warzonerat | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

06-02-2025 23:37

250206-3mbcbsspfm 10

05-02-2025 13:44

250205-q1zwmaylfy 10

Analysis

max time kernel
895s
max time network
899s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
06-02-2025 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

warzonerat defense_evasion discovery infostealer macro macro_on_action rat rezer0

Malware Config

Extracted

Family

warzonerat

168.61.222.215:5400

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4472	352	runonce.exe	98

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/5576-50088-0x0000000005A60000-0x0000000005A88000-memory.dmp	rezer0

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/896-51374-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/896-51272-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
30	4644	msedge.exe

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x001a00000002aa91-266.dat	office_macro_on_action

Executes dropped EXE 3 IoCs

pid	Process
5576	WarzoneRAT.exe
7504	WarzoneRAT.exe
7932	WarzoneRAT.exe

Loads dropped DLL 1 IoCs

pid	Process
352	WINWORD.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
11	pastebin.com
12	raw.githubusercontent.com
30	raw.githubusercontent.com
69	pastebin.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5576 set thread context of 896	5576	WarzoneRAT.exe	108
PID 7504 set thread context of 6708	7504	WarzoneRAT.exe	114
PID 7932 set thread context of 6012	7932	WarzoneRAT.exe	118

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\_CutButterball	WINWORD.EXE
File opened for modification	C:\Windows\BreakTart	WINWORD.EXE
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\NetWire.doc:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NetWire (1).doc:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NetWire (2).doc:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NetWire (3).doc:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 48952.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:SmartScreen:$DATA	WarzoneRAT.exe
File created	C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:Zone.Identifier:$DATA	WarzoneRAT.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1616	schtasks.exe
6456	schtasks.exe
7104	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
352	WINWORD.EXE
352	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
432	msedge.exe
432	msedge.exe
3656	msedge.exe
3656	msedge.exe
4632	identity_helper.exe
4632	identity_helper.exe
2684	msedge.exe
2684	msedge.exe
460	msedge.exe
460	msedge.exe
3912	msedge.exe
3912	msedge.exe
2196	msedge.exe
2196	msedge.exe
940	msedge.exe
940	msedge.exe
5576	WarzoneRAT.exe
5576	WarzoneRAT.exe
5576	WarzoneRAT.exe
5576	WarzoneRAT.exe
7504	WarzoneRAT.exe
7504	WarzoneRAT.exe
7504	WarzoneRAT.exe
7504	WarzoneRAT.exe
7504	WarzoneRAT.exe
7504	WarzoneRAT.exe
7504	WarzoneRAT.exe
7504	WarzoneRAT.exe
7932	WarzoneRAT.exe
7932	WarzoneRAT.exe
7932	WarzoneRAT.exe
7932	WarzoneRAT.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5576	WarzoneRAT.exe
Token: SeDebugPrivilege	7504	WarzoneRAT.exe
Token: SeDebugPrivilege	7932	WarzoneRAT.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
352	WINWORD.EXE
352	WINWORD.EXE
352	WINWORD.EXE
352	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3112	432	msedge.exe	77
PID 432 wrote to memory of 3112	432	msedge.exe	77
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4524	432	msedge.exe	78
PID 432 wrote to memory of 4644	432	msedge.exe	79
PID 432 wrote to memory of 4644	432	msedge.exe	79
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80
PID 432 wrote to memory of 3004	432	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb74c23cb8,0x7ffb74c23cc8,0x7ffb74c23cd8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1152 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\NetWire (2).doc" /o ""
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:352
- - C:\Windows\SYSTEM32\runonce.exe
    runonce.exe
    3⤵
    - Process spawned unexpected child process
    PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:940
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5576
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp11F8.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6456
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:896
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7504
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp29A6.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7104
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:7644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6612
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6708
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7932
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3C34.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1616
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,5361118253929739317,6668016065813598572,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6520 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1144

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3996

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:7200

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:7248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:8436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WarzoneRAT.exe.log

Filesize
507B

MD5
a0c3e1aca0335d2d3a6c16038a5e1feb

SHA1
865132ecfd8bc3781419e10a57ef33686d80f83f

SHA256
68e52b0dae9281848730d457702a3fbe0868a0209d2740c9b5435dcf872d1072

SHA512
6b5dc7bb61bebea323e806e4eeaac8383621c84be7545af744923445dc4545b9395abcd8f7b82f8b30fddc28872e3f47a010a271f588b5dd725cdd1be2ee4ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dd795ade0c329665b4c712b5039fc922

SHA1
9ff5f43d6eceb01f035b39e663267e6e86557e73

SHA256
00bcfb8cf7897f4eb26422d6d637a4a9170596654f4b73e6ff43b97720cd4f61

SHA512
aee2c66682ac5bf6318cd68c4726e8a5a5650985d2a0e026d4d2d0dc2cf9c8899a6c9b3136b8ef18773ca853205bd3a7d7dea594fbfc72cf61f29c67e38d27df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
be85a012866f82533b134a3e7c03581c

SHA1
8f361377763dc0f643a3c2746149ca5850c5d8c0

SHA256
7c0534066657219aeecf9763515dbb8eeb5b0cc4509d25ed75d5347476f443a0

SHA512
38aa3dc3c36a5319162d52fb0bdb7588dfa9fada5247c49ee53d870b7d928ea5be1387e176e8caf3dd6cad9b6975d432eae587c0103f8dffc56f17ef887ae621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
281d0b16693c19e54229a12afd023824

SHA1
10295cc58d90d70f5d6a43d4d0a43dc6be025a83

SHA256
d8bfff991f14843a4b0776c6ffbf2acc60b298fb0f482ab06e4573a480b5d96f

SHA512
207e3d9c764940b9da9adb61f0a663a9abc6eacd9908c1061a11bd3b092341dc1d18062d793fbc991d44abe516707fb5a6730d6cd7c34d2653e59aef86029258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0c9b4edcece243a96e48c4999a8330dd

SHA1
9f388982a4a889674d6dd85edfd5319209a5d49a

SHA256
de2d99fd3b4c255206c99e24ba463a30fc3fb6970531b629037a0367cc08e7b1

SHA512
81bc6ac1fdc4edd1ea3f27cf13f479d5be846b6d37ae2c6bb00a00d923621c44d70abf4496d55be0fdfd363f472525b54abceed12424d31f657c0d2666c37640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad56fd65bf9b5024567de9da74c81783

SHA1
d3802f37e97e4f6a217e37f0bf6f8a7ff1079954

SHA256
cbc2e532bc81b8517df430017c3861438b4b027325f9269a19bac9f44b7ccba9

SHA512
4a9937aba607e5017a5465c64f6ea82dbfca0b0c33afd733bd0b975a280651a1eafebbc32eacd18fb74925a37464b7e4a2c76dde9b34e1902b25cf5b881a51a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cee9aee85d928634a7865ea12b2c4893

SHA1
b7208558b8213dc2b0ebb6107622cf10b2bba014

SHA256
7eaab987797809dad4106313ca5f116da07d675a93b70f64fe7670043350ef4b

SHA512
646749a39e14abdcaa4c3d31f7fabd712c0ede67b06a304c2430a57a37ca46a6ea0417868e1f0b1f014995ddc4158b5f97a9cf7a5f99c2cc67d30b8a3905fa0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6da259ebaff364c47505955b2e33dec8

SHA1
9496779e9e21c4eb66f564818b32f77662f74f11

SHA256
0379b3e2930fb1c371ddc8cac1139d16402f8d111a8d4f59ca8bb03613252354

SHA512
186bf8c5063544069effcbf9b99cdf16c375277df2e25e8dc6afab264983dbdfb0e1b98a916c34f241477fe35085c384239d214de1d5af2c20496c06e83ecacf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d7e0ac259e1d1413542fe954ab7e3e72

SHA1
c303bc895038a7c319757725c714517889985281

SHA256
d812f98b9b2cffc43bbc63eb4597aa39d47ea9a33a5f1d9fa910326348a416e4

SHA512
ff0ee35ff3297dca40dd7b42e64880ab9be8d63219b0e2d3fa3ea2f52edd9c7a23a746fb138e7280fb83879865d74e3376f539bdda6c29f6cc1356ec53fd947c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cc920a3e8e3d710ad0de00a784490565

SHA1
67fe55765defae036731fa87ab103b37163d139a

SHA256
624fcd0d4a5b7ca72851106fe9ae444a4c111d1edc423c7c9f8dcd3ebfa83913

SHA512
f5c4ce510f7a3c489340eba904fbed198dd4554719eef54e256bb3cfe0df29529bdb2777a91cd269b57bc400bba99c232f3d433bfe8b942221c4daacf2f42f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
b033c072fb3efe7e9509e0791c9c4d16

SHA1
5581a57fe89fdb45afd5477d85ebb0af22f9b508

SHA256
f682ce94db6a02c3239da3d3c626634ab64f80641c9558eeca3276bfba9729c1

SHA512
d6486d6bed6d143a8c5a05af334f4047d1a845edbe0cd6fe6475074f1c6b21eb048b91bde17b9ce6fbf5b32290ff732a274ec5b342a3516c6bd54034321f30f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dc7943af2da422b6e8ae4be9637c628d

SHA1
b21d53668097e99b2443538f3c7c9217dd81497b

SHA256
fc05ff0450f06bfe024c52c85a643ad0c31c9f63551a96c4c70a092995339b50

SHA512
cc23ee273233522a97f92012fdcbd5a654592f1b829e628ea59cb00bdb36bd522642599b462c8b092c7d113580b11b3ff732f9c68f6ccc412f22e95b42d87f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ce9a.TMP

Filesize
874B

MD5
c2f91b5585dbfe1b070b2de058d00a14

SHA1
bf1059cad5fcf8604a3793e54ff8ca619b4f2d5b

SHA256
58b1a03e1210df517e34581bdfe368b628bac5e5d123c7464d1892daadfa5a97

SHA512
5b756881ab3854338949fa98ebe79ac31125681e308f400d511b0e07da7c95bfcdc38d9eb7d9d8501270349cc3120555ecc233a81578ac00671e5f40c4331530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\3d7a9c77-946c-4a46-893c-7b74871508ef\3

Filesize
2.3MB

MD5
e272dcc7a1abf47e7b3295438edead86

SHA1
4baa51fcd81fc490a703a0b708aa629ded22e8a8

SHA256
2eaa2805123cfbce4bc3480000446dd718d9ec505e0d8a53befbf2d4a1853ca3

SHA512
f9bdb629e0dffdb25f425ed06c89103d15680a6c8bcb5ed6136b3c93b43a561d8d0f0459bbce54cbd2db3b15514fdb90fa5d5f0b0fb423984e731360a6381f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9c092ef3a0c62b480588d6886a3c428

SHA1
3f0302365a04d8f19a27177fcb8eb6a16e268f82

SHA256
4e71815b2be93af141f282c86b678c78f36bd37951425f1b455049472c52f70a

SHA512
b4e94c0fbefb886ef971171fbc21ced17fa1c31760412e0c1d16fe535f33bf0b92e9423c1c9e086a2b3ffe5fd75473154646c884fe01cea3078839f623636526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
987d36f86f682f87328f3741ef16a696

SHA1
3caec87bd46ecaa483ac308fdfe4d4f0bbd3e1d8

SHA256
c98888fd7de6c9ed7ea244eff0fe15f82204065147755eb9a42358231eb3807e

SHA512
a909ed9f14c531f3ec7d28e7dbfd516c96a4365c15783df94ecf3e7b7bce99b1cfa63faeb4e3932dbd3f28c2df6e03e03f27c3afef22ede6ac3e9d82f2a70c11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f5e9ed7589702ac0b3175fa82bd4144b

SHA1
39b8844037ed45cacbfd7ca45b2244e6b2f31aec

SHA256
5a8efe0b39948b5dd763139594303aee069e85960aab37d9d27cc223ca915188

SHA512
29394ffa73bbcd6d80d71343cd32d3808c803968b213c139a4097de5e5a4050daf3e439ce77c16f19d95df539e16c8adf65c930b486ef84ecb86c4022c1de82e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a2eff8724215704d3c10d22c4821ada8

SHA1
62403eaa3aaffebf113a9fd9b23f08bd5a5d093a

SHA256
e9d0bd2b53c7bde9ba86e70fe72669934f25ccba9150657ec636f16a0bbaf038

SHA512
c4f60f776459890317b0dcfb2a556391b4ae620add26d4a986a6f4f11786c7e9790c6e6ce6cec193365aa034acb0762531f226aabc666347d0787a55585d7e67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
112f5bd1c28459ff3f933be83e96c16e

SHA1
e95a90fa508a948c3baf3eb56d590077a9e453e6

SHA256
65bbe478882fddc61b3451617a7f1ec7e53b9d726dd714e13e9fdb8f6f5fe77b

SHA512
b540eca08284cc6594a6d70d7a977212c906c7c322937658cd121f588ccd84843c4dfbafb1ffe47c4a7e186cd0ceee23bbc676e24a597f63d9c7526ef961530a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ands.dll

Filesize
30KB

MD5
d4a7e2883571bd5aadc8c42e7dde6288

SHA1
90d06ccbcfa36ed581a9a9af5f3581dc36387746

SHA256
787b25dc26dc474d9a6a8afe13c20ec3db2d204b390c399029c92da3dbbbdd40

SHA512
a204f3be5a0a95c3b6126473b6079965386c4a66d59bc0bbb40772141b65775d7db60b01caced38796c66d2bf7a6d23e8dd4970d7a9a5d40901ac19477d25714

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp11F8.tmp

Filesize
1KB

MD5
3bdb8de114711312f2bea563254b5752

SHA1
5e64a098ec77571ab248d99e8277a8732cec8a62

SHA256
5760a872aaf73fa12ff8de464b5d600b5ea7d517118f0aa5534e1d8d993d1634

SHA512
0c5f5cfc286a8146189a2d666e97da48371cccb69e2e16141a65ada0625fd710b8c8c2aff438d37e0b98058d3a88038187214a7a57084fe0667cc6cc5d3307e0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
360B

MD5
b21c58ec398e8d7d5e75799087a377e9

SHA1
e50e41e2089283467f45343ae94be9889fd62d00

SHA256
d2fea37ddf6b2aeaa06da19445ace91dde1fb0719cc070fad0538525b51399fc

SHA512
9877dd14b05761619ce0e2d69367e9b77b5f9ab621ff923cd362ccce0d9dbcb4f0019879799b5015f149e89b47fe6d087f555ebf8fee622e8b9c6e473379c769

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
49fa8037be32abb022c8f6af1439840e

SHA1
188a566bcc79de628c57cb5032c5b8fe9ebb50a8

SHA256
c9ec72709e69e9bd5dc89b3c2ec997de8f98dfbd8b7141fdd1c58349b982bd7f

SHA512
92026e10555d58d9389cdd8d7c7dfc054f9d82fa5a6117bdd90f71f100b6b6a40f875ad55900b143d06f8a8dd7f2006c93463efd3bec1919c75e5d2fc06ab03e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
a20592d45d22cc8546c7c84008c567a3

SHA1
f54caa6c78edf55df8a60f7d8b4870bcc3a7618d

SHA256
a82ca82d752f154c87fe4c4848d9e8d192660fa5d178acdb1b53c887a4e65096

SHA512
779c0f44824ad8467bbb168d0d014e74c3a13b28f3a0b0a07ac906db4375b42c24f3de47a52dfe82c7afea183df72ef4e07cf500bf3cc88082c92ed47a679834

Download Submit
C:\Users\Admin\Downloads\8722c1c5-2c24-4aca-98b6-14d9d1fc5f34.tmp

Filesize
7.3MB

MD5
6b23cce75ff84aaa6216e90b6ce6a5f3

SHA1
e6cc0ef23044de9b1f96b67699c55232aea67f7d

SHA256
9105005851fbf7a7d757109cf697237c0766e6948c7d88089ac6cf25fe1e9b15

SHA512
4d0705644ade8e8a215cc3190717850d88f4d532ac875e504cb59b7e5c6dd3ffae69ea946e2208e2286e2f7168709850b7b6e3b6d0572de40cfe442d96bba125

Download Submit
C:\Users\Admin\Downloads\NetWire.doc:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 48952.crdownload

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Windows\BreakTart

Filesize
47B

MD5
081c6d16a42da543e053d56b41e011a4

SHA1
7c3b4b079e17988aef2deb73150dda9f8b393fdc

SHA256
7a4a7fc464c0e33f4959bbfad178f2437be9759ec80078a1b5b2f44656830396

SHA512
5a65a2b81c0d001be174a100363adae86bdc9af02360fbd2c87ebdb45d62833104e4cca90473f1156792473af5922e947677585c55052a99868e6a395aa457ff

Download Submit
C:\Windows\_CutButterball

Filesize
64KB

MD5
6b10ccc28034b21cf63d7b7579b94e6e

SHA1
814e0a2e9dbca239e29e324b70b5c15dd0c97d39

SHA256
850de9d945d7803a41599977a1d76415e19d2c4ffb61157da2728ea9436ba918

SHA512
8932bbfa50c78212eb4108ea3156aa6ba0f7c496b00c2ecb75f9dda3f0c68ee9156b553d5aaff0560eeb51e7406f8609b57c04ef131a01be3030c2d5cd282402

Download Submit
C:\Windows\_CutButterball

Filesize
210KB

MD5
4949235e71e8074176f7d119aca49a0e

SHA1
0d4d4597ff0c1d6a0c62eef24e3a1b2e0c842741

SHA256
19fcaad54b2bfefa85700eb0c4e58c0bb3b0b7713ad6299400646fef39c09c4d

SHA512
512c55826039d6f8d6a71c1ce6ecc35f49111f74de78010fd60a3acf1ec4610947456a1a1893ce31e5dcb874991240c8995ac824c291739eb3994b7c2c32661e

Download Submit
C:\Windows\_CutButterball

Filesize
128KB

MD5
dcad0eb1d58b934897e6830e5c309f42

SHA1
0c14be3dc47cf46f5c5409766989ecfebfb66d9f

SHA256
74e578c93ac9c351fc98ec5438bad1d5b4d5b6daec5d565d1bab91bb389fc629

SHA512
4c7e0aaa2c0b5a93dce933320d7b560b5d9fb5dc132f346434f095738517ac3b340a039bb5b5f93def8bc4bca5feebbf4246a4304a13728fd07b01c42c2cd5df

Download Submit
C:\Windows\_CutButterball

Filesize
250KB

MD5
6e74f4dca1d5d0b1a9cd3216d90afbad

SHA1
ba59e2a4724c00b503b29e4f8eb207127a7d3712

SHA256
9d415a5ba707ee5eb6a6a1ecf3d9fdc3aa526ec7fbfb508573e640363c2b92ee

SHA512
806f49d2d4af92ae43d8ad827209852595e100dee79317c01623d293b308f333d660dd0a992ccb4599df0cb6c418bd3a0a5a9f9dec91cd182d73b11c3a64c016

Download Submit
C:\Windows\_CutButterball

Filesize
256KB

MD5
239083bf3e5928b50e948a9ac9fa83d1

SHA1
7b27d3882817ef6f72da14eb4537c7a09cf10ad6

SHA256
7c6264130231218067434fd1b01332b8479dd41fcd229164ba1d4bd3eb095cdc

SHA512
040a034aa946391dc6674bc7356a7b37fd49c627a021dd0962c9ddfb8eee437a0f4854f9bc282c71a2bbfdb47f5fb929373d668e7ebf7b98f1eec80b2783f7f7

Download Submit
C:\Windows\_CutButterball

Filesize
64KB

MD5
8a5cae234f9a0b08e558f3704f859305

SHA1
88fbd5947523e839da42fab1ef6c45462c80348a

SHA256
d963e63df60fd51e6c7a7e4fc89622ac79ac0425d55d69615cebc833875aee57

SHA512
c7b2e737cbea03af37f715909001b3d0b6d48eca6f584ea48433a54a4b559a7533355aaf9e31acc66b2064552c338a815042c329d6d0570ed57c2fff5c1bb39d

Download Submit
C:\Windows\_CutButterball

Filesize
64KB

MD5
39060dd69259340078f9d33a584657a4

SHA1
19271ab3a3ad124eff02a0faa59fbf47a227d0ea

SHA256
6d82893bfa41481112bdad8ea033156ccc82b2334d0348a8a335f10219688f6b

SHA512
bdbd254f8f63d909508aa6ab8dd20384495c59ed3482931de8e52c1b129ef683ed18bca044867bc22cd7c9a3066e7d9d61be81b2b5d5e79bd100fd3d70c57087

Download Submit
C:\Windows\_CutButterball

Filesize
64KB

MD5
0340e5e9502ab49c1913b38bd890a4ed

SHA1
3df541db0a57b8ba558c01fce80ca01888967f9b

SHA256
7cae91c24f92bd110f8666791ecedf459eeb8b1aad305b319ce52478ac9c1054

SHA512
bcbd3405c7b389f8b2542c00b88cfffa9e5f5063cde03bb2d41ec93301dc743ce4fb1adec3d097e99de19250ed21b381c855c49c7892522fe2024434a857a14b

Download Submit
C:\Windows\_CutButterball

Filesize
256KB

MD5
15d60e360fe57e1c5934d285a8d4462e

SHA1
7c745292ad1db40bbb3522577cebe7f1d6e249cd

SHA256
ca38caf0fb34e836a72da056b18b3a0b375d11bc389ddb183ef4d6d2251f9f0a

SHA512
480aa8f6b670ad8581d0b02bc495a620f298ffc1f28123b393f159fb3da7b89d9c67408b05fd1b156d5e750ffad4bf47e242589410b915ad1c8ea3fc91297ab1

Download Submit
C:\Windows\_CutButterball

Filesize
320KB

MD5
4338a6aef9a3cd0e0d956276b387d12c

SHA1
ddfda88593c37e8e475dbb7a24bd3b0bfcb727fa

SHA256
661884e582da4a724280ea0444ab00c6c74357e1b524f85e864c2f04011a61fd

SHA512
6d400794381bd34c4917a3d5741318f49cab3dc759191495a9d02acc3c7dc63cca38a4e33eb7deaa312c02a8a4359130694fcdec4dbd8d214c20ffb4b9e95d7b

Download Submit
C:\Windows\_CutButterball

Filesize
378KB

MD5
ba8a92cf1095886fa8fc9f0f0ea51919

SHA1
c3f554a422cf30f8fdaa8ec650aac2c90afcbf3d

SHA256
3a9280db620969a1668ca7272380e831b15ac9c877d6fe4430cf30eb5a94b2b0

SHA512
3880fd722f76842e9c88321cb68fe1f9dc4daf3eee1675e31dd9e60fcc5de3ace131e08047162399d307ec6f19e24c1a7f4dd43f14cf3e6e0a35665470f5330e

Download Submit
C:\Windows\_CutButterball

Filesize
64KB

MD5
b804d8b0cae9c8b42fbb00151cceb6ac

SHA1
7bf5d07e9e8bc858a71b49f46d45cf638d41f623

SHA256
b53bc204bf6feeb891cbd81f191ae37e620b569f65771aaf1ee3e7907dfe0d3e

SHA512
e58ea790df2c8d5e96917d8199d19878ef580c02894711ce9e16e13fbc76b95b6099ed672e44be3b539c49850538217998c826a0cc598c21cfe4587dfbc8e073

Download Submit
C:\Windows\_CutButterball

Filesize
64KB

MD5
73bd0be55397388203936db5b180f96e

SHA1
defa8a88458649a64d962dcd7d65f53b7d844d5e

SHA256
6eee3da306cd3248cc1f1da60f9cdc1a52638b43768daffc5e0772363efe4060

SHA512
c384b53990130fedf97f2ad9e0bbeb8855d7e46d7a14ca554042b255f8baf594581838ca48f4feebee2b60cdd4ac9d3059cd0be2aa788cd6ff1c2227d0e2c84e

Download Submit
C:\Windows\_CutButterball

Filesize
49KB

MD5
f1a7ed04c70fb367b09eecacf9229144

SHA1
2c855ae94b8f9b09a7370e0c6057473103fb8462

SHA256
c3a6f0fa2014a7e9e0b6c5b4108c35cff4e329da58908cddb3037fbca2998b58

SHA512
92a5154c52d9b2f7d2ced2daa8b4c80e2120e6a27e21fd7b064af29f98837f615099b079611049956a1ed003dc2ec851a397ecf49f6cb80c78d9b1180eaa1bd3

Download Submit
C:\Windows\_CutButterball

Filesize
86KB

MD5
de722feed2d62affd1e2a94940dfeeef

SHA1
cd944259a7475b2f9d0fef47b11ad671435b70b8

SHA256
3286bc7ee1c8a4a93af6ef007836e99999ae5ed0d489eba7987d4fb730abf4d3

SHA512
721c4279a976824341acf0880d383cdc0dcf1470f3274e909f31d46ad17d5299c21d8fff850e508b03f54ce823240b9647809cac681bae1d14c4a2017d675ac0

Download Submit
C:\Windows\_CutButterball

Filesize
4KB

MD5
282a5f1f20884b9f6b93f657e2b423f7

SHA1
f43dfe2eb353dba52225b9869ddd17ce6824820e

SHA256
c28b0f301d9e89d8e3fd092464a2bf063a85d20485227266f2601a4ff07b5fa9

SHA512
bb29e175b261f660c564ea0907ddb926c5cc63d6fa5acc95902740045bf1c9613a7e4f5bbc81107f74b661e320010bd3d03718e1003856cb68ed34fe4d61980e

Download Submit
C:\Windows\_CutButterball

Filesize
128KB

MD5
5e2194cf18370192a259d6eff97e1d03

SHA1
b406c97632501d31e7ea8ace52723f1ef977eea0

SHA256
f2cd098648d74cd8d37e2fa46b4867efd51c38eb18b8708a0881fe7df5254cfd

SHA512
84383fce6c96b9b70daef338f360aea94ef07225a7e3460781ac0c6d8541ebbdbdd0012178ac7f11434ab86172ff4af45a7b0cfb008dd1c4f5adb45d9c8d74cd

Download Submit
memory/352-311-0x00007FFB43A10000-0x00007FFB43A20000-memory.dmp

Filesize
64KB

Download
memory/352-473595-0x00007FFB43A10000-0x00007FFB43A20000-memory.dmp

Filesize
64KB

Download
memory/352-312-0x00007FFB43A10000-0x00007FFB43A20000-memory.dmp

Filesize
64KB

Download
memory/352-309-0x00007FFB43A10000-0x00007FFB43A20000-memory.dmp

Filesize
64KB

Download
memory/352-314-0x00007FFB41170000-0x00007FFB41180000-memory.dmp

Filesize
64KB

Download
memory/352-473592-0x00007FFB43A10000-0x00007FFB43A20000-memory.dmp

Filesize
64KB

Download
memory/352-308-0x00007FFB43A10000-0x00007FFB43A20000-memory.dmp

Filesize
64KB

Download
memory/352-473593-0x00007FFB43A10000-0x00007FFB43A20000-memory.dmp

Filesize
64KB

Download
memory/352-473594-0x00007FFB43A10000-0x00007FFB43A20000-memory.dmp

Filesize
64KB

Download
memory/352-310-0x00007FFB43A10000-0x00007FFB43A20000-memory.dmp

Filesize
64KB

Download
memory/352-313-0x00007FFB41170000-0x00007FFB41180000-memory.dmp

Filesize
64KB

Download
memory/896-51374-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/896-51272-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/4472-471012-0x000001E893830000-0x000001E893831000-memory.dmp

Filesize
4KB

Download
memory/5576-50028-0x0000000005380000-0x0000000005388000-memory.dmp

Filesize
32KB

Download
memory/5576-49452-0x0000000000950000-0x00000000009A6000-memory.dmp

Filesize
344KB

Download
memory/5576-49828-0x0000000005CA0000-0x0000000006246000-memory.dmp

Filesize
5.6MB

Download
memory/5576-49885-0x00000000056F0000-0x0000000005782000-memory.dmp

Filesize
584KB

Download
memory/5576-50088-0x0000000005A60000-0x0000000005A88000-memory.dmp

Filesize
160KB

Download
memory/5576-50087-0x0000000005B00000-0x0000000005B9C000-memory.dmp

Filesize
624KB

Download