hxxps://example[.]com

Resubmissions

28-01-2025 13:27

250128-qp9axssqck 3

28-01-2025 13:08

28-01-2025 12:54

28-01-2025 12:51

27-01-2025 18:45

23-01-2025 19:23

12-03-2024 13:45

12-03-2024 13:33

Analysis

max time kernel
894s
max time network
845s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
28-01-2025 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://example.com

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2852	main.exe
8	main.exe
1508	main.exe
4052	main.exe
2852	main.exe
1628	main.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
16	camo.githubusercontent.com
46	camo.githubusercontent.com
51	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4668	1508	WerFault.exe	122
956	2852	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crpt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BcatCrypto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BcatCrypto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BcatCrypto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BcatCrypto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crpt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1651422038"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31158703"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ezgif-1-e99b3d2b6b39.gif:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BcatCrypto.zip:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2036	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
4936	msedge.exe
4936	msedge.exe
1384	msedge.exe
1384	msedge.exe
2376	identity_helper.exe
2376	identity_helper.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
2080	msedge.exe
2080	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4216	4936	msedge.exe	77
PID 4936 wrote to memory of 4216	4936	msedge.exe	77
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3332	4936	msedge.exe	78
PID 4936 wrote to memory of 3092	4936	msedge.exe	79
PID 4936 wrote to memory of 3092	4936	msedge.exe	79
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80
PID 4936 wrote to memory of 2028	4936	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://example.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcd2c33cb8,0x7ffcd2c33cc8,0x7ffcd2c33cd8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\ezgif-1-e99b3d2b6b39.gif
  2⤵
  - Modifies Internet Explorer settings
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,1655381198507682864,2942591903513327986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1744 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3004

C:\Users\Admin\AppData\Local\Temp\Temp1_BcatCrypto.zip\BcatCrypto.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_BcatCrypto.zip\BcatCrypto.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1556
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2580

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_BcatCrypto.zip\How Test Program.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:1756

C:\BcatCrypto.exe
"C:\BcatCrypto.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4088
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:8
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1900

C:\Ajay\BcatCrypto.exe
"C:\Ajay\BcatCrypto.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1744
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c crpt.exe -e -p deCtr$% "C:\Ajay\BcatCrypto.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 580
    3⤵
    - Program crash
    PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1508 -ip 1508
1⤵
PID:4268

C:\Ajay\BcatCrypto.exe
"C:\Ajay\BcatCrypto.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3100
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c crpt.exe -e -p deCtr$% "C:\Ajay\BcatCrypto.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1128

C:\Ajay\crpt.exe
"C:\Ajay\crpt.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2396
- C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c crpt.exe -e -p deCtr$% "C:\Ajay\crpt.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 572
    3⤵
    - Program crash
    PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2852 -ip 2852
1⤵
PID:1640

C:\Ajay\crpt.exe
"C:\Ajay\crpt.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3464
- C:\Users\Admin\AppData\Local\Temp\RarSFX2\main.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\main.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c crpt.exe -e -p deCtr$% "C:\Ajay\crpt.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
9f96d459817e54de2e5c9733a9bbb010

SHA1
afbadc759b65670865c10b31b34ca3c3e000cd31

SHA256
51b37ee622ba3e2210a8175ecd99d26d3a3a9e991368d0efbb705f21ff9ac609

SHA512
aa2514018ef2e39ebde92125f5cc6fb7f778f2ab3c35d4ec3a075578fda41a76dbd7239fe2ea61533fb3262c04739c6500d1497c006f511aa3142bb2696d2307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
26KB

MD5
8ce06435dd74849daee31c8ab278ce07

SHA1
a8e754c3a39e0f1056044cbdb743a144bdf25564

SHA256
303074dab603456b6ed26e7e6e667d52c89ab16e6db5e6a9339205ce1f6c1709

SHA512
49e99bffcdf02cfe8cef0e8ef4b121c75d365ab0bbc67c3a3af4cf199cc46e27ab2a9fdf32590697b15b0a58ee2b7a433fe962455cf91f9a404e891e73a26f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
20KB

MD5
edff034579e7216cec4f17c4a25dc896

SHA1
ceb81b5abec4f8c57082a3ae7662a73edf40259f

SHA256
5da4c64f6c1ff595779a560e215cd2511e21823b4e35d88f3ba90270d9244882

SHA512
ab2dcd1628a0d0cadf82eebd123526979e8cf0a2a62f08f1169d4c03b567eca705bd05a36e5ffa4f6c3df393753b03e3daa18122955dde08fd8e5b248694e810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
4.9MB

