phorphiex | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Resubmissions

30-11-2024 01:23

241130-brr24awjcs 10

30-11-2024 01:22

241130-brh47azpcm 3

15-11-2024 19:13

241115-xxjtkayqgz 10

Analysis

max time kernel
76s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

phorphiex redline xworm 1337 defense_evasion discovery infostealer loader persistence rat trojan worm

Malware Config

Extracted

Family

redline

Botnet

1337

194.87.248.37:1912

Extracted

Family

xworm

147.185.221.22:47930

127.0.0.1:47930

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Extracted

Family

phorphiex

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd

Attributes

mutex
753f85d83d
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

phorphiex

http://185.215.113.84

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023ca6-185.dat	family_xworm
behavioral1/memory/5476-193-0x0000000000FE0000-0x0000000000FF8000-memory.dmp	family_xworm

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023ca7-298.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b84-10.dat	family_redline
behavioral1/memory/2640-17-0x0000000000370000-0x00000000003C2000-memory.dmp	family_redline

Redline family
redline

Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs

description	pid	Process	procid_target
PID 5404 created 3380	5404	RMS1.exe	56
PID 5404 created 3380	5404	RMS1.exe	56
PID 5404 created 3380	5404	RMS1.exe	56
PID 5404 created 3380	5404	RMS1.exe	56
PID 5404 created 3380	5404	RMS1.exe	56
PID 5404 created 3380	5404	RMS1.exe	56
PID 5404 created 3380	5404	RMS1.exe	56
PID 5404 created 3380	5404	RMS1.exe	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	313772969.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 10 IoCs

pid	Process
2640	marsel.exe
3436	spofrln.exe
5404	RMS1.exe
5476	svchost.exe
5892	m.exe
5564	sysnldcvmr.exe
5588	313772969.exe
5176	1540423532.exe
5172	2101913542.exe
5656	1867011991.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
29	raw.githubusercontent.com
30	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
102	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5404 set thread context of 4544	5404	RMS1.exe	143

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sysnldcvmr.exe	m.exe
File opened for modification	C:\Windows\sysnldcvmr.exe	m.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	marsel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spofrln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1540423532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1867011991.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	spofrln.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000006a4174df9718db01745a28749f18db017e32878ec642db0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
3988	msedge.exe
3988	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
5204	msedge.exe
5204	msedge.exe
5476	svchost.exe
5476	svchost.exe
5588	313772969.exe
5588	313772969.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5404	RMS1.exe
5868	powershell.exe
5868	powershell.exe
5868	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2916	OpenWith.exe
5204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	4363463463464363463463463.exe
Token: SeDebugPrivilege	5476	svchost.exe
Token: SeDebugPrivilege	5404	RMS1.exe
Token: SeDebugPrivilege	5476	svchost.exe
Token: SeDebugPrivilege	5588	313772969.exe
Token: SeDebugPrivilege	5404	RMS1.exe
Token: SeDebugPrivilege	5868	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of SetWindowsHookEx 57 IoCs

pid	Process
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
2916	OpenWith.exe
5204	msedge.exe
5476	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2640	1360	4363463463464363463463463.exe	91
PID 1360 wrote to memory of 2640	1360	4363463463464363463463463.exe	91
PID 1360 wrote to memory of 2640	1360	4363463463464363463463463.exe	91
PID 1360 wrote to memory of 3436	1360	4363463463464363463463463.exe	92
PID 1360 wrote to memory of 3436	1360	4363463463464363463463463.exe	92
PID 1360 wrote to memory of 3436	1360	4363463463464363463463463.exe	92
PID 3988 wrote to memory of 5032	3988	msedge.exe	95
PID 3988 wrote to memory of 5032	3988	msedge.exe	95
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 1544	3988	msedge.exe	96
PID 3988 wrote to memory of 4620	3988	msedge.exe	97
PID 3988 wrote to memory of 4620	3988	msedge.exe	97
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98
PID 3988 wrote to memory of 1404	3988	msedge.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3380
- C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
  "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Users\Admin\AppData\Local\Temp\Files\marsel.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\marsel.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Files\spofrln.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\spofrln.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Files\RMS1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\RMS1.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Files\RMS1.exe' -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Files\m.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\m.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5892
  - - C:\Windows\sysnldcvmr.exe
      C:\Windows\sysnldcvmr.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\313772969.exe
        
