revengerat | hxxps://github[.]com/enginestein/Virus-Collection/tree/main/Windows/Source

Analysis

max time kernel
160s
max time network
174s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
25-12-2024 11:29

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/enginestein/Virus-Collection/tree/main/Windows/Source

Score

10^/10

revengerat warzonerat guest defense_evasion discovery evasion infostealer persistence privilege_escalation ransomware rat rezer0 stealer trojan

Malware Config

Extracted

Family

warzonerat

168.61.222.215:5400

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2020	bcdedit.exe
4712	bcdedit.exe

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/3952-985-0x0000000005480000-0x00000000054A8000-memory.dmp	rezer0

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x000700000000f64d-872.dat	revengerat

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/4864-992-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/4864-994-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Downloads MZ/PE file

Enables test signing to bypass driver trust controls 1 TTPs 1 IoCs

Allows any signed driver to load without validation against a trusted certificate authority.

defense_evasion

Code Signing Policy Modification

T1553.006

pid	Process
4712	bcdedit.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2116	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
4732	DanaBot.exe
3984	Spark.exe
3952	WarzoneRAT.exe
4948	RevengeRAT.exe
1460	RevengeRAT.exe
3492	NJRat.exe

Loads dropped DLL 1 IoCs

pid	Process
3984	Spark.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
1	0.tcp.ngrok.io
67	raw.githubusercontent.com

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3952 set thread context of 4864	3952	WarzoneRAT.exe	132
PID 4948 set thread context of 3992	4948	RevengeRAT.exe	135
PID 3992 set thread context of 4292	3992	RegSvcs.exe	136
PID 1460 set thread context of 2548	1460	RevengeRAT.exe	140
PID 2548 set thread context of 332	2548	RegSvcs.exe	141

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\File Cache\Spark.exe	Spark.exe
File created	C:\Windows\File Cache\Spark.exe\:Zone.Identifier:$DATA	Spark.exe
File created	C:\Windows\File Cache\Initialised	Spark.exe
File created	C:\Windows\File Cache\DLL.dll	Spark.exe
File created	C:\Windows\File Cache\IFEO.exe	Spark.exe
File created	C:\Windows\File Cache\Driver.sys	Spark.exe
File created	C:\Windows\File Cache\Spark.exe	Spark.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\NETFramework.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\RevengeRAT.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NJRat.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Spark.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4292	4732	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NJRat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegSvcs.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 10 IoCs

description	ioc	Process
File created	C:\b9584a316aeb9ca9b31edd4db18381f5.exe\:Zone.Identifier:$DATA	NJRat.exe
File opened for modification	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 487271.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\RevengeRAT.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NJRat.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Spark.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NETFramework.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:Zone.Identifier:$DATA	WarzoneRAT.exe
File created	C:\Windows\File Cache\Spark.exe\:Zone.Identifier:$DATA	Spark.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3912	msedge.exe
3912	msedge.exe
2352	msedge.exe
2352	msedge.exe
236	identity_helper.exe
236	identity_helper.exe
4692	msedge.exe
4692	msedge.exe
4476	msedge.exe
4476	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
2360	msedge.exe
2360	msedge.exe
3068	msedge.exe
3068	msedge.exe
4720	msedge.exe
4720	msedge.exe
1264	msedge.exe
1264	msedge.exe
3984	Spark.exe
3952	WarzoneRAT.exe
3952	WarzoneRAT.exe
3952	WarzoneRAT.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe
3492	NJRat.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	Spark.exe
Token: SeDebugPrivilege	3952	WarzoneRAT.exe
Token: SeDebugPrivilege	4948	RevengeRAT.exe
Token: SeDebugPrivilege	3992	RegSvcs.exe
Token: SeDebugPrivilege	1460	RevengeRAT.exe
Token: SeDebugPrivilege	2548	RegSvcs.exe
Token: SeDebugPrivilege	3492	NJRat.exe
Token: SeShutdownPrivilege	3984	Spark.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 2492	3912	msedge.exe	77
PID 3912 wrote to memory of 2492	3912	msedge.exe	77
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3372	3912	msedge.exe	78
PID 3912 wrote to memory of 3140	3912	msedge.exe	79
PID 3912 wrote to memory of 3140	3912	msedge.exe	79
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80
PID 3912 wrote to memory of 876	3912	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/enginestein/Virus-Collection/tree/main/Windows/Source
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff79e03cb8,0x7fff79e03cc8,0x7fff79e03cd8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:3644
- C:\Users\Admin\Downloads\DanaBot.exe
  "C:\Users\Admin\Downloads\DanaBot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 296
    3⤵
    - Program crash
    PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7196 /prefetch:8
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7308 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7272 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:764
- C:\Users\Admin\Downloads\Spark.exe
  "C:\Users\Admin\Downloads\Spark.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" -set nointegritychecks on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2020
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" -set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:5040
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCB93.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:648
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,12841198338887937129,12717402197851721606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:2824
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4292
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:332
- C:\Users\Admin\Downloads\NJRat.exe
  "C:\Users\Admin\Downloads\NJRat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\Downloads\NJRat.exe" "NJRat.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4732 -ip 4732
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Subvert Trust Controls