MD5
ad6d6102891e5ebb93b219255b8eaefe

SHA1
2338a9a6d39c8757a4974fa07ced5bb7e72beb8d

SHA256
b9512439edde053eef00cbbc6dbf6ed781436cda4f68d79bb4f96b35dcbdea57

SHA512
29ab02e07a3694a8045055d22c44d1aaf4e5156cf95b4a08be0dcdf25cee36037e0584d0b19c24133c4b1d983368a0a7e00832df9e637f0bc39124e46098dd79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2f27a748ec469fe5ec653735b229b5ad

SHA1
f2bf2e17d45779f6ef6fc51ff499ebe4317acdd8

SHA256
7cf6a3a29746a8cef87ac47ef4ebd8762fe1574fd44281057192f06d7240975f

SHA512
dee2c180e23b6a19d6ae608649281df52cb57461a85c52d485d34da3b31c2b87bbbf5613f01fef88eae4135924a0db3eeed9fa257ecd94b014e59da0388bb148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
9b98154c6f510ebac09b244745cbcd66

SHA1
392e134ee9eeb061ac792af234986de10b2314a7

SHA256
2cb53715712ad5bf0a78e0c1dfde78ade34e5c8d7624a311d30a8317a4d7719f

SHA512
323a962ba54c0de2f50dec892a771e4379bf98f1017a23bdbfd28618b400e62f9465fce7931f0dadf811f32956518e9a46eec18b322b16530e961300e43fdaff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3d996419886ffd37cc26b67e283f3562

SHA1
f5e4d214aaced446e3033f1102c3175cc0ad10e7

SHA256
3026f377204e254cffcaa0934677f55613033c10ab3a745d629456b81da523fa

SHA512
389da1bb7ceca32080a7ddf2eaa848325959621c8ae60da113bd2420304c0f291a6f8d5006b44fd20f07c113c495b09b2856b9569d02dddc6fe1a839dcccb7ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
849B

MD5
9ade5f08aff3ea968e6cc6b6caa5b9a6

SHA1
2db629ad79fdedc8fc1d0391f0f223afbca34f9b

SHA256
d46531698c9b8da97ed159afc08101d382327843c1251cf0cb11876d49187617

SHA512
83f9ea65ecac0d937dcb66ce20badababd8cf64b87d7bf17f5c2fcbca32eec5e7f2223cbf1229d5dcb1613196bd2f12c7bfc90bc8f69922df73809217b009c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b0e40d08083a489dd21a3ea2a8ee09b8

SHA1
2886dba618cff197ea61d98d5e9458fd412beac4

SHA256
cbcca0c45c0c9084fe9c5a46af2c0b70ef7e202c776fb829c18869b12e8e7f8a

SHA512
ee2452bdbe37f6f30c03056e8ab7770757345ab791a4595ca629eb92df64a82866bd9c184de5f15e5a2c41699bc6e2f2dd89f2782e3460f6dca816d30ee7787e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
788b2cb1fb3337d491331f9970f1de3a

SHA1
60b702d644aa5893a83bad5e4de6c7d9e2df7c9f

SHA256
2358fef892a169c24d2f64f83d0d384db560c7df67bd1e6fa6d6e5146d5a6e3d

SHA512
ab549b5ddcfaa62c520ed4898ac0038a5afc28a46d516588e6d56b76b73510db93793e032c5f0fa43c4010966c7358447ab03708385e6fb2b73c1b76dbd57a49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
716adaac8b90f4aac2c125ceb45f4b0b

SHA1
7ef04ab936e558c2e54b07b8740c91a30a8d8ab2

SHA256
302e998b6aeed29f75c13a9c45bdc51fb8443c6b57142ef488c3557a23d1d999

SHA512
65c36944e8f3a3fda2f12babe9819eea38b7814548f78d37dba617c7d5a16bc2a204b6a99bbe96bbfd49040cc5509c8d6be092ae063c9195c1434d836d1f9ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
83de5352b7792304658893389424cdc6

SHA1
18968c03fb1ebc75ed3de4703219550810b50da1

SHA256
a339131768d607468c6349e04ee5a27355ef0c90cc80ea5498ecafc400008d57

SHA512
b9cd6a1f636f3d7e1560c89252779f84be7024090492755255b13d8d8b5953561d4e8d2e9337b13393e2e281c205a1314630d7871e46e0d23e47232418cd86bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89497f9f21623ec10be0b3ded3a23db1

SHA1
75c2df22408ce679c2ad234efcdf464c72278193

SHA256
f7a81da04300a325f62c0322fecef54f867930762fead39df02a82baf57b7e1f

SHA512
0cc441143a991da106e18d2a64137e3ba9698a8956fa25c30403056db661b4a72a7aaf1e855bfc0790d5d2ad4f1302d83592b0a810732677585795ea148ebd36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
cd04fb7f27d066c9a92c4164b037b5c4