        C:\Users\Admin\AppData\Local\Temp\313772969.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5588
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:5832
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:5800
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:5636
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\1540423532.exe
        
        C:\Users\Admin\AppData\Local\Temp\1540423532.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\2101913542.exe
        
        C:\Users\Admin\AppData\Local\Temp\2101913542.exe
        6⤵
        Executes dropped EXE
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\1867011991.exe
        
        C:\Users\Admin\AppData\Local\Temp\1867011991.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffec1a046f8,0x7ffec1a04708,0x7ffec1a04718
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3528 /prefetch:8
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3528 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2032,4851971342904277796,2514564137849880678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5204
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4424
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5192
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2916
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\microsp
  2⤵
  PID:2708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
307b2169dadc8171963378d19db16275

SHA1
aef5ec036ba4775a6410d01aa432fc7afb0c43a6

SHA256
36d7c8343e72841238c16b12a888a278e7a3ebbbc79de0f643f4d92e6bc05729

SHA512
76e1b3fa49e16c2431eafe68da883981783855a7202f0720eeb7efd915a06b35807fe88ab802c3e247aadd96bb47981bf607ecdf341e1093e4c261eb740164a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
495B

MD5
960035d6d5838db956469bc7c325666c

SHA1
19492d6c700938455cd589eaffdd674ebe024758

SHA256
3fccdc664ef976f008d171f32ef3ea8c7eb73df1e9b83fd233932cd37142342c

SHA512
f5a58a502fd9c47641c03d87c2457f3cd4d25a517358ee6fef37b2677bb069c26f17a005f2289b1fb91f48fef446d7eb388514e5182db00d5f545811a2ac7334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
614096532bfc5f4c9373ac5694b0f63c

SHA1
04882505e5ad8a8732d1284aba95ec8c91e31904

SHA256
3a7475fb02a420a899c77bc873a5717eac573a87c8437cf87ce1dd69d9dddd66

SHA512
a2f3d1b73422113cfee4a7005385f01eb4e6d376df6d5846abbe78bd488f63eaf101c1eb8eb327e4c38df720b66880bbdede1e373d94d6ca0beeeab38deb3456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f23c1c204a564f26d9dbeb4a6961edca

SHA1
0a04b1d74309a750ce5e83f64ae330989b329c8b

SHA256
8f7cabec2aa5306ae0abc76557dca739f6749971c49ebdd9598337f76adc99b1

SHA512
ab1bb6a34d1bede904df575a03a5e78554f37edcf744cddffdaa28f7e02dad642cc71b5ffaa4d0855db4d379987fab18b4ad8f521c38513c52f2d89ed7c332cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2376a3143a69632aa7315cbc59802fc9

SHA1
5abefc42e57bb30af83cb596ba2c5f8548edc685

SHA256
6ae97941cc76e62b7da3eda5d9f26203981b17e9d873bf666324921140f2618a

SHA512
27c19efe842f44e066930c19278ea38ee0cda9a1408535ad53f50e091917efbf55de4436d291bd64dd85e574a999d761feb24736207a17e0d7c8bb9e58ff4639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
279cf5a252c82b9399b8fd39390712a5

SHA1
9499056f2d933b64e5a90151b78ced5313dd2c5c

SHA256
87fda874cd64a2397ab9eccbb0dfbf876532f57069b752ab438e6d2deb417814

SHA512
bcc509ac2b674e37c5e79a4085a7863c956c30fa57a01fc90de6164f7a719b945eb9906ec5ab0f5d534d50f8066e943768216e919752ce7a9e5e9a14d0fc32c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
32c379b51979b01e74d10a4b0b9eacdb

SHA1
46406e1fef467b2d9c60c61237dbdbb26f8c9ecc

SHA256
d3de900537c759d47cac68aa7b5238aea7be9e6d1f6b2fc27686d88b19fdcf3f

SHA512
796edd9025bd3b6994a3729e1a7fe29f94100ed9e71b40fc811cfe551bef34452dc4c2b8c7fe5fd29cc3e5daca324c3ce1658df2330a5bc3c62194de14d0d21f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5e93b4863c6825dcc46788aaa75dac5d

