hxxps://gofile[.]io/d/kQoB54

Resubmissions

18-12-2024 12:18

241218-pgqceazlfn 7

18-12-2024 12:17

18-12-2024 12:16

18-12-2024 12:14

18-12-2024 12:09

Analysis

max time kernel
45s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/kQoB54

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Steam API Cracker Coded by MR.ViPER - v3.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Microsoft Windows Protocol Services Host.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk	Steam API Cracker Coded by MR.ViPER - v3.0.exe

Executes dropped EXE 4 IoCs

pid	Process
1412	Steam API Cracker Coded by MR.ViPER - v3.0.exe
4976	Microsoft Windows Protocol Services Host.exe
4548	SteamApi.exe
5056	Microsoft Windows Protocol Monitor.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\Virus Total\desktop.ini	7zG.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Program Files (x86)\Microsoft Host Interface\Data\Microsoft Windows Protocol Monitor.exe	Steam API Cracker Coded by MR.ViPER - v3.0.exe
File opened for modification	C:\Windows\Program Files (x86)\Microsoft Host Interface\Data\Microsoft Windows Protocol Monitor.exe	Steam API Cracker Coded by MR.ViPER - v3.0.exe
File created	C:\Windows\Program Files (x86)\Microsoft Host Interface\Data\Microsoft Windows Protocol Services Host.exe	Steam API Cracker Coded by MR.ViPER - v3.0.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam API Cracker Coded by MR.ViPER - v3.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamApi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft Windows Protocol Monitor.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4976	Microsoft Windows Protocol Services Host.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
2900	msedge.exe
2900	msedge.exe
2044	identity_helper.exe
2044	identity_helper.exe
3860	msedge.exe
3860	msedge.exe
4900	msedge.exe
4900	msedge.exe
4976	Microsoft Windows Protocol Services Host.exe
4976	Microsoft Windows Protocol Services Host.exe
4976	Microsoft Windows Protocol Services Host.exe
5056	Microsoft Windows Protocol Monitor.exe
5056	Microsoft Windows Protocol Monitor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	4852	7zG.exe
Token: 35	4852	7zG.exe
Token: SeSecurityPrivilege	4852	7zG.exe
Token: SeSecurityPrivilege	4852	7zG.exe
Token: SeDebugPrivilege	4976	Microsoft Windows Protocol Services Host.exe
Token: SeDebugPrivilege	4548	SteamApi.exe
Token: SeDebugPrivilege	5056	Microsoft Windows Protocol Monitor.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
4852	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3872	2900	msedge.exe	83
PID 2900 wrote to memory of 3872	2900	msedge.exe	83
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 5092	2900	msedge.exe	84
PID 2900 wrote to memory of 852	2900	msedge.exe	85
PID 2900 wrote to memory of 852	2900	msedge.exe	85
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86
PID 2900 wrote to memory of 2256	2900	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/kQoB54
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdce0346f8,0x7ffdce034708,0x7ffdce034718
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,4059061763027538799,15339262679259110945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4744

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\" -ad -an -ai#7zMap27112:112:7zEvent25091
1⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4852

C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\Steam API Cracker Coded by MR.ViPER - v3.0.exe
"C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\Steam API Cracker Coded by MR.ViPER - v3.0.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1412
- C:\Windows\Program Files (x86)\Microsoft Host Interface\Data\Microsoft Windows Protocol Services Host.exe
  "C:\Windows\Program Files (x86)\Microsoft Host Interface\Data\Microsoft Windows Protocol Services Host.exe" {Arguments If Needed}
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4976
- - C:\Windows\Program Files (x86)\Microsoft Host Interface\Data\Microsoft Windows Protocol Monitor.exe
    "C:\Windows\Program Files (x86)\Microsoft Host Interface\Data\Microsoft Windows Protocol Monitor.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\Data\SteamApi.exe
  "C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\Data\SteamApi.exe" {Arguments If Needed}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
db58f0e8de7e3dae99fcd0354b702471

SHA1
d77b9fa98f0035ff9d58cc6b35dfd2d2cb58dc6e

SHA256
ba49ed9af022c186bc99815efb4841381a92b050d0e883b1321096ae4fe8d05f

SHA512
2675c28e2e46350864b9c3b2589339baf5d0a8ec89789ce4d1dde4f3e4e7ba32d7e84fd13be1a17187283f3a0e533c66025a8c5689d7cd17c8375ef07ae1498d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
473B

MD5
6e9c5273f4a9789842919ac745b40612

SHA1
e28af3ef1995b1ed617260bc4f72def9d8f0202c

SHA256
cb858f47eb2bdc4f8997ece3b26240ec490cbc949b0b128004017772231e3d88

SHA512
393659da264cf4d14c2fc65ec07e418ab15c8f594684696972e0cae9309552807f8573bff459302876b13d74bf210fe6fe4179c5948ac06f26cdcc47f44bb42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1eb394bb0d2a2eca143cfd3692c340a

SHA1
7e0fd0742a8399243f98ac9564e58e12f5280445

SHA256
fbd8c70b36a679b9d49005c618408b7b106bfa2d1d7ad3c38bdcbd646eb22d54

SHA512
23815533a6b02e8ee55b8bc35bff198d9ab888f414ceb2c60a9b3bb684d7702a6ae05ef30e38bb3fc3f05525416a8c16b827cfbc762dcb7b223dda895a2b0ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ae3c928485ee42189125add83846400

SHA1
21171c4a6610a6eaa5192567d3d1388b71e49a43

SHA256
4a04d86d2bb9f20ffe51f5032527c8496ce6bcb7320d2ed65b0b65f4eb7ebd9a

SHA512
f6e1bd1b90a4b6497eacb812891ca83492fe6308e5afe420acd106781312f3ec2478ad83f86793e5d3d5ef938ac7ae9970fdd0c78bf13d3e2f79eeae653e88b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8773099529c81be1664b674ccc79ac66

SHA1
aa3c535ea797f79afb44db0725711f39fb3dedaa

SHA256
9d5e2544f3f339e3a54b8eec10fa06fa21afad63aaa47652fbf31f7682ae7301

SHA512
aaae8c80132daabdde4978f5c36dc665c05d0a7d1c20871fa0046ae1eaefeec8b288d9656290a35429d0bb60b57810c788bb16846d33e0865b9e4895ff97e6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6315e9831340b4f118ec4a2f1c3b3983

SHA1
4fcd890d2c79da2c2d8f0c9776d687dc769a997d

SHA256
7546535d5b4a44703ada6781331dc246cd5e84d3b54b7df9fe544945ff688478

SHA512
b10b6434a475a77fac3acf182b7adb6a2136adf8af329a998ed1e6e4cc57d6333fc7bd9ab0490392b8e2b10383238f68321bd1a9d6be9f60c94f35cca824d7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2d047dd99f045a8fcead7bd0c562ed7d

SHA1
210405970756a439ae8f6795e98373b1517fa79a

SHA256
726a8721b2a800f2946faaa2bd5a08ca60ffc56c2cedaa4def076a4c8eb6bcea

SHA512
cd210162399dedd6adcb4070ec518d05a8bd1559399ac779c5d9a235e0d882c3d543e604087a9b71549e16df3163165605ddf081beee37031df3d5479a053119

Download Submit
C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER.rar

Filesize
1.8MB

MD5
659ccac29a8ef6a918146e1585ed4288

SHA1
a06ebb0d13ea282bcc75b7bc8696cedc0a242696

SHA256
47715294a4a85e5308a26b046bc13768f3e300911875ad92b8506aa154ef1a61

SHA512
bb466106d7485dba2fb193186a771cfcbe85d2b6d1ec7a70040c8b4d4238b9ba7d101ca3aa6d294fd1f399b3596ce70902c72bd4407b1b7f0447b8166bbfc695

Download Submit
C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\Data\Microsoft Windows Protocol Monitor.exe

Filesize
9KB

MD5
61fce223872024b0ecb0bb2a7ffb7c47

SHA1
f893d620f9d843c8bdb86a0375f856508a6ce136

SHA256
4b5069b9708a8e97b17af6aa96cf2112877a675b4dbc1f6dbc2601b494b35d11

SHA512
8926a5f7d6aa862351044d79a634decda989b50ad422ba3e9a97c573ff618a8314607a7afe093925f56d87861eefb31d3820d9e02b1cf2847c0e6072880ac192

Download Submit
C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\Data\Microsoft Windows Protocol Services Host.exe