SHA1
0371a89c67ffde12cb56a9a10a1b2bc54d6ff8ac

SHA256
b4c8258e6655864d49ec7a9cb6f684917b024ea0c71ffac308f912f8ee772ead

SHA512
fe4fa00f309f8ff8f1d1683e404b30b174f7ce8b546f13c616686c77f2396f07e4a5829979b44869c4908d27233aeb1b4d80976e730063c20326a38ce65c78c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
066e47a0d150588e7c8ad9ba517ff217

SHA1
1bdbb6623dec80f3c7d439a4a61b394acc6084af

SHA256
84c44d5479726777deca5d5d5677853ba205c1c9ff79d74444ccef64bc9dd9a1

SHA512
2f4155b4fe0c326c19e828243cd12ad11f36e5cfa157efed9fb0945bbf498bd8120ee2503f80910ea0ed1c12a53914894b39acee29eaa8ccff9320096326191d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
875312906187da3213cbace1b9e4fae4

SHA1
5c31026573efac649ee4ab2babcd61bdff928cd0

SHA256
c97f4c31c957e45cedcb03a0c29aeb7cdc43e57b23dd5e56506359169716ef8f

SHA512
beb507bfb5d86758e6a0d3edf3ebcf573f1c0067c9eb89cda3df6998eeeba78acb4554329cae6f39f7f9ec3fde3d5255770fbe32bdce3c902ca96e394a2ef033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b65921629f28f2be902c06b1aa4c515

SHA1
ec03ea3cf965349869a385cdd0f9fd418bb14981

SHA256
ce05435538818276703890dc1006ff479f75c20fb247d7eac7be360de129c446

SHA512
122727df96e66cc171aa7b62a7a2af5252939dd40fe60cc198f216220d891031a3e1cfe0755805f2610c67c6e4b839d48c7649c8fa1ac5648d3db5b1bf14fa10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
55e005a04acdfbe6e0433ba97ac12f4b

SHA1
856e08e1d32f374051e75538335c03ff0e2c3c86

SHA256
2bf95e1dcb73b113b7df26e25fbdcc5ad2ef715b3e5bc59fe7a098171177327f

SHA512
1b6935276c9f67fefbfd6462aad461c8f7179642963966ea7db8e37b54925fe1ed5721fff8900dadcf02b2ffe47d7954eb80b96c34f9d08d9eb826f2e110b15e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9f5c463ab1c6112083666afc2e40cbdb

SHA1
7b22874f554bf1ab627b9623a83f4802fadd3cc3

SHA256
4087a1210d79aad50d4c40c9fb5b6dc127ccab4b8e0d6e65cbd0205272c86660

SHA512
f8f9ee228185f086d5e4f6a514fb2a53c2e25c73af7842016efe896f773ade747e6fdc3c28ba9cc7b10b1e0b0c40e7343a9d054dabef356383d6fac8f2e05a2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b9d39dbacaaaf774ff7b145b45df481

SHA1
f02b29c92bfb3109c1e3be082bf02aef26b8c078

SHA256
92dcb70edf007572b9bd5be472aa7d069b971b8a3386028996e078a6b42ce306

SHA512
d801635b7e3943e4603bf45bf88a0c0e37bc9ba7147cd1e35d9c46288e1f4495aa6432a9c695b6f1940b758d5c7cefe1405fca8bad2af280185ea24d2ea24cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
064b45377286c724689009126c851abf

SHA1
99bd7929f745c8e97e8a2ebedab62540bbd36961

SHA256
f0d22a51c4bce65aeceec1db421fb0d4dcf6b3f5768d1d7346db96ba2da691b1

SHA512
680f893e976b3b47b9a2639af7ea47c1f371532a070ccfb866ae687ea10456581d482afbdb500a006eac7434883b44d0c5a8d68e9ff8187ae32682a29a61862e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58842f.TMP

Filesize
538B

MD5
6f834a98fadd021913cb46ea9f8f0fbb

SHA1
d75d0c0cbd58dd3b88d7fa9855c552c323c8b087

SHA256
b85fc7bde1ee246857f030406cfd914a89013bf40dfd7c4cbf525fa28cc88815

SHA512
8b79216d2fec5fd3f796d4da64be11ba3683a5e5bf8d0d29fd3d67e6ed7722b4432e7bd6b310cab939e5dfd1faf847d2be5de3935de9740e567c446dc2e74ca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1b11240b38ef2a03bf215f9b72b8441

SHA1
27c3de4a2f7cf37ab35fc543c7b78db6a175e410

SHA256
dd1987e6103f7c965f28c0695a25ce5ed81af360ef43437dbda0d6ce43397868

SHA512
b77546488457361ce8278e4368a0d9fe4926cd2024b99735bc21f0ee0ad6cd5add5d523c85476ed3ecb3a63f1c857fd983e1fd93fb832887ad6886415c7df54f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a35cabc8dd31958c8786f50e9785c631