T1553

Code Signing Policy Modification

T1553.006

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegSvcs.exe.log

Filesize
120B

MD5
50dec1858e13f033e6dca3cbfad5e8de

SHA1
79ae1e9131b0faf215b499d2f7b4c595aa120925

SHA256
14a557e226e3ba8620bb3a70035e1e316f1e9fb5c9e8f74c07110ee90b8d8ae4

SHA512
1bd73338df685a5b57b0546e102ecfdee65800410d6f77845e50456ac70de72929088af19b59647f01cba7a5acfb399c52d9ef2402a9451366586862ef88e7bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
18KB

MD5
7d54dd3fa3c51a1609e97e814ed449a0

SHA1
860bdd97dcd771d4ce96662a85c9328f95b17639

SHA256
7a258cd27f674e03eafc4f11af7076fb327d0202ce7a0a0e95a01fb33c989247

SHA512
17791e03584e77f2a6a03a7e3951bdc3220cd4c723a1f3be5d9b8196c5746a342a85226fcd0dd60031d3c3001c6bdfee0dcc21d7921ea2912225054d7f75c896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
33a080a713aa4abaf50b2ad96ff7ce18

SHA1
a561471c2f95db0cd07e5c7bf1d1e7c4f6625aa7

SHA256
ab67c296ca2bc8fbb854a41e70ed19d29a41b8704a582272fc5a1fd86b6e2c05

SHA512
5cc63bd8d2d183392e34aab48357cf572720293984473b8867c89bef03d683ea2a204d5d9823e8d6c0f967cee5c5785fe0b1c72c028052601187b21acfb28585

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5b6066302cd0f741a44f1ebfcaa9722b

SHA1
6c0650d1067b815727fc949c1765e60c7b06ca1e

SHA256
ddcafa07be6c56f85aada7691419455e9c7357db09a13a774ccd46e1854e6684

SHA512
fa203568c10999220ffb4efb780d1bf7d35a3c6dfc375245a588b7fe2c69ee4ccc7abd31031a5dd09d0d4af7ec817d4e9973dfaabb7f27bee685e9266c392ec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
733B

MD5
0496b3ce88d322cb58e2cb001ab3fc9a

SHA1
ffdc20c79262a4fe44a50cc5992a441868badcda

SHA256
cd2f169ed9bbbc50f104152c5cdddfca49aba6eaaec24070cb26836fd57a21b0

SHA512
e13ec7b392c789d991e0edde116947a945c84837f2e6a51159021db988d15a0eac3be3d4f849f92c384067b1c5947cc0a295e189ae74d8606e16b3df09fbed75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1009B

MD5
8d73abc1fb8ef161501c4200925872ba

SHA1
9b71446fa3f2587dd59864c3541994ac2baa319c

SHA256
0075ef50b9f58bf16ec440789153347741700a41de48d79ba41b841d4a693872

SHA512
6396387a61471c90f833cec9fd67cf2ead926f78385943be6818c29003b846caf0d383ad16ea8678add5f47f541d7dd954a49e9d52ddaf708620e10122d55eae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f673ede6aa2f7d1f9cd575b90dab9b20

SHA1
6fd4dcf2581a426e4ee8fc0de36daee9bde19d9e

SHA256
8c36631d4ed6b9d053d5900becba9898d0ded8a8abc08ee95520a3b69f804268

SHA512
cf564c5ddaed98f8e90bb8480e9f2a4540df0ee8a57ec1ca28cb1d83e5b89132ad3e9ae2985ea639df1598ed237731feb4912309d5ce7c809ff56610989b3c4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab70333e10238a1b78271dc442312302

