96d16b88d6

SHA1
4299c3486ee1bccaef4fc6a39c9d8e5feac48f4c

SHA256
6e9df368f43102eb8bdf7e6d74217c969c66fca4b7452d27b3b8626ec8faf672

SHA512
adba863f86e258f47642340a49794dec7202becd9e6b8157e9eb02a9fadff52cccce11c402550a4660319e481e1198ca7e1717dc58778e7266a31bc7b0e15f3f

Download Submit
C:\Users\Admin\Downloads\Chlorine 1.0.zip

Filesize
1.6MB

MD5
f4ac9d28631a30ef50f6bca3d3b7cab1

SHA1
7a07ac4f0ad311c8eac484fa963e0c6f53aededb

SHA256
c4f5bc5c881eee90ced6f673271e054454dd9ede74eb8162b7ccee91af53778a

SHA512
c3bfa4c759a1bbd8b0b619fd69ce291b020ef427c94c09531909abeec2250bc584f2fadee4daf9113755ff0d86fd55f8575c02604553cf265dc3fbfd78ee4f0f

Download Submit
\??\pipe\LOCAL\crashpad_4904_LMJDYLAYNQSALADL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/472-615-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1596-570-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2624-606-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4068-607-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4068-623-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4728-524-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/4728-596-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download