SHA1
ed0673ea4e778a2354e49710abc7f9015edae4af

SHA256
6ad3eebd046d3ae0cf64aea3b08f5bd3d63188e847aedc4b84f96ff6e5b36714

SHA512
f650252fea3133014e36d2e7c5b8b9e5c24c41befd7f70117f0cbd51356c41f8c696575ab9d2fb0d3f2d4b4f82ac01143cde542e3346bd7436965ebc591ba249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8263c58a6ee793518a60a64e082d19c5

SHA1
0f1e9537be7252aa528065ca7c65c9d4a72f79e6

SHA256
e7259cdf29343f059dfc1e413767123bb1b308f9516edb53d63dc0dbc71fcbb0

SHA512
90bbcb442c838f73bd1545be0916d0f75e7dfe95723ad5d9158c14a6a9b638b538ff6ad14c304161fe7b760fe5411eb911e92378ca8aadfea8ffa75bb9522eac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8d73928e06ec2f16d98af1485ef3c540

SHA1
ba728af5540e00ff634ee2922a8a1e0e6bf3577e

SHA256
889a2d1e0903cfe3736c0ce294abbeb87b3c08dc266f2968e0fa152a5c61ab49

SHA512
9a00b1102d3f43d4b19abfc2854f8bb0201c4927b2cbf299d669cf03bd93d58f5e49288f79351a3fa04ccc493625a9177ff2cb5a620b1ebfd511e4f4dfb64fe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\crypt.exe

Filesize
151KB

MD5
e5125d4651c008eba61d9fd3abd5ab31

SHA1
4a85e5d6ab73891832c9adaa4a70c1896773c279

SHA256
874cb7a8513b781b25e176828fe8fe5ac73fa2fe29ea2aac5fe0eaad50e63f39

SHA512
26ba2cecf7324e1c5fe46112c31523e2fabad8de34fe84ce3a9e3a63922b0f85d84982e7c6bae13d2e3cf65193f7a19a67a2fc80af5a78ef8cfe611fce1a9409

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe

Filesize
1.5MB

MD5
b60e214eaa44ff19503fbd4f5317a1ed

SHA1
14020df6fa74797607db5ca081a232c8c21cf6f2

SHA256
7c8da07bc7da089402739b2c1d006ba6373fefea38e557328a134be65ead9b2c

SHA512
06dba6c725a21a274603243366688fb5f868d3f80f069c41acdbe384b70485af29a1df1ea97801163392f60a2e90f46c91961e35a829f63665f0ad38baaa03c3

Download Submit
C:\Users\Admin\Downloads\BcatCrypto.zip

Filesize
568KB

MD5
37cbda979b054f52a91629131ede55c9

SHA1
473fcf804ee3904601dc13c390e5bea4c58b5702

SHA256
33765f8786fe116b6a584a0a90c7e5622e12f3b6ac6967d9d5f0b7b93a72b895

SHA512
d72111cd07484976e4a8b5c63726c612f983286ae4992350742144eee49766fb70d18ace09674f84cf0f3d36421b8e9cdb56db5539ef96725322918a3a2db1ae

Download Submit
C:\Users\Admin\Downloads\ezgif-1-e99b3d2b6b39.gif:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/8-841-0x0000000000730000-0x000000000094C000-memory.dmp

Filesize
2.1MB

Download
memory/8-839-0x0000000000730000-0x000000000094C000-memory.dmp

Filesize
2.1MB

Download
memory/1508-853-0x0000000000A20000-0x0000000000C3C000-memory.dmp

Filesize
2.1MB

Download
memory/1508-855-0x0000000000A20000-0x0000000000C3C000-memory.dmp

Filesize
2.1MB

Download
memory/1628-895-0x0000000000950000-0x0000000000B6C000-memory.dmp

Filesize
2.1MB

Download
memory/1628-897-0x0000000000950000-0x0000000000B6C000-memory.dmp

Filesize
2.1MB

Download
memory/2852-776-0x0000000000CB0000-0x0000000000ECC000-memory.dmp

Filesize
2.1MB

Download
memory/2852-774-0x0000000000CB0000-0x0000000000ECC000-memory.dmp

Filesize
2.1MB

Download
memory/2852-881-0x00000000008E0000-0x0000000000AFC000-memory.dmp

Filesize
2.1MB

Download
memory/2852-883-0x00000000008E0000-0x0000000000AFC000-memory.dmp

Filesize
2.1MB

Download
memory/4052-867-0x00000000005C0000-0x00000000007DC000-memory.dmp

Filesize
2.1MB

Download
memory/4052-868-0x00000000005C0000-0x00000000007DC000-memory.dmp

Filesize
2.1MB

Download