SHA1
de151faeec987890d534a0232e99115b62476a59

SHA256
abbce52414b0c279c5aa9568f09ddceef9b0493e432592f8f89de36e1fac7259

SHA512
8252faa7e586b907234a4c1bdb572e198efd6b8b9ea25fca6cfdf0b824c338f858d593dfa473547c169a26226e985ade4a5fa7f9a81c9185615ec95208c3697d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc41fcfc9799db8f1908c868b14d6826

SHA1
c84ddbd3bd17248f78ce46a5cb163e6ce0590cec

SHA256
065809e7d9415d26a47ff14e82b96eb256e58ba3d84c63b72219503bca4fbcc0

SHA512
7baec08fe8afa3100f5ae83e939267354f0fbd15c7eb51a1fd5eb3120013fe8bf93a7338d7e891ac093510d347662d0d3129d143505f5e0b2875733670f036bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b614847b32ff266867faeaca021d72f3

SHA1
444561f62619080d0f1cd1830a9a9346b1650a63

SHA256
8e44d3b823eb9d598e148e988462840c00da9c2ab56bee82d68414b87b80141e

SHA512
e5e74faa2033e0bac3a06f6fde517235781286aa27b29b0335670d7c998b01e1576c4818d78517a3967f737704dea9d0b6a544d1ec46b680f1151da2c6c31910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9ae863e5c1afa20c3cd9587f7065603a

SHA1
67f63a067170fa8bba10fa162dc3c9501dfcd8c4

SHA256
d49dfd5748953c659e7c4efeb8108f193e08f7f9b3235a9719008fac56cd8558

SHA512
f0d9b634d512e80a648c844cadf661dce7f2bb894dd06e39649bbe502ce818fe31f8e4dc8ab3a21858ae7993a00dd7ef51b5b488325cc8ae57a07bf02329d46e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
09b36c5768b3f46157b17779cddb09d9

SHA1
cfe117404b684c1fbf93703b5bbd96e0a7275ebd

SHA256
e7918e1b67a98c04bda9f4aa43631eb94593ba28cd247a34d93ac7748868e605

SHA512
d8eede65e4c37dbc286ae73221a9e641c76bfb43fb2dd38195f31b91a8765bb874c279c5edb124067aaefc4f8132454f776f410ac2cfd4bf2d0523adfad25aa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
198a344ed5f59bd4e0a8072b82bb2d4d

SHA1
7bbfaf4b210648ee78f137b5766c0501e992eae0

SHA256
8b2e6bd49213ab20c032bd983998f987e2b243b55de9d318bfd7126250cbce81

SHA512
32d3dd4e6a94a8587b75029be183853e3dd5df9620e9dd0e3563340055a8dbcbe1c4ef7bcc94cfa0517ed1cb94767a64011bcb429489e4bd632bb4a6cf177c7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
97270de323c7f06d0eec5cb107e88977

SHA1
2c70ce963fff3d1992ecd0b448455fc5762f99f9

SHA256
2165814cffe6f4d6e9c6b8c6e7856c90a813dd8697541ac8b8fe7877d595c8eb

SHA512
f6f0932f13f142823c91614995a03135b7413dcf878b319d909e580b4ac433c0eff1072d8c2d084e9171150b49aafd8a8911dd49336aba48939e9a7db4c666dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b6f2db3eb2069d1539900b0982c0f897

SHA1
568fe8272a34df3532ec25c02ed8f81aa1610a70

SHA256
351e99d4cc124936692ab99241e0f4d85913a760e78b5568327aef06398a0f2f

SHA512
78a2a2fecfcf11261123bdab09d311d97ccd303169d65f0c8fcce34b2856fa8366072a2a2e5edd7c55570f5cc6526918ccf2af098fcde3fe5e3a6679d64b51b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
783f5f0536aea12fefbc33d360ef0be2

SHA1
c1fdb3f912f7cc08079da24c2f9657c7410f6343

SHA256
855a9b15b645c58af0cd1f5c8e512c0a62504244124409f79b099c0240d532a7

SHA512
adfb38ebed316d82bb9fc3c370971e1070468d792e559b0a2547366d1a756736582ca9cc39fad6961e9ba73147d4a6516af58db994dfd27e66bb300146a7177d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
130e17cfb0267bda87e26ec03b54e7b5