SHA1
7b315c674dc126b1436196e72141ddf2dae71386

SHA256
ea204da68617b4fefb09cd4c9088a37987bd86f9add0b58e6ab8ed74eb0cbb43

SHA512
1803692c6430c928c403494b35de193aa6fbf1ed3ae7be414a7ff3531b40633d10ec69185ba9d32e2ace2117b66027680dd0ff535c020fc8cf4bb952dc4ca73b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dd4b9689c067373e000c108a2d703d2b

SHA1
e8a6d914d4a73e4d1fa3836e7ef962750597156d

SHA256
94002d0f2854cd7a4a0c73dd755bb318e6e44c9b335b8870001e2547e83b7d4f

SHA512
482bbc3c4119ec88b9cdc2e9c8eb566c85629bfac2a3a278a273ff7a5656bd39b72633d9d343636ed31f536008d6740e6c14647d8e04701bf5ff7f117003e0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\1540423532.exe

Filesize
10KB

MD5
96509ab828867d81c1693b614b22f41d

SHA1
c5f82005dbda43cedd86708cc5fc3635a781a67e

SHA256
a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

SHA512
ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\1867011991.exe

Filesize
61KB

MD5
77c5eb90118287f666886fc34210c176

SHA1
d7a59bf4f014304e29df1868ef82fe782432120a

SHA256
59a96d66d97e202829ea79a5e0bbf71981c05a13ab700b0120f7d99d33515080

SHA512
5577d167ad4748ad7917ff3f792a0caa01ba40638bdf7143c1403d2efcad4019f8da49719ae0ad88febdc1ef64207fba7ca5bb96dc12c334571d30e2e8f22cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2101913542.exe

Filesize
5.6MB

MD5
13b26b2c7048a92d6a843c1302618fad

SHA1
89c2dfc01ac12ef2704c7669844ec69f1700c1ca

SHA256
1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

SHA512
d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

Download Submit
C:\Users\Admin\AppData\Local\Temp\313772969.exe

Filesize
8KB

MD5
cb8420e681f68db1bad5ed24e7b22114

SHA1
416fc65d538d3622f5ca71c667a11df88a927c31

SHA256
5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

SHA512
baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\RMS1.exe

Filesize
1.4MB

MD5
03b1ed4c105e5f473357dad1df17cf98

SHA1
faf5046ff19eafd3a59dcf85be30496f90b5b6b1

SHA256
6be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba

SHA512
3f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\lnwtLq4.exe

Filesize
5.2MB

MD5
f9d439154b882444a73ebece7b6dff73

SHA1
7f824a2f7c485c1445d7c1d249217b0c01c3acda

SHA256
9c022e0b33b29cde3ad608628c8928939e543be3fcc62397c4a7951cbc552488

SHA512
4f1474de49831a62a33656a0107f430b80d5a08658d888ba6bc0990ba610068d4dab59216ea956ad059ca084f6c51325b79e28199ced66adc806d95843d59c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\m.exe

Filesize
79KB

MD5
0c883b1d66afce606d9830f48d69d74b

SHA1
fe431fe73a4749722496f19b3b3ca0b629b50131

SHA256
d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

SHA512
c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\marsel.exe

Filesize
300KB

MD5
7b00870520af8ffe5a031a618a3ef0de

SHA1
0156615f305b09fca3ef86b52102e159fcd0761b

SHA256
849becb338206340fafa50fe6711451ab9d51887725db18afe7d83a17bbd5191

SHA512
40401fc1e2f02742aff8626a6d5f058ed1bc5344d37f50e0109affd1e048864d390af03e086be7e3379761e4c882f27a209f918da68063e11475dd2b2c83ffa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\spofrln.exe

Filesize
37KB

MD5
fdf0546d58297a6e51596876a12239b8

SHA1
e3a107f3f5a3d42548a1be0e8a23fc24206f70e5

SHA256
f224346929620555fc8ffea8a7814cccd5073434c3607583e4e87414cb599352

SHA512
56ab06704bb457c332afb7ea0703c826c1bf94dcc83912d8478d9b81d67e7e3eaffe25ba8883df39fb9ee3c0b0644b87cd0970274a6fc1717fa620af9e9deac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe

Filesize
69KB

MD5
35de149d3c81727ea4cce81a09f08581

SHA1
dfa61238834b2f689822ece4f3b9f3c04f46cd0a

SHA256
1803c1f48e626b2ec0e2620649d818ebf546bfe58dffddfbad224f20a8106ba0

SHA512
dc7986c5849b6aa21ce27f0dac697f2a9d069fcd3652f1a50d1d50ab06985b6ea436458cc63dd16d7030be75db7e20c84e62bd05062b06a5ec18e2fca2b50152

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ueta5cdy.wzv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1360-1-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1360-2-0x0000000004C10000-0x0000000004CAC000-memory.dmp

Filesize
624KB

Download
memory/1360-3-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/1360-4-0x00000000753AE000-0x00000000753AF000-memory.dmp

Filesize
4KB

Download
memory/1360-5-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/1360-0-0x00000000753AE000-0x00000000753AF000-memory.dmp

Filesize
4KB

Download
memory/2640-35-0x00000000056E0000-0x00000000057EA000-memory.dmp

Filesize
1.0MB

Download
memory/2640-74-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/2640-38-0x00000000057F0000-0x000000000583C000-memory.dmp

Filesize
304KB

Download
memory/2640-30-0x0000000004E30000-0x0000000004E3A000-memory.dmp

Filesize
40KB

Download
memory/2640-101-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/2640-33-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/2640-37-0x00000000050C0000-0x00000000050FC000-memory.dmp

Filesize
240KB

Download
memory/2640-29-0x0000000004C80000-0x0000000004D12000-memory.dmp

Filesize
584KB

Download
memory/2640-36-0x0000000005060000-0x0000000005072000-memory.dmp

Filesize
72KB

Download
memory/2640-27-0x0000000005130000-0x00000000056D4000-memory.dmp

Filesize
5.6MB

Download
memory/2640-18-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/2640-17-0x0000000000370000-0x00000000003C2000-memory.dmp

Filesize
328KB

Download
memory/2640-34-0x0000000005D00000-0x0000000006318000-memory.dmp

Filesize
6.1MB

Download
memory/3436-31-0x0000000070500000-0x0000000070AB1000-memory.dmp

Filesize
5.7MB

Download
memory/3436-82-0x0000000070500000-0x0000000070AB1000-memory.dmp

Filesize
5.7MB

Download
memory/3436-28-0x0000000070502000-0x0000000070503000-memory.dmp

Filesize
4KB

Download
memory/3436-32-0x0000000070500000-0x0000000070AB1000-memory.dmp

Filesize
5.7MB

Download
memory/4544-1478-0x000001BCE0060000-0x000001BCE011C000-memory.dmp

Filesize
752KB

Download
memory/5404-261-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-202-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-251-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-247-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-245-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-243-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-241-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-237-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-235-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-233-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-229-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-225-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-231-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-223-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-221-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-219-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-217-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-215-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-211-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-209-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-203-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-249-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-197-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-213-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-207-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-196-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-1292-0x000001B15B7B0000-0x000001B15B854000-memory.dmp

Filesize
656KB

Download
memory/5404-1293-0x000001B141290000-0x000001B1412DC000-memory.dmp

Filesize
304KB

Download
memory/5404-253-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-255-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-257-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-189-0x000001B140CB0000-0x000001B140E10000-memory.dmp

Filesize
1.4MB

Download
memory/5404-259-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-239-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-205-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-199-0x000001B15B580000-0x000001B15B6A5000-memory.dmp

Filesize
1.1MB

Download
memory/5404-195-0x000001B15B580000-0x000001B15B6AC000-memory.dmp

Filesize
1.2MB

Download
memory/5404-1471-0x000001B142BC0000-0x000001B142C14000-memory.dmp

Filesize
336KB

Download
memory/5404-194-0x000001B15B450000-0x000001B15B57A000-memory.dmp

Filesize
1.2MB

Download
memory/5476-193-0x0000000000FE0000-0x0000000000FF8000-memory.dmp

Filesize
96KB

Download
memory/5588-1324-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/5868-1484-0x0000025CF5C50000-0x0000025CF5C72000-memory.dmp

Filesize
136KB

Download