dcrat | hxxps://file[.]garden/Z01XJyuAz2yPo4d4/client[.]bin

Analysis

max time kernel
113s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
14-01-2025 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://file.garden/Z01XJyuAz2yPo4d4/client.bin

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5860	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6136	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6084	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5784	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	960	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	960	schtasks.exe	91

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
3916	chainreviewwinrefSvc.exe
4372	msedge.exe
5408	msedge.exe
5448	msedge.exe
908	msedge.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows NT\winlogon.exe	chainreviewwinrefSvc.exe
File created	C:\Program Files (x86)\Google\Update\smss.exe	chainreviewwinrefSvc.exe
File created	C:\Program Files (x86)\Google\Update\69ddcba757bf72	chainreviewwinrefSvc.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\ee2ad38f3d4382	chainreviewwinrefSvc.exe
File created	C:\Program Files\Reference Assemblies\msedge.exe	chainreviewwinrefSvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\dllhost.exe	chainreviewwinrefSvc.exe
File created	C:\Program Files\Windows NT\winlogon.exe	chainreviewwinrefSvc.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\Registry.exe	chainreviewwinrefSvc.exe
File created	C:\Program Files\Reference Assemblies\61a52ddc9dd915	chainreviewwinrefSvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\5940a34987c991	chainreviewwinrefSvc.exe
File created	C:\Program Files\Windows NT\cc11b995f2a76d	chainreviewwinrefSvc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2528	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 8c003100000000004759c064110050524f4752417e310000740009000400efbec55259612e5a16802e0000003f0000000000010000000000000000004a00000000004aca9b00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	chainreviewwinrefSvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "2"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\client.bin:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5164	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2528	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2240	schtasks.exe
4396	schtasks.exe
2948	schtasks.exe
3068	schtasks.exe
4652	schtasks.exe
1352	schtasks.exe
2868	schtasks.exe
6084	schtasks.exe
4584	schtasks.exe
1048	schtasks.exe
3144	schtasks.exe
2748	schtasks.exe
6136	schtasks.exe
3460	schtasks.exe
5860	schtasks.exe
5784	schtasks.exe
3404	schtasks.exe
4532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
2796	msedge.exe
2796	msedge.exe
2244	msedge.exe
2244	msedge.exe
4012	msedge.exe
4012	msedge.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe
3916	chainreviewwinrefSvc.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3048	7zFM.exe
4300	OpenWith.exe
3424	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	1720	7zG.exe
Token: 35	1720	7zG.exe
Token: SeSecurityPrivilege	1720	7zG.exe
Token: SeSecurityPrivilege	1720	7zG.exe
Token: SeBackupPrivilege	3880	svchost.exe
Token: SeRestorePrivilege	3880	svchost.exe
Token: SeSecurityPrivilege	3880	svchost.exe
Token: SeTakeOwnershipPrivilege	3880	svchost.exe
Token: 35	3880	svchost.exe
Token: SeRestorePrivilege	3048	7zFM.exe
Token: 35	3048	7zFM.exe
Token: SeDebugPrivilege	3916	chainreviewwinrefSvc.exe
Token: SeDebugPrivilege	4372	msedge.exe
Token: SeDebugPrivilege	5408	msedge.exe
Token: SeDebugPrivilege	5448	msedge.exe
Token: SeDebugPrivilege	908	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
1720	7zG.exe
3048	7zFM.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
4300	OpenWith.exe
3424	OpenWith.exe
3424	OpenWith.exe
3424	OpenWith.exe
3424	OpenWith.exe
3424	OpenWith.exe
3424	OpenWith.exe
3424	OpenWith.exe
3424	OpenWith.exe
3424	OpenWith.exe
3424	OpenWith.exe
3424	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3192	2796	msedge.exe	79
PID 2796 wrote to memory of 3192	2796	msedge.exe	79
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 1848	2796	msedge.exe	80
PID 2796 wrote to memory of 4332	2796	msedge.exe	81
PID 2796 wrote to memory of 4332	2796	msedge.exe	81
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82
PID 2796 wrote to memory of 6008	2796	msedge.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://file.garden/Z01XJyuAz2yPo4d4/client.bin
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffca2cf3cb8,0x7ffca2cf3cc8,0x7ffca2cf3cd8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,17652494864337396204,11819009778287737890,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,17652494864337396204,11819009778287737890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,17652494864337396204,11819009778287737890,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17652494864337396204,11819009778287737890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17652494864337396204,11819009778287737890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17652494864337396204,11819009778287737890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,17652494864337396204,11819009778287737890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,17652494864337396204,11819009778287737890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4024

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap24266:74:7zEvent14107
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\client.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3048

C:\Users\Admin\Downloads\chainreviewwinrefSvc.exe
"C:\Users\Admin\Downloads\chainreviewwinrefSvc.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b5939eiBHe.bat"
  2⤵
  PID:5688
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5344
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3436
- - C:\Program Files\Reference Assemblies\msedge.exe
    "C:\Program Files\Reference Assemblies\msedge.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KU0xjXjpGp.bat"
      4⤵
      PID:5820
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3804
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:4432
    - - C:\Program Files\Reference Assemblies\msedge.exe
        
        "C:\Program Files\Reference Assemblies\msedge.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5408
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\24XiM7UcCi.bat"
        6⤵
        
        PID:5244
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5624
        
        C:\Program Files\Reference Assemblies\msedge.exe
        
        "C:\Program Files\Reference Assemblies\msedge.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yM2KtpV4cy.bat"
        8⤵
        
        PID:404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4992
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2528
        
        C:\Program Files\Reference Assemblies\msedge.exe
        
        "C:\Program Files\Reference Assemblies\msedge.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aKt4VVYkRN.bat"
        10⤵
        
        PID:5508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3872
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Update\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Update\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows NT\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainreviewwinrefSvcc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Downloads\chainreviewwinrefSvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainreviewwinrefSvc" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\chainreviewwinrefSvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainreviewwinrefSvcc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Downloads\chainreviewwinrefSvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3424

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\cd072d4f31eb71.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msedge.exe.log

Filesize
1KB

MD5
f2e58a4d6897d4adf2e33ca36ace55ce

SHA1
67294a7cca4e465fa83b73debd117b3e6f8277d3

SHA256
c146c805685f0d4962c861f33b3ed0740cc7a21f97e79bdf0411dab030d85b1d

SHA512
5e1a8525517f2d1e0d2e422ad06ec3cf2e22252c77f320d36db6792f39b1f6473eb7a0d34518178f705921c51c2c2ded71c2167ab6605c6262d29da4c16e1bb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
c9a9eea46f33542badcfc8e31e8e4eeb

SHA1
20a0285ec6c23ccd4a539221517b079c4f87e51a

SHA256
50c2fb3b8879888534a5353e9b654ff8dd8a5cfc8c1821dd2b5920aad918789a

SHA512
0d70ca80701d1e1b515cbc4390d6f70896aba5d30f5492faf783c186c22d883cceb9dfb46c5777157a6450323c25b998597ed122184af03eb0b993a18adbf194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b419747856fa317b6704f00001c290b

SHA1
da69aaf23b1c15d137958c5a0eebb3f2c9a38d44

SHA256
2482cb32c1981216841c79e7bc63c88a316707a65388548cf10a808dc0a915c3

SHA512
51d31141dcab9eac831a323d83f2b8f7a2abc3fd35386065d36ccc0175ab7ae7fead398b3c193d7a5f36668ca0384b264e2828e3221f4645439a022abea02900

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88d0b877025c5629f34f2a8d9c219443

SHA1
7c71ee8acb3cc5199a2922e825bd34e63de2999d

SHA256
fd3ec0430169c3c6f0e005c6ff7fd629be3488e92d90ff16cde56dbd335471c4

SHA512
c36f67ad9e5cd5091718fd135574b79af43d2507661f9823c010f8bff6bcc4ff28d69fc8c4f4727e7c090437b5b830be1b4d020113081abac9cd525bcd738a2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e7ea677f75665c504751771e1ec362aa

SHA1
139a16211e1991ef488d30fd9e857eedf54ba549

SHA256
6216822a4adf030d856dece92255df25cf44cfa047979810b09eeb24f9841dd1

SHA512
f135f03a9f333e2e60283bc39edcd855fa1858fc32010fb42cd0c87f5a208989a1f399512f42f639566c6efa97ec4ac14c77dabe568963f6b45c0bfc9296e4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
2418779c98eaff64e65869d398ae4344

SHA1
d7419ad298eca6fd98f2401bff1811c1f48ceb3b

SHA256
f7e1e1e6b53cb86dee443bb4ceb32b57dca28be5fe4de5597fcbd5b50c0361af

SHA512
3766f6f08df7c9ca1132c17c79898cc9ec93da97b048b1bf3791ddf0973a35d6ba0a3129d214ae25132d7b6908c0d8a83f56e9c19f1b351a1e175b2bb2fcedfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\24XiM7UcCi.bat

Filesize
224B

MD5
92bfd80ae34f2b2062745a18e5868886

SHA1
4624c09a4346eeca06c7af68771b3e6eeb0f333c

SHA256
8d3ddd859470c8a62a121be7a75c40d34cba1ad3326668c4b433395c5356040c

SHA512
fb0e5e9d5f7959dfa0a9b5f8e336c83dfd517b19531218cacec5076806a1620c33429eca7664d039bea2be36085505b5f55c401b6a99dc0f274661ca2b172c60

Download Submit
C:\Users\Admin\AppData\Local\Temp\KU0xjXjpGp.bat

Filesize
224B

MD5
07908ebaa3e4293ad0b4921ec3b398e5

SHA1
c60e405b86e2662aad14ad95d7aeca177bf85605

SHA256
a7e9e02a3b13a4d5ae2efa3b3b5fd93b72c8f18ebed9710af533190b517ef06f

SHA512
9ab35b81074e8fa26d395babaecaf9cfc8188b97d976164a9c830a577474c0ccb512e5a860179b2bbbdbd857e72f3e16e76944e6b2a63985d2e1c843d0585216

Download Submit
C:\Users\Admin\AppData\Local\Temp\aKt4VVYkRN.bat

Filesize
224B

MD5
69359de6a006a7b072af9656545d849a

SHA1
19f14fd221dc49574bb747dc2258a03f3724f69f

SHA256
76723564c1fde27e578d6a9347407ccdbbc0b20357da0442ebea454f0253fe1d

SHA512
d63f8d3510d09b4239bca30d6337efd9260940b9d170deb664f424d15280e31b9fc0a3303331e4a731b9a3a47f2d133ef3b41121e3d298350171680d45971e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5939eiBHe.bat

Filesize
224B

MD5
a902de7c21f88635df8e1c89f9a78739

SHA1
0354c0c5ae56a840f2c6a11fe7c98450a4e21efb

SHA256
fe968503d17092c0d8424c5a8704ce2b79efff70d22a6ff78f659627120c1262

SHA512
501d9c289a7983a2d4a3640c1b32ed08b3b3de098b0ac30e139bd557244143c54bdb00af4ac4c4e793d1ccd175b9db2d68bca94e3c9a475f963b5c85cfd5b018

Download Submit
C:\Users\Admin\AppData\Local\Temp\yM2KtpV4cy.bat

Filesize
176B

MD5
99b0a5ec75ad451b9554e3d8427a2006

SHA1
07f5398085dd52fb84bac06c5cfaeb27b1df403d

SHA256
c9dfbaecc26e9a81f0fdee9de161200023d42968586c70447421339edc9a00e1

SHA512
39e6521ecec9862243cc2f72e33367e7c422a413d82a9ed7a9f0c6939196e28870d13653c486732d459bc7280c7534ee6a8bebfcf98444f3cee8f2530d16ad85

Download Submit
C:\Users\Admin\Downloads\cd072d4f31eb71.txt

Filesize
135B

MD5
ffd3a23486189922c1385a87883fbe7a

SHA1
bf7c20e0071a92ab7d101afdb0e9a244b9047238

SHA256
a2a1d5f9d20065435649f63159362246f321d4ad08d7145ac30f22e69e97a125

SHA512
10dd04e05be67016fc2cb035e468232a6ca1303fbfc4c7a0ad92a4654c64d8996f8902cb96af528f0ce2bbb1c6e73c798edd8e1345c239d0a7cdfd65ef6cd71d

Download Submit
C:\Users\Admin\Downloads\chainreviewwinrefSvc.exe

Filesize
1.8MB

MD5
11cca9e2c6dc9c2a728b89e7314ec26a

SHA1
58aec3b662a1c4e8b43cc454d90813ac89b5e612

SHA256
300072795259e7b2baa69a7a3d19ffea1844dffc391e710c654aa1b66b0e2197

SHA512
fb1fcff1c94e73b1227f65b237639e25604d614cfe365f2108bbbfdb489b97410fdc17411b8f00fc5b8f57d51080b4496010537a6a4ff9b15b7bdd24f89d0df7

Download Submit
C:\Users\Admin\Downloads\client.bin

Filesize
2.1MB

MD5
bf4f13d82d217ed69d80124c50d9441c

SHA1
b7ee7d109f61371342e924e6a0c3505347dd318f

SHA256
51890bfc6f223014ff16f4bfa6ace8e2d2ec3c81eb6965406813b9ca32b08508

SHA512
1ba17e55d6d1f6fda99daffe3f11f995d5e8434901b2aea9105728ccbff1b81727d96bf8811a62e8367fca0ec23bdea331165b001088b183281164269668d2f4

Download Submit
C:\Users\Admin\Downloads\client.bin:Zone.Identifier

Filesize
83B

MD5
21a4e3fa1f322d6cc4fd333e7301eba1

SHA1
474b9610a38ec6773ae95580af36861764f1ee2f

SHA256
fe16e443d523334bb93b293d5d41213defbab10e3c8a719dcce329889f43f186

SHA512
28df1386b055dc0c17b5ff9ea484a2b249182e2d345e2665b51aacaafa184ee6f6984964f5ba396c74d341bac0ee392430201f48f4e6acb7672e4ec9c12734ab

Download Submit
memory/3916-129-0x000000001BE20000-0x000000001BE3C000-memory.dmp

Filesize
112KB

Download
memory/3916-134-0x000000001B9F0000-0x000000001B9FC000-memory.dmp

Filesize
48KB

Download
memory/3916-132-0x000000001BE40000-0x000000001BE58000-memory.dmp

Filesize
96KB

Download
memory/3916-130-0x000000001BE90000-0x000000001BEE0000-memory.dmp

Filesize
320KB

Download
memory/3916-127-0x000000001B9E0000-0x000000001B9EE000-memory.dmp

Filesize
56KB

Download
memory/3916-125-0x0000000000C90000-0x0000000000E6A000-memory.dmp

Filesize
1.9MB

Download
memory/5408-175-0x000000001C220000-0x000000001C2C2000-memory.dmp

Filesize
648KB

Download