SHA1
1c26b4f1ad166ad61e0b96f29879579e513fae79

SHA256
1ad432c8ea6bcee039e6574f8d35215d22e8680ea0dbacaa803dcb0562999f0c

SHA512
6a49b91947056be62a3def1bea13b8327c833416154032c4c5ebf86ded1aeb14023322ac9981b0e8c4891671e8887bd86bea63129d84a2e0718383f229c61605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ae4c458267135a42e2560f9327bd01e3

SHA1
98fe59cbcfcf21fd274410e56d33c559377e6d8f

SHA256
9e07ba723713fc01cbe9f1ab5cd454669576792527bebd64168a31d83cf65afe

SHA512
a1e79c5aabb5b31c7137e769eb088aaa2793f50187aa517816eb13c15d13e19b964b7e785b99f56330e93bed849795f0765013ae019009b97cdc6083d5b8de28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580078.TMP

Filesize
874B

MD5
cf766adca7c83ce45c82cf48d4dc3b74

SHA1
dfb1e6904269f58be3550f47e7cf13d7ba170ca8

SHA256
24704add9c22e8b4e499547023b275744b8b55c8acd552e85e37fc5ae7329de5

SHA512
a49b121fb3c0746d46008d2acb195fb4241798eec88ce20868c26cf628993ac6c638912b94f2d2892d18c8582af32b040e5b91f83495ed57beadd3f4a20092b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
205485ec04d0957c3776235f0d8df9aa

SHA1
a3b6b6930127d2bd9ed89d821687c60a0ef37bf8

SHA256
819639d07c43278ca3f8618ba338d283297037cd80fc63989ff86700beeb1365

SHA512
7c9b24df783eb2726594ecc0fa8d2972b91a3612692b56f27f1d792a4317111c446d8bbf232d5f99da834bb0cc86ce592675be7385f280a7d7c6c9e6e75c1714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7fc3a2d8a001b774880b9aa005264d9a

SHA1
7b7c67edf1a006307ae2e2d9fcb7f9457511d751

SHA256
4fc4f366c0684a4a6c678414de502128e4c15cfc55f37db6df38855d052ff475

SHA512
1490ce7bef4813fd99be405928f559dad79a8d6b1fc6d927eac1d1423d4070274a78c902e37e652cce2fc4c730153c4e0008b82edf2bce7a8ed3e23601e6233b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ce960e6d672c55d5ba50f09412531914

SHA1
ffa21d058c994cf4b4ca71ff926f36063ba183ab

SHA256
9666c0d913f436c560e8d6129c5a11cfc6766c57f6cf25625661eb0f6f3cf580

SHA512
326b0134215644ad8d5ff1a4aceb2edbf6ad19423e23b37df48ff4bf39a4aa89e32d723e8c898dbe855c7918e53d203a0347d57fc9101a1f54f73f59dc01345e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e5802e4fc3cdeacf1cf39b8a2ef945c6

SHA1
5f7ae5529e8b4fb5f70f116706deea700a5fee5f

SHA256
95f5cefe114bef632a3801e5f1aafeca120ae39acddfb0fb201cfdea5398cb3a

SHA512
df68306fcd5202f45621a9861a1cceb6091779300aeac87d52b703e0fcd873920e9dd079ceaf05807b00661956cd921352aa0fe73ec0a9429023d53c52537f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a0b9572c-991b-4dd1-a7d7-f967602f8ce4.tmp

Filesize
11KB

MD5
afd8a7a9963a6c6359f61bc830279ed6

SHA1
c9228588b04a02f4ca4b5703271b10da58e41510

SHA256
ab403423df525b9f00e0fe8ba6590ec20c675a97719bbd1a24830d47260ed748

SHA512
48dc9a76b665ed8a110478ccc2246dda99cd3791ee6f7b336a92a713ca8c70652a9afe77732c0cd7d6bff27dc07d2710fefcc03b59094d8b8f74162d54483a57

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCB93.tmp

Filesize
1KB

MD5
8eadec610e1257c2c95dc0a114c8a1a8

SHA1
71535fc3b41b7ccdcf2a707b672beb1bf9a0a03c

SHA256
8a457eff5b84287b1112d2e91d68c6b7ce6927cdf2914ea211959e9ee4914892

SHA512
e9003796720756884994085a9e818779c6f1fd148816e1a46fff5e399d85f5e51e4053406e89868406eb74882b52d9cfd801fe897a947b2e22e12a56bddff245