Filesize
9KB

MD5
b90f7cd95e2f8ffcf180a4c96be66014

SHA1
4fd7eeb26b6eb7227262d0d8cf6fac947a9ff231

SHA256
38a61d517c08fe4da2798c9a42d5bde4bbadf3758cf70638709a3eef5079e8e1

SHA512
e83d9d8971a2374d5694fd8a45814f1307f891b8dfb2bdda80911948b762bcedc9de236462caf88e3398c3287a00f08db9274f5739a1f9259ef8de0aea018795

Download Submit
C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\Data\SteamApi.exe

Filesize
1.1MB

MD5
428b193b299abf00ffb17a13e3485ca3

SHA1
d22e03b1abaff0e862bb371afade0a9103364e03

SHA256
07a95c611eeca43f18c36211ba9a710d5dbb59f4339ed1faac1523f31107a092

SHA512
42b007ff51052c5b643760fb8490bfe717fe9ee146be5b301db0df8dfa65ac61bfd1829445e0b0237150db003db1f5eb5e82fe3e47b26c5b337ae36d5a61de33

Download Submit
C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\Steam API Cracker Coded by MR.ViPER - v3.0.exe

Filesize
13KB

MD5
0bda6a46010a4798858b725d4fad4394

SHA1
056e416d1802f0b2a7618caaba58439dbc10ff5c

SHA256
b90901e5f167d0631bf924e4d616881c91a0f2cc3c6f498f4f0f896a6ffb46f9

SHA512
1bd6951193166cc661a0742c9b1c6a03c5f25a20d8185e2b307565822a06d01caf3efa8335d3b7f6ffc4bf3c9c02a22f46d42635f0a0c49279690d375d67c6e0

Download Submit
C:\Users\Admin\Downloads\Steam Checker by Mr.ViPER\Steam Checker by Mr.ViPER\xNet.dll

Filesize
116KB

MD5
3df8d87a482efad957d83819adb3020f

SHA1
f5b710581355ac5d0de7a36446b93533232144db

SHA256
2ac175b4d44245ee8e7aee9cc36df86925ef903d8516f20a2c51d84e35f23da4

SHA512
da28c34a85a6530b1c558fa11b0e71e70710d719cd8ceaf81f954d1fe3927ec139bee6c5f3135425cc5220905240f1a31d831611c46d18f5d52600b607ea59a6

Download Submit
C:\Users\Admin\Downloads\Steam Checker by X-SLAYER.rar

Filesize
1.5MB

MD5
df2aa099aaaf245e1125c949431ce534

SHA1
7fff72baa77272e1e314802cca2009c3c2d38936

SHA256
e539ac53241fd8d1d1d80e4b9b97f19cd7bf6fbe9b77fd24da09717c634d3677

SHA512
7de65faf0bd0ae75535d7061910d8dbfedf947d9a374baab6ff7f4643b1d4a64ec5a26d6f534cd79808e33e9025bb61cd79c3cbfb3d0d0b007289958173eea4c

Download Submit
memory/1412-234-0x0000000005470000-0x00000000054E6000-memory.dmp

Filesize
472KB

Download
memory/1412-229-0x0000000004F40000-0x0000000004F4A000-memory.dmp

Filesize
40KB

Download
memory/1412-228-0x0000000004E80000-0x0000000004F12000-memory.dmp

Filesize
584KB

Download
memory/1412-226-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/1412-235-0x0000000006C10000-0x0000000006C2E000-memory.dmp

Filesize
120KB

Download
memory/1412-227-0x0000000005510000-0x0000000005AB4000-memory.dmp

Filesize
5.6MB

Download
memory/4548-253-0x00000000004A0000-0x00000000005CA000-memory.dmp

Filesize
1.2MB

Download
memory/4548-254-0x0000000004E20000-0x0000000004EBC000-memory.dmp

Filesize
624KB

Download
memory/4548-258-0x0000000005190000-0x00000000051E6000-memory.dmp

Filesize
344KB

Download
memory/4548-259-0x0000000005310000-0x000000000532C000-memory.dmp

Filesize
112KB

Download
memory/4976-250-0x0000000000F20000-0x0000000000F28000-memory.dmp

Filesize
32KB

Download
memory/5056-257-0x0000000000870000-0x0000000000878000-memory.dmp

Filesize
32KB

Download