dcrat | hxxps://download[.]oxy[.]cloud/d/bchi/2/858f276bb0052113f612791ea5f59928

Analysis

max time kernel
71s
max time network
75s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
16/03/2025, 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download.oxy.cloud/d/bchi/2/858f276bb0052113f612791ea5f59928

Score

10^/10

dcrat gurcu phemedrone umbral credential_access defense_evasion discovery infostealer persistence rat spyware stealer

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot7940307483:AAEmmDBRKx8kRMTrlD986B7qCulYd2jfQHw/sendDocument

Extracted

Family

gurcu

https://api.telegram.org/bot7940307483:AAEmmDBRKx8kRMTrlD986B7qCulYd2jfQHw/sendDocumen

Signatures

DcRat 51 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		5432	schtasks.exe
		1580	schtasks.exe
		1344	schtasks.exe
		5616	schtasks.exe
		1744	schtasks.exe
		4508	schtasks.exe
		4476	schtasks.exe
		4604	schtasks.exe
		3348	schtasks.exe
		4496	schtasks.exe
		5204	schtasks.exe
		3876	schtasks.exe
		5820	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Nvidia = "C:\\Program Files\\WinRAR\\RarExtPackage.exe"		Nonagon.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS		msedge.exe
		2788	schtasks.exe
		3164	schtasks.exe
		2460	schtasks.exe
		3840	schtasks.exe
		1756	schtasks.exe
		6048	schtasks.exe
		5700	schtasks.exe
		4468	schtasks.exe
		5768	schtasks.exe
		2932	schtasks.exe
		5200	schtasks.exe
		2124	schtasks.exe
		4264	schtasks.exe
		1648	schtasks.exe
		460	schtasks.exe
		4620	schtasks.exe
		2444	schtasks.exe
		1140	schtasks.exe
		5592	schtasks.exe
		960	schtasks.exe
		1520	schtasks.exe
		2808	schtasks.exe
		2828	schtasks.exe
		4696	schtasks.exe
		936	schtasks.exe
		3884	schtasks.exe
		3192	schtasks.exe
		2548	schtasks.exe
		1936	schtasks.exe
		1660	schtasks.exe
		400	schtasks.exe
File created	C:\Windows\debug\PXm40rAQJNL1dLLc2xrFc0EDNV.bat		RarExtPackage.exe
		4684	schtasks.exe
		3064	schtasks.exe
		5496	schtasks.exe
		472	schtasks.exe

Dcrat family
dcrat

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000002b288-601.dat	family_umbral
behavioral1/memory/5204-618-0x00000213C85C0000-0x00000213C8600000-memory.dmp	family_umbral

Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
stealer gurcu
Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6048	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5700	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5432	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	460	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5592	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5496	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5768	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5616	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5204	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5200	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5820	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	6028	schtasks.exe	147
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	6028	schtasks.exe	147

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x001c00000002b280-583.dat	dcrat
behavioral1/memory/4988-895-0x00000000001A0000-0x0000000000292000-memory.dmp	dcrat
behavioral1/files/0x001c00000002b07a-901.dat	dcrat

Uses browser remote debugging 2 TTPs 1 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1892	chrome.exe

Executes dropped EXE 7 IoCs

pid	Process
712	Nonagon.exe
4508	RarExtPackage.exe
5204	wtf1.exe
2220	wtf.exe
2776	cs2.exe
476	Nonagon.exe
4988	DebugTracker.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
292	ip-api.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Nvidia = "C:\\Program Files\\WinRAR\\RarExtPackage.exe"	Nonagon.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Java\msedge.exe	DebugTracker.exe
File created	C:\Program Files\Java\61a52ddc9dd915	DebugTracker.exe
File created	C:\Program Files\WinRAR\dwm.exe	DebugTracker.exe
File created	C:\Program Files\WinRAR\6cb0b6c459d5d3	DebugTracker.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\DebugTracker.exe	DebugTracker.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\baf0f489ef151f	DebugTracker.exe
File created	C:\Program Files\WinRAR\RarExtPackage.exe	Nonagon.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\debug\DebugTracker.exe	RarExtPackage.exe
File created	C:\Windows\debug\wtf1.exe	RarExtPackage.exe
File opened for modification	C:\Windows\debug\wtf.exe	RarExtPackage.exe
File created	C:\Windows\debug\cs2.exe	RarExtPackage.exe
File created	C:\Windows\appcompat\DebugTracker.exe	DebugTracker.exe
File created	C:\Windows\debug\__tmp_rar_sfx_access_check_240670359	RarExtPackage.exe
File opened for modification	C:\Windows\debug\PXm40rAQJNL1dLLc2xrFc0EDNV.bat	RarExtPackage.exe
File created	C:\Windows\debug\VUQLBafFd1oU7p3k.vbe	RarExtPackage.exe
File opened for modification	C:\Windows\debug\VUQLBafFd1oU7p3k.vbe	RarExtPackage.exe
File opened for modification	C:\Windows\debug\cs2.exe	RarExtPackage.exe
File created	C:\Windows\appcompat\OfficeClickToRun.exe	DebugTracker.exe
File created	C:\Windows\debug\PXm40rAQJNL1dLLc2xrFc0EDNV.bat	RarExtPackage.exe
File created	C:\Windows\debug\DebugTracker.exe	RarExtPackage.exe
File opened for modification	C:\Windows\debug\wtf1.exe	RarExtPackage.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\debug\wtf.exe	RarExtPackage.exe
File created	C:\Windows\appcompat\baf0f489ef151f	DebugTracker.exe
File created	C:\Windows\appcompat\e6c9b481da804f	DebugTracker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Nonagon.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RarExtPackage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133866234965038243"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings	DebugTracker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2873637269-1458872900-2373203793-1000\{5F3F6B8C-996C-4940-9494-F68226539565}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings	RarExtPackage.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Nonagon.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1520	schtasks.exe
2828	schtasks.exe
5204	schtasks.exe
4508	schtasks.exe
4476	schtasks.exe
6048	schtasks.exe
460	schtasks.exe
2548	schtasks.exe
2460	schtasks.exe
1744	schtasks.exe
1756	schtasks.exe
3164	schtasks.exe
4696	schtasks.exe
2808	schtasks.exe
5616	schtasks.exe
4496	schtasks.exe
3064	schtasks.exe
1140	schtasks.exe
5200	schtasks.exe
4264	schtasks.exe
4620	schtasks.exe
2444	schtasks.exe
3884	schtasks.exe
5496	schtasks.exe
5768	schtasks.exe
1344	schtasks.exe
936	schtasks.exe
1580	schtasks.exe
1936	schtasks.exe
3348	schtasks.exe
3840	schtasks.exe
4604	schtasks.exe
3876	schtasks.exe
2124	schtasks.exe
2788	schtasks.exe
1648	schtasks.exe
5592	schtasks.exe
4468	schtasks.exe
960	schtasks.exe
1660	schtasks.exe
5820	schtasks.exe
472	schtasks.exe
4684	schtasks.exe
400	schtasks.exe
2932	schtasks.exe
5700	schtasks.exe
5432	schtasks.exe
3192	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2220	wtf.exe
2220	wtf.exe
2220	wtf.exe
2220	wtf.exe
2220	wtf.exe
2220	wtf.exe
2220	wtf.exe
2220	wtf.exe
2220	wtf.exe
2220	wtf.exe
2220	wtf.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe
2776	cs2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs

pid	Process
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	wtf.exe
Token: SeDebugPrivilege	5204	wtf1.exe
Token: SeIncreaseQuotaPrivilege	3396	wmic.exe
Token: SeSecurityPrivilege	3396	wmic.exe
Token: SeTakeOwnershipPrivilege	3396	wmic.exe
Token: SeLoadDriverPrivilege	3396	wmic.exe
Token: SeSystemProfilePrivilege	3396	wmic.exe
Token: SeSystemtimePrivilege	3396	wmic.exe
Token: SeProfSingleProcessPrivilege	3396	wmic.exe
Token: SeIncBasePriorityPrivilege	3396	wmic.exe
Token: SeCreatePagefilePrivilege	3396	wmic.exe
Token: SeBackupPrivilege	3396	wmic.exe
Token: SeRestorePrivilege	3396	wmic.exe
Token: SeShutdownPrivilege	3396	wmic.exe
Token: SeDebugPrivilege	3396	wmic.exe
Token: SeSystemEnvironmentPrivilege	3396	wmic.exe
Token: SeRemoteShutdownPrivilege	3396	wmic.exe
Token: SeUndockPrivilege	3396	wmic.exe
Token: SeManageVolumePrivilege	3396	wmic.exe
Token: 33	3396	wmic.exe
Token: 34	3396	wmic.exe
Token: 35	3396	wmic.exe
Token: 36	3396	wmic.exe
Token: SeIncreaseQuotaPrivilege	3396	wmic.exe
Token: SeSecurityPrivilege	3396	wmic.exe
Token: SeTakeOwnershipPrivilege	3396	wmic.exe
Token: SeLoadDriverPrivilege	3396	wmic.exe
Token: SeSystemProfilePrivilege	3396	wmic.exe
Token: SeSystemtimePrivilege	3396	wmic.exe
Token: SeProfSingleProcessPrivilege	3396	wmic.exe
Token: SeIncBasePriorityPrivilege	3396	wmic.exe
Token: SeCreatePagefilePrivilege	3396	wmic.exe
Token: SeBackupPrivilege	3396	wmic.exe
Token: SeRestorePrivilege	3396	wmic.exe
Token: SeShutdownPrivilege	3396	wmic.exe
Token: SeDebugPrivilege	3396	wmic.exe
Token: SeSystemEnvironmentPrivilege	3396	wmic.exe
Token: SeRemoteShutdownPrivilege	3396	wmic.exe
Token: SeUndockPrivilege	3396	wmic.exe
Token: SeManageVolumePrivilege	3396	wmic.exe
Token: 33	3396	wmic.exe
Token: 34	3396	wmic.exe
Token: 35	3396	wmic.exe
Token: 36	3396	wmic.exe
Token: SeDebugPrivilege	2776	cs2.exe
Token: SeDebugPrivilege	4988	DebugTracker.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3576	MiniSearchHost.exe
712	Nonagon.exe
4508	RarExtPackage.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5188 wrote to memory of 4192	5188	msedge.exe	78
PID 5188 wrote to memory of 4192	5188	msedge.exe	78
PID 5188 wrote to memory of 3088	5188	msedge.exe	79
PID 5188 wrote to memory of 3088	5188	msedge.exe	79
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 3728	5188	msedge.exe	80
PID 5188 wrote to memory of 5756	5188	msedge.exe	81
PID 5188 wrote to memory of 5756	5188	msedge.exe	81
PID 5188 wrote to memory of 5756	5188	msedge.exe	81
PID 5188 wrote to memory of 5756	5188	msedge.exe	81
PID 5188 wrote to memory of 5756	5188	msedge.exe	81
PID 5188 wrote to memory of 5756	5188	msedge.exe	81
PID 5188 wrote to memory of 5756	5188	msedge.exe	81
PID 5188 wrote to memory of 5756	5188	msedge.exe	81
PID 5188 wrote to memory of 5756	5188	msedge.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://download.oxy.cloud/d/bchi/2/858f276bb0052113f612791ea5f59928
1⤵
- DcRat
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x298,0x7ffe8d3bf208,0x7ffe8d3bf214,0x7ffe8d3bf220
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1752,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2192,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1952,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:13
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3492,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4228,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4900,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5252,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5392,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3532,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5600,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5112,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5728,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6644,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6772,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6780,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6780,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6988,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7012,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6852,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6296,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=6816,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=4888,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7692,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=7732,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=8032,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=8188,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=8332,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=8184,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=8388,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8640 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=6932,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=5568,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=3652,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=8100,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8268 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=8292,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=8020,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=5356,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=6688,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=5256,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=5024,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=6692,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=6804,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=5156,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=6328,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7484,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5196,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8736,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=8772 /prefetch:14
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8776,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=8768,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6448,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6468,i,17907919549214237034,9971175377717719828,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5080

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5796

C:\Users\Admin\Downloads\Nonagon.exe
"C:\Users\Admin\Downloads\Nonagon.exe"
1⤵
- DcRat
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:712
- C:\Program Files\WinRAR\RarExtPackage.exe
  "C:\Program Files\WinRAR\RarExtPackage.exe"
  2⤵
  - DcRat
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4508
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\debug\VUQLBafFd1oU7p3k.vbe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\debug\PXm40rAQJNL1dLLc2xrFc0EDNV.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5140
    - - C:\Windows\debug\DebugTracker.exe
        
        "C:\Windows\debug\DebugTracker.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e61VijIGvC.bat"
        6⤵
        
        PID:2224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:6012
- - C:\Windows\debug\wtf1.exe
    "C:\Windows\debug\wtf1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5204
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3396
- - C:\Windows\debug\wtf.exe
    "C:\Windows\debug\wtf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- - C:\Windows\debug\cs2.exe
    "C:\Windows\debug\cs2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      PID:1892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe6495dcf8,0x7ffe6495dd04,0x7ffe6495dd10
        5⤵
        
        PID:4104
- C:\Users\Admin\AppData\Local\Temp\Nonagon.exe
  C:\Users\Admin\AppData\Local\Temp\Nonagon.exe
  2⤵
  - Executes dropped EXE
  PID:476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\263b40168142b81c1a017e29648f15\msedge.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\263b40168142b81c1a017e29648f15\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 14 /tr "'C:\263b40168142b81c1a017e29648f15\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\263b40168142b81c1a017e29648f15\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\263b40168142b81c1a017e29648f15\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\263b40168142b81c1a017e29648f15\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DebugTrackerD" /sc MINUTE /mo 5 /tr "'C:\Windows\appcompat\DebugTracker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DebugTracker" /sc ONLOGON /tr "'C:\Windows\appcompat\DebugTracker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DebugTrackerD" /sc MINUTE /mo 11 /tr "'C:\Windows\appcompat\DebugTracker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\msedge.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\Default User\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DebugTrackerD" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\My Documents\DebugTracker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DebugTracker" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\DebugTracker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DebugTrackerD" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\My Documents\DebugTracker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Cookies\msedge.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Cookies\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\msedge.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files\Java\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\45b378cfa389121d62932bc9d4e6\msedge.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\45b378cfa389121d62932bc9d4e6\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\45b378cfa389121d62932bc9d4e6\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\WinRAR\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\WinRAR\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\WinRAR\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Windows\appcompat\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\appcompat\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Windows\appcompat\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DebugTrackerD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\DebugTracker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DebugTracker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\DebugTracker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DebugTrackerD" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\DebugTracker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\263b40168142b81c1a017e29648f15\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\263b40168142b81c1a017e29648f15\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\263b40168142b81c1a017e29648f15\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\263b40168142b81c1a017e29648f15\cmd.exe

Filesize
942KB

MD5
22cbb5402a44f058c9176e04aa74b5f6

SHA1
10838c4611974ba2a5382442677dcf679840ecdd

SHA256
5d1930426e5e41548bcc214c4298c96028ea71d2a83f755e50fa5756c35a615a

SHA512
10d0693f4c6ff9cbcdf5b4ec8b0c690f11d9463c834c94fc7659bf9a89edae9c0b951e55f5909344caf4cccc1ea8d7635b58126cb3667847a290b4f0ac49f0a0

Download Submit
C:\Program Files\WinRAR\RarExtPackage.exe

Filesize
1.5MB

MD5
84d934c68349e798f58a35df1f2f90c2

SHA1
be0974e4699ff06f52f0d5d380bc9cb8f0c50e19

SHA256
3b7218b64c14fc5125a93b4f898886d3bb9c1bb69f0696ae557bb2b79fe8e8f6

SHA512
83ea4479e8536b015a628c0a8ca0662b269875f303bd0193ad551022c04105406001990f3b261c8201ec031d92047450debe1c915a2e361eddb80b48b876d335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8272581d8cb38484cc8cb6afbdd0d37e

SHA1
2baa96a0439003aabaad1ce5619ea0a581cf261a

SHA256
025356bf819ea8a5da44ac2c4510bc380a9448247a30665577430ca7a44ca297

SHA512
60574186c595b0018d9223afd38e59378b1b00ef4f39be17ef2d7613cdac5b8f9e6dc3f2efefd559a0e4e8d64884d6ea155e874df13f170bb6dfbb41a0104959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
b44a683d00baccba6a40db763e098a08

SHA1
99e17ae138880c3bb6bdef5c37c99a08754a5675

SHA256
5c163e4a95c8d8378de5917bbec7131bcd67ac082c15710a001ff543a6e9b0d4

SHA512
76abb5dad80991c2a7bde3879cdd28c5bfdc56cb2526fc0e433c76167c417fc26ffea3220cf9bc69e59bf7290800c377de7563a49dfb32a4af99376097a37007

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58294d.TMP

Filesize
3KB

MD5
c5b61b5af2c6f092bbdfc44aa260a572

SHA1
a75e882bfb4352f881fd1411650ed20adcde5dc7

SHA256
6d30d265bf2fd25190d9478a4f2c4c31e2058e76aebbc10d9f5986361e9358ac

SHA512
4775bf946e20c3527375e81527cc47dd629bc268176179360165db4807483f95ba186ff676367165c9bd0fd31f5210f54abfa23776ae691c24aa40ac0b5698e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_download.oxy.cloud_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_download.oxy.cloud_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
13KB

MD5
93ed4b7d30da995528597c7510bedb90

SHA1
2dbfa58047479f5ddf7cebcfcb13b3d403c81a00

SHA256
c9c64e081e9d73ec1fa0148d124ce91bf1d0bd5fae4f478fcb79801ad35820e5

SHA512
c35801a2b21cc38c8839073fab4d646ddf12e79ed62cd6d308a243d33b3d4525d4a4428fc2ef56f3627011859ac6edc2ca961c282ed263ff0635c68593446d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
d7413a758ab09c0fa6e9e711adc82c26

SHA1
ecfc097164a87c221a0eae561b77649f15a9037e

SHA256
f0c4c8701d1a60c5d7136653dfec449f07eb6af4940c0cb95f6729bd2fa538e2

SHA512
6a459f001f5717a79af5e776458c1e963f69130df8c37aed0f4f9338e28f538ce33cf2e142b067ccb6805a6f4b23e038a9c1019fd9f249e08798690a3da5013a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
21KB

MD5
dc0a2e0b0d529f6ea43d137668f44827

SHA1
45651a5a729e4eacf77cc2e7052d59f453e95c92

SHA256
da7050d16a634642e18600452d94062b1327c7723af32ee811f5233164674e26

SHA512
4ba44ea40a07c71ef174db2a26dd2a16a9ae7b05c9029d518d2800a6489aa1447a5d6bb3cfdf03e8bb236aca01ed601e6e21826ca08fcd254f9635b9c611156b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
d4772be2ecfd9117f2b809fc638f478d

SHA1
53a99cd051cc25450d889a1e51d1f3f4df89a564

SHA256
2a92ab135ebf35d480465e5402a1fd7411aab565356e76809dd12d1561095af3

SHA512
80ebff31d9385bcdd34ff9b95a53c79fc1caab3c58364793df23acba510a49411326bef3ec9173276317039c71491d457f318855dd92f7f5775976384457c8c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9090dd408fe20569567fa46d8237da98

SHA1
28c6c15dcdd96d857b0e33d7e909f2ffaeab9e19

SHA256
dae4c84aa9a292677bad655418c9408f4649a163a9d158da12c7d3af29949ad7

SHA512
cc52d30423c5f52b53535add2a9e3932c8555df346fb30142ea02000896117c3625b7ebea3f949d0dd1ad370db30c68e4eda981bc316afb86b68cc1253f677b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f453.TMP

Filesize
48B

MD5
10b62683b84e953892b5fe7bd1a2a17d

SHA1
5d64fbf4f90ae210757a9958702d211fa5e09cb2

SHA256
fe494335935b86a39415de089e4d525721c9b086092912d352279cccf86b2beb

SHA512
0f9b08d12514fa117e28bb75a839a035aa25ebb957c1b9886aa6ac04757a298ea383fc363098dd68743e0b16e1bbf3c6ba3c42dd92a0fa49d49818f13133ad5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
bce76a632583e72c9e857333f2474d2a

SHA1
e2dbf1c3dc7f38011ea1bc47261eb5f9093fe2a7

SHA256
9352846e1a18f35e978eea1605e42ab58794f09152c647f04a987cb3af08bb60

SHA512
beeea09eee844dee0f7a003739b1f5bb6088f9a519ef9010515f6f2df3615937b0cbc72eadd804dc4a70faac2eb6670f4488d9b8a06c594920f4739708e346f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
464B

MD5
59d4f6154e068914e5f138fc631027bb

SHA1
943a7564b2b767fa485f2ecf94518c317652fd9c

SHA256
f2a468392da1640534b8f051293416de7c4f28fc3c083293c6940cea4ccefea3

SHA512
500fc47594a4c55b74007c6c87e1e185c03f4b4ebb09605614626c76cb090d7e05c6cc054c8be3db0722f2680e2858af99761055733c244718186385d271b328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
eba35d0a1c9af95c21593db025016428

SHA1
d5b790d220c60c0786f0bc09bd7b9c92ee62624b

SHA256
f81d057a7c2e8a130985e20f428454b9eaf8aeff72e3426786088cc1e3ec04b6

SHA512
53f3b71d70c6ea08fa6348bcf1154a241da17bd559834f296b7818722a71eb0cf372b63ee13d481d4347ef698a564d80b33999944e49c91ccb476f457d868b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
c95026660615dfe18a7155812172820c

SHA1
1e20c9216895c97ab0289647f37a4c7f3aaa0eea

SHA256
de835e0004bcabcf8547319ea890ad33788a1a7f1b100c155260ac9fa7112e99

SHA512
983739ba0068f44f71c4090a2008c9cd03f2a7e507c948e1d4a8ea1cd9bda749cec152375a5430b9f3710aa5c656fd6b0a7d544d6d626ef19262a196511c044f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
0e83a8506c973e0f9fca4b539049a9d6

SHA1
7111ae2d0221171c3d99d08ffb62ecb90798d072

SHA256
3840a2a5db69e76e9c7615706c832646d56bb434f999093b3810854333f88037

SHA512
98c6f35d6894e220b9c4bdb1a4ebbd880d4faed25f831e357e868b1b0c674a1e1f589f30e503500ab47c91cd99057972970448cf416bcaaa906cba0989895ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
f389ed8fc4da52a771b01869627de532

SHA1
b22fb98f6139802f0e29add36e0123e511dcd098

SHA256
e9020605ea1ce2f00afcedccf4af0b24d8f76b3f0077734434b15bb8596d3d4b

SHA512
75e54f63e9c220efbdc114197c5e4a0fe864a97f53cff17c5b33379d8d743e0d551ed5edc85d680dc25bb57aa0274bb1aa9f00a82efd184e5faf82b40bf5854e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
16a4380d7fb2bf1f37ca0d594fe1a853

SHA1
8c02e8f3b095ce390554423245783148fdfe8768

SHA256
68fe3fae4da1117c8ad1422358872fecf69981efbb63dbc5b82d67005fbb1d31

SHA512
c8dc79165a5f75373be8b122b6b8abe7c84c6ccca65cc4ac533924030be4d5534ac6a0811d7cf4b5c9f499af0cc160f5ebe75554626f31baede867f8cba94587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
9bdb3d0afee47d598fefdb2ddc8c2f58

SHA1
2c42b81ff9a8a1d487a4e0f5b00c3be066e93b24

SHA256
d00f13d5d3d9c32448a7bf85afe85ca7679c2325a7d5566b3095aff7e854ec95

SHA512
a599f016afe5f0aa308900afcdc776c81ce8e69243597086877d8c134fcdfad1546b40c87fda630a0cb82c4b544bd5547ac82a5700a770ec33325e3e525eb776

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
35a7fe734c3d3c96329a864cf18ed53e

SHA1
addc7b3d4ca4130a9ce6e3eee848616bef71e30f

SHA256
73b3301b9407bb4a2dd46ec1fb8f823599e29a3beab2b0aca5414ed86ad53354

SHA512
362224837648379ceba837d4c042fcf702d8eb0802c302ce83c57a69302ad1a2ed821cfa9e96ee0161caa024e4d0794ddfae6487f2266d6f060d476591e90b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
fb093b94ec5c5b6ab6e802ac1c39c3d2

SHA1
e2492800075c5c3b8d22f44ce7215dfc5f52749e

SHA256
d19d0a7f8a6d12783f188985151b0890f6ee1ab2d4226e136c8971c922c3858a

SHA512
497809681bc85a4af693d903bee0032ddef72cf4ef0271155067cfd893c1ea894b421553d1f804c27a2f7bc41588d9939b617ede369eebc50bdd8245986c35b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
7e017e6c516c3fa48378819a8d84ae5c

SHA1
d44752acee33837a9397b6a3518b806ea9361373

SHA256
a8fb474306c763e3219d863ce2437fa67b8704e0616cae44b838d8c46d00838f

SHA512
00942ea39066be255242b26d84ab09ea82585f7596c418bef2cefcf48f715da5bf2051a37ac2d4f163c12a3fb8bd27384d319516a199c21181c431260e4fe860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe580635.TMP

Filesize
392B

MD5
1430986d0c0e29d998124c9fde69f284

SHA1
8b56b3541cc45176bf0652b01e3a1acabbcb59fa

SHA256
4948aca0cc8c23eb24764925e4a9b9989e3952eeb31321630a62f170426af00c

SHA512
205a53e0aa3d8cde1c6688b4125516f7493f55098409d3b5a25863f4f8423ba5805622939c93990bd002c1413d740b8049bc172e7f09052c93284b1921d1fd4b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
24KB

MD5
398f86cddf688ae15eb16d4be91e9a30

SHA1
76c043312eedc8d170b64f90d283e106bec5bc1d

SHA256
d2690574482b6977093ec93e593de1b6efe72ce726b7d51aee8f2bced77d2583

SHA512
18e4c3883c636742ecda94557ce43070bbe0c39f166d2097b80e6ef7165a0bb639f0cc728977a3e71bb291eddea601d84a43b634af1fd0cf89132ea7f66a7c8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nonagon.exe

Filesize
3.5MB

MD5
4ae1c103c73c6355507e7a483aa20292

SHA1
639d1907cc11e1477ce31d364f2fe29a9ea61721

SHA256
9161af95885be07510afc9364a59d924ff4368c50690031c1b3f327f6db3dc28

SHA512
a8ee95a70d9910418302410cae6c9cd4cd894d1ee9f903e3cf8f8d0edb7f6dd80bcd249e2845ab67fcacceb5b58fd2f80b7bf0c424ea84a27b669ee7381cc4a8

Download Submit
C:\Users\Admin\Downloads\Nonagon.exe

Filesize
23KB

MD5
1b554731ea6b94e44ab6fe7ec45eb153

SHA1
1849707450548f79b4f8d941745c2c72199a7f00

SHA256
f679075808adffca9a26ade94cc8494ccc500333e8613708e9ba077d88d92a70

SHA512
96880df0242f41380e2877a3cac119e14ab062c4892040a3d8c9fe5fbc58ee6681729d1a1ca5c62427d4ad5ca76be1167d8811e9b4c35656e0c1000d660c06c1

Download Submit
C:\Users\Admin\Downloads\Nonagon.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\debug\VUQLBafFd1oU7p3k.vbe

Filesize
217B

MD5
f9ed37928a0d95692faa9f69d0cd5cb7

SHA1
77c2968f3d2ba8afb128307105861734b4fce286

SHA256
61ac997d454ae62b6025b60e2ac9f1c7031cf380f3d9d1395de3cd816d35554a

SHA512
cbe7954def42abac38dde5ba9f9fbc341e8e9161a9b0826e9fe779541fdf2b0057402d9c3dab608a9b01dc9c3229a122e13ac71bd52be978adbd628d16867b79

Download Submit
C:\Windows\debug\cs2.exe

Filesize
137KB

MD5
509f2eeba11a964fa8d22ab6994cee78

SHA1
544321089bbc1cbc6e51eabcfcb0c042f797142c

SHA256
21c7ecd4074b68a2d59b6b241037392a0f1ee2d6450fa3c72a3895f3563d5a2a

SHA512
f6eed65466977ef5b775e9dd1c204790b901e64bebc648e71b38062dd5d9207cc53fbfa4bf7b170dfc1fa41bfb1570cb6527863d9abe5d03efc49eedc5487cf0

Download Submit
C:\Windows\debug\wtf.exe

Filesize
265KB

MD5
47ba0b9187c62981c229372477e2b2a0

SHA1
9c861ee21eb30ec6aa35b02bd437f70c2ac25eee

SHA256
93a0a5f1d487c699ba0809428c732bb0d741bc41b4459490b24d9b03ee3183fc

SHA512
2a65a3b52751ce99918ab3e01db1cc21e08e5a5069fd0256a6601a3aee5d2d75ce842c9eeb147cd7d76612b0ab8f86adee2eab3fea8e410f55c8061a690585c7

Download Submit
C:\Windows\debug\wtf1.exe

Filesize
229KB

MD5
187795687849f43176bc94aff323435f

SHA1
22e3d510df771291a2a256946ac6268ccf5d10be

SHA256
d7ebf40f863050be539cd8cbba2463c48235aa509819ed3b066a1c0b4974203e

SHA512
b099c9cbd3f5d9cd44dae19c66e88d32e5c290fa3f8cd6818397b54f2f73d318738d96b295053254bed4f254a2ebdfb2a8e75402e61314343060447888d781a3

Download Submit
memory/712-885-0x00007FF703E80000-0x00007FF703E8A000-memory.dmp

Filesize
40KB

Download
memory/2220-632-0x000001B950BA0000-0x000001B950BE6000-memory.dmp

Filesize
280KB

Download
memory/2776-631-0x00000259C9A40000-0x00000259C9A68000-memory.dmp

Filesize
160KB

Download
memory/4988-895-0x00000000001A0000-0x0000000000292000-memory.dmp

Filesize
968KB

Download
memory/4988-896-0x0000000002410000-0x000000000241A000-memory.dmp

Filesize
40KB

Download
memory/4988-897-0x0000000002420000-0x000000000242E000-memory.dmp

Filesize
56KB

Download
memory/4988-898-0x0000000002430000-0x0000000002438000-memory.dmp

Filesize
32KB

Download
memory/5204-618-0x00000213C85C0000-0x00000213C8600000-memory.dmp

Filesize
256KB

Download