Download Submit
C:\Users\Admin\AppData\Local\Temp\uRClgZblR.txt

Filesize
39B

MD5
502984a8e7a0925ac8f79ef407382140

SHA1
0e047aa443d2101eb33ac4742720cb528d9d9dba

SHA256
d25b36f2f4f5ec765a39b82f9084a9bde7eb53ac12a001e7f02df9397b83446c

SHA512
6c721b4ae08538c7ec29979da81bc433c59d6d781e0ce68174e2d0ca1abf4dbc1c353510ce65639697380ccd637b9315662d1f686fea634b7e52621590bfef17

Download Submit
C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\NETFramework.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 3406.crdownload

Filesize
4.0MB

MD5
1d9045870dbd31e2e399a4e8ecd9302f

SHA1
7857c1ebfd1b37756d106027ed03121d8e7887cf

SHA256
9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

SHA512
9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 393845.crdownload

Filesize
31KB

MD5
29a37b6532a7acefa7580b826f23f6dd

SHA1
a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f

SHA256
7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69

SHA512
a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 448671.crdownload

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 487271.crdownload

Filesize
1.4MB

MD5
4fb795478a8f346c337a1f84baccc85b

SHA1
c0919415622d86c3d6ab19f0f92ea938788db847

SHA256
65a7cb8fd1c7c529c40345b4746818f8947be736aa105007dfcc57b05897ed62

SHA512
9ca9e00bb6502a6ab481849b11c11526a12e5a1f436f929381d038e370c991e89a7bbcddc62da436accaeaa1d292b6453fdea964d645d08299a64aa603f8bc69

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 491043.crdownload

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 866384.crdownload

Filesize
495KB

MD5
181ee63003e5c3ec8c378030286ed7a2

SHA1
6707f3a0906ab6d201edc5b6389f9e66e345f174

SHA256
55bfcb784904477ef62ef7e4994dee42f03d69bfec3591989513cccbba3fc8fe

SHA512
e9820f60b496d6631e054204c6fc5b525527d40a578faac1d5cdb116abcb4a35aacf4f4354ff092a2b455c5d9c2e0f29a761d737d9c9ad3d59d70b51d0583d92

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 921473.crdownload

Filesize
50KB

MD5
47abd68080eee0ea1b95ae31968a3069

SHA1
ffbdf4b2224b92bd78779a7c5ac366ccb007c14d

SHA256
b5fc4fd50e4ba69f0c8c8e5c402813c107c605cab659960ac31b3c8356c4e0ec

SHA512
c9dfabffe582b29e810db8866f8997af1bd3339fa30e79575377bde970fcad3e3b6e9036b3a88d0c5f4fa3545eea8904d9faabf00142d5775ea5508adcd4dc0a

Download Submit
memory/3952-979-0x0000000000360000-0x00000000003B6000-memory.dmp

Filesize
344KB

Download
memory/3952-983-0x0000000000C70000-0x0000000000C78000-memory.dmp

Filesize
32KB

Download
memory/3952-984-0x0000000005B00000-0x0000000005B9C000-memory.dmp

Filesize
624KB

Download
memory/3952-985-0x0000000005480000-0x00000000054A8000-memory.dmp

Filesize
160KB

Download
memory/3984-975-0x00000000053B0000-0x0000000005956000-memory.dmp

Filesize
5.6MB

Download
memory/3984-976-0x0000000005020000-0x00000000050B2000-memory.dmp

Filesize
584KB

Download
memory/3984-974-0x00000000003B0000-0x0000000000430000-memory.dmp

Filesize
512KB

Download
memory/3984-1045-0x0000000005960000-0x00000000059B4000-memory.dmp

Filesize
336KB

Download
memory/3992-1010-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4292-1011-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4864-994-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/4864-992-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/4948-1006-0x000000001C080000-0x000000001C54E000-memory.dmp

Filesize
4.8MB

Download
memory/4948-1007-0x000000001C600000-0x000000001C6A6000-memory.dmp

Filesize
664KB

Download
memory/4948-1008-0x000000001C790000-0x000000001C7F2000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads