raccoon | 3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93

Resubmissions

31/03/2025, 00:46

250331-a4vs3sztev10

10/03/2025, 05:28

10/11/2024, 23:53

09/11/2024, 01:37

09/11/2024, 01:31

Analysis

max time kernel
18s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2025, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b4df70b068c231a06bb8fcc5a256e34.exe
Size 929KB
Sample250331-a4vs3sztev
SHA256 3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93
MD5 0b4df70b068c231a06bb8fcc5a256e34
SHA1 29ecfc8234162b43674d90e137546a4ecd4f65d7
SHA512 603a19c3c084bd71dbeda26d34d3d179d1c7f1eb23f4f411a83cbb4d365482885794763fa0d9711dbb6a383a32e60e8ec50aeacce7b87c859b70bf8998ff958b
SSDEEP 24576:pAT8QE+krVNpJc7Y/sDZ0239GhjS9knREHXsW02EhY:pAI+wNpJc7Y60EGhjSmE3sW02EhY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon redline 4 5076357887 76426c3f362f5a47a469f0e9d8bc3eef @tag12312341 afb5c633c4650f69312baef49db9dfa4 nam3 ruxarr_gg discovery infostealer stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

31.41.244.134:11643

Attributes

auth_value
a516b2d034ecd34338f12b50347fbd92

Extracted

Family

redline

Botnet

@tag12312341

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

RuXaRR_GG

insttaller.com:40915

Attributes

auth_value
4a733ff307847db3ee220c11d113a305

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

http://193.56.146.177

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

http://45.95.11.158/

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Raccoon family
raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 10 IoCs

resource	yara_rule
behavioral2/files/0x00070000000241d1-182.dat	family_redline
behavioral2/memory/4924-197-0x0000000000FC0000-0x0000000000FE0000-memory.dmp	family_redline
behavioral2/files/0x00070000000241d4-208.dat	family_redline
behavioral2/files/0x00070000000241d5-218.dat	family_redline
behavioral2/memory/1092-226-0x00000000005B0000-0x00000000005F4000-memory.dmp	family_redline
behavioral2/memory/3248-243-0x0000000000970000-0x0000000000990000-memory.dmp	family_redline
behavioral2/files/0x00070000000241d6-229.dat	family_redline
behavioral2/files/0x00070000000241d7-247.dat	family_redline
behavioral2/memory/4092-255-0x0000000000A60000-0x0000000000A80000-memory.dmp	family_redline
behavioral2/memory/2584-263-0x0000000000AC0000-0x0000000000AE0000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	0b4df70b068c231a06bb8fcc5a256e34.exe

Executes dropped EXE 11 IoCs

pid	Process
992	F0geI.exe
2340	kukurzka9000.exe
4924	namdoitntn.exe
1136	nuplat.exe
4192	real.exe
1092	safert44.exe
3248	tag.exe
4092	jshainx.exe
2584	ffnameedit.exe
5184	rawxdev.exe
5228	EU1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	iplogger.org
7	iplogger.org

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	0b4df70b068c231a06bb8fcc5a256e34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	0b4df70b068c231a06bb8fcc5a256e34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	0b4df70b068c231a06bb8fcc5a256e34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	0b4df70b068c231a06bb8fcc5a256e34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\nuplat.exe	0b4df70b068c231a06bb8fcc5a256e34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	0b4df70b068c231a06bb8fcc5a256e34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	0b4df70b068c231a06bb8fcc5a256e34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\tag.exe	0b4df70b068c231a06bb8fcc5a256e34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\rawxdev.exe	0b4df70b068c231a06bb8fcc5a256e34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\EU1.exe	0b4df70b068c231a06bb8fcc5a256e34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	0b4df70b068c231a06bb8fcc5a256e34.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	namdoitntn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nuplat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	real.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	safert44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jshainx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b4df70b068c231a06bb8fcc5a256e34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffnameedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rawxdev.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EU1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0geI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kukurzka9000.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133878556021060142"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-83325578-304917428-1200496059-1000\{BE1990A4-A401-4C1A-9E77-35DF50943D31}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4972	4712	0b4df70b068c231a06bb8fcc5a256e34.exe	89
PID 4712 wrote to memory of 4972	4712	0b4df70b068c231a06bb8fcc5a256e34.exe	89
PID 4712 wrote to memory of 620	4712	0b4df70b068c231a06bb8fcc5a256e34.exe	90
PID 4712 wrote to memory of 620	4712	0b4df70b068c231a06bb8fcc5a256e34.exe	90
PID 4972 wrote to memory of 4724	4972	msedge.exe	91
PID 4972 wrote to memory of 4724	4972	msedge.exe	91
PID 4712 wrote to memory of 4124	4712	0b4df70b068c231a06bb8fcc5a256e34.exe	92
PID 4712 wrote to memory of 4124	4712	0b4df70b068c231a06bb8fcc5a256e34.exe	92
PID 4712 wrote to memory of 4832	4712	0b4df70b068c231a06bb8fcc5a256e34.exe	93
PID 4712 wrote to memory of 4832	4712	0b4df70b068c231a06bb8fcc5a256e34.exe	93
PID 4712 wrote to memory of 1068	4712	0b4df70b068c231a06bb8fcc5a256e34.exe	94
PID 4712 wrote to memory of 1068	4712	0b4df70b068c231a06bb8fcc5a256e34.exe	94
PID 4972 wrote to memory of 4216	4972	msedge.exe	95
PID 4972 wrote to memory of 4216	4972	msedge.exe	95
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96
PID 4972 wrote to memory of 3636	4972	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe
"C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AbtZ4
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x344,0x7fff4dbef208,0x7fff4dbef214,0x7fff4dbef220
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1832,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2420,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2252,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:8
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3484,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3508,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4148,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4256,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4564,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4912,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5072,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5224,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5264,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5756,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3976,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:8
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6260,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6444,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3968,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6876,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6884,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7548,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7548,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6164,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3480,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:8
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6508,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7844,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6864,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:8
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7720,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:8
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8364,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:8
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8384,i,3007645759742747618,8966320572232093849,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:8
    3⤵
    PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC4
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK4
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX4
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1naEL4
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX4
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nhGL4
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A3AZ4
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AUSZ4
  2⤵
  PID:4244
- C:\Program Files (x86)\Company\NewProduct\F0geI.exe
  "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:992
- C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
  "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2340
- C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
  "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4924
- C:\Program Files (x86)\Company\NewProduct\nuplat.exe
  "C:\Program Files (x86)\Company\NewProduct\nuplat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Program Files (x86)\Company\NewProduct\real.exe
  "C:\Program Files (x86)\Company\NewProduct\real.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4192
- C:\Program Files (x86)\Company\NewProduct\safert44.exe
  "C:\Program Files (x86)\Company\NewProduct\safert44.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1092
- C:\Program Files (x86)\Company\NewProduct\tag.exe
  "C:\Program Files (x86)\Company\NewProduct\tag.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3248
- C:\Program Files (x86)\Company\NewProduct\jshainx.exe
  "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4092
- C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
  "C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2584
- C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
  "C:\Program Files (x86)\Company\NewProduct\rawxdev.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5184
- C:\Program Files (x86)\Company\NewProduct\EU1.exe
  "C:\Program Files (x86)\Company\NewProduct\EU1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EU1.exe

Path C:\Program Files (x86)\Company\NewProduct\EU1.exe
Size 286KB
SHA256 2f7a5ab1ce00d00b1196b2cd815457176467928a47a8c652b8af41e6bab8772b
MD5 eaa8eacd3c59ed71b7f68ef7a96602a3
SHA1 9b35e7b6cd147a4a729d3f6b1791e774a754c589
SHA512 c19934e143dcf1242f2f1584baaad4cebbd2e06d048c2ef9d347683ef0d77e2791c364608957e8ea4c1b9613450c3c2e4112bb56280ee12a4b1b1a63c714d83e
SSDEEP 3072:SKVC7oLxctmeDksO7GTIG3gvF+1Bd4Cdf3ZnKvAbMAg0+bpJHaggzgLOJHNR/ONN:SKVCDaqzV/4IPFqAb7GxVgzdDGTdD
MD5 SHA1 SHA512 SSDEEP

Submit Download

F0geI.exe

Path C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Size 339KB
SHA256 f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b
MD5 501e0f6fa90340e3d7ff26f276cd582e
SHA1 1bce4a6153f71719e786f8f612fbfcd23d3e130a
SHA512 dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69
SSDEEP 6144:Y7v3qLsCqxXXFaNOq7trETZdZjPLUQxIAi/9xlNtQ/3N:Y7vbfQOkrETZdZjPv10RNk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffnameedit.exe

Path C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
Size 107KB
SHA256 713eeb4e9271fe4b15160d900ad78498838bb33f7f97ad544a705ab2a46d97cf
MD5 4bf892a854af9af2802f526837819f6e
SHA1 09f2e9938466e74a67368ecd613efdc57f80c30b
SHA512 7ef9d8cb4daf6be60c5a41439dab4e7384676b34de2341ac52cb33815645fbb51a4b78725ea97479d287a8d7a0a61b4b337b1ad49cce2a23c9192fd9b7678d44
SSDEEP 3072:zcvFBYCY+piqI+Tg6h4MLkKUQc7b9fDWhB4EASNB:zcvmvI4MoKtcJWhB4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

jshainx.exe

Path C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Size 107KB
SHA256 84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665
MD5 2647a5be31a41a39bf2497125018dbce
SHA1 a1ac856b9d6556f5bb3370f0342914eb7cbb8840
SHA512 68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26
SSDEEP 3072:9cvFBgCYKpi8IVJFKQ6OUxuvQc0ZpDHh64EASNh:9cv+t36jo4c+Hh64jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

kukurzka9000.exe

Path C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Size 491KB
SHA256 8bbc892aedc1424ca5c66677b465c826f867515a3fea28821d015edcee71c912
MD5 681d98300c552b8c470466d9e8328c8a
SHA1 d15f4a432a2abce96ba9ba74443e566c1ffb933f
SHA512 b909975d0212d5a5a0cb2e2809ee02224aac729cb761be97a8e3be4ee0a1d7470946da8cf725953c1b2d71fb5fc9dc3c26fd74bce5db5cc0e91a106f8bded887
SSDEEP 12288:uhUQ3jSNiEU7pWQZmMmmr1omuSxvB+HTPA7G:qU4jp1WQZmM5s2QTPA7
MD5 SHA1 SHA512 SSDEEP

Submit Download

namdoitntn.exe

Path C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Size 107KB
SHA256 1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e
MD5 bbd8ea73b7626e0ca5b91d355df39b7f
SHA1 66e298653beb7f652eb44922010910ced6242879
SHA512 625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f
SSDEEP 3072:NcvFB4CYHpiVIlf0By1C+4IQclHbTTh/4EASNB:NcvGt91Cdxc9Th/4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

nuplat.exe

Path C:\Program Files (x86)\Company\NewProduct\nuplat.exe
Size 287KB
SHA256 e080161f57d4eaaad9173b63219ba5a9c2c595324a6b3ffe96783db40839807b
MD5 17c42a0dad379448ee1e6b21c85e5ac9
SHA1 2fec7fbb4a47092f9c17cd5ebb509a6403cb6d69
SHA512 5ddfe9af625c54e417452fe582041cdd373b52d4ededbcba71a88050fd834bc8af822257f7ad606e89db3fde15be98f58c1d8ff139dac71d81a23f669617a189
SSDEEP 3072:YqQsGJ88a/x8IZC7QK+7fieyqBuJV6H+pUJcJI+6UVLGqFwFz5e1pJHaggzHRuNK:Yq7337fiaAa8SyMUV9nxVgzxuUmkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

rawxdev.exe

Path C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
Size 287KB
SHA256 cdd49958dd7504d9d1753899815a1542056372222687442e5b5c7fbd2993039e
MD5 3434d57b4ceb54b8c85974e652175294
SHA1 6d0c7e6b7f61b73564b06ac2020a2674d227bac4
SHA512 f06fa676d10ff4f5f5c20d00e06ad94895e059724fea47cdf727bd278d9a3ba9daec26f5a0695cb74d87967d6d8020e14305e82725d5bc8c421c095e6704d9aa
SSDEEP 3072:sqQsGJH6KGxIdbwsgYOUGWeo2Rq9/YzulXcWh011KX4iLTBe1pJHaggptbRuNmTC:sqAJf0WeAJtV/I1KrLTsxVgDFu4TGN
MD5 SHA1 SHA512 SSDEEP

Submit Download

real.exe

Path C:\Program Files (x86)\Company\NewProduct\real.exe
Size 286KB
SHA256 975457ed5ae0174f06cc093d4f9edcf75d88118cbbac5a1e76ad7bc7c679cd58
MD5 8a370815d8a47020150efa559ffdf736
SHA1 ba9d8df8f484b8da51161a0e29fd29e5001cff5d
SHA512 d2eb60e220f64e76ebed2b051cc14f3a2da29707d8b2eb52fb41760800f11eafeb8bb3f1f8edcfca693a791aa60e56e263063f2b72abe4ad8784061feee6f7bf
SSDEEP 3072:dKVbAU1xp6UMi5Ag/aX0XqG0heHp8hc5++ieQEkv9wgpJHaggpd+iRgDLyp+R/+a:dKVbdiLwi25ieQ3BxVgpd5w2a
MD5 SHA1 SHA512 SSDEEP

Submit Download

safert44.exe

Path C:\Program Files (x86)\Company\NewProduct\safert44.exe
Size 244KB
SHA256 86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709
MD5 dbe947674ea388b565ae135a09cc6638
SHA1 ae8e1c69bd1035a92b7e06baad5e387de3a70572
SHA512 67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893
SSDEEP 6144:up3Ja5x20VGgvErTAGx+v8ZfOmCWpbR7xVn8fvu3mRYGg5xibAq:upZlOvGTAGx+v8ZfOmCWpbR7xVn8fvu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tag.exe

Path C:\Program Files (x86)\Company\NewProduct\tag.exe
Size 107KB
SHA256 8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89
MD5 2ebc22860c7d9d308c018f0ffb5116ff
SHA1 78791a83f7161e58f9b7df45f9be618e9daea4cd
SHA512 d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e
SSDEEP 3072:bcvFBgCYCpieID9L27lqeI6QcEhpTFhM4EASNz:bcvOfYlq9zcqFhM4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3e876f232d2a766cc7244538ab5fc61da25853942ffe237bbee3077f0cbb435c
MD5 36f9fd1ea77d2f590556c7d635edd948
SHA1 77be267292d38d47ce859e8924a6730130f7f2da
SHA512 5c222b04d880e65af08e3ca8e8695af07d0c29ef5cf70c74fa0d81baf12f7dd7ad11073cff8651767e4743f40bc3fa93df6198bd3cbdcbcf38ba1ecbedea5a42
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee9a4e8df1a64f019f80b1d75be15fd30693816fcaab4c7425230e96b6badba3
MD5 caba3b97f983eb81b0720471256478c8
SHA1 339f3ecc344478074922a419c72f2d5ae5057596
SHA512 2509f6b967fd54eb3dce44408b7e0b5c32c2900a68082f573aa8382def609314022cdb0759ce9cbd88f6a7c2b83b3026f464388f3848fed913cae30d7f2b730f
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
MD5 40e2018187b61af5be8caf035fb72882
SHA1 72a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA512 a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
SSDEEP 1536:IRWH74CshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHNdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8e4aadfe192cafd58c183673521f59150b44bdd3dd09895d5776ffb7925322ad
MD5 0d9d95524242307405f6d2a513d04289
SHA1 e7c32ac8e5a2dc9a29b214344153c7c47dea36ea
SHA512 b8d81f775a7d7435838c1c894d9497bb66f1364b4840899bbf56fa3cb93a3f8b938c3cda27ed6f690ec1f51f1d1daacec0b7672413b98992d3f1d1dae6851083
SSDEEP 192:sVERFyMh/Ky0Ml8MgnsJHNqKcwcwIPbmE+t09nfIZ8pqHY+WNqFSY1qF24IgdJ:sVEtLInsJH4fZPytwqHSgSmUn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 3b280c126363cb656e6fbdcdad1dcee5bb80edcbe9cf6cc4c4128de379726ee8
MD5 04e08225ee337ca751cefd40b2ef6028
SHA1 fd670f892788aeba49b6df9715b01b89e8044916
SHA512 519eda64c791462c629b4f41ea26501c82fb53e37987ef1e248d16efaf6a14d89318825c34f7b72f99663ab1b378213f0b6471e4d3fa07e62a54ccd4c8bf85cb
SSDEEP 768:+hVK8dE7pLuLpb9WFhjxz8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/lmYLlq45+NroL:+hVK8dIEpb9WFhjxzu1ja8lmYLw0+mWc
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5a37794d79503dbec7db0b03f681241c2309fa35015d3fca4324a050cf54b124
MD5 00b1e627bfad780c8d8cd663b7660e4b
SHA1 5155957cdc99ef6c03cb91514c6d34b91216e174
SHA512 2a686c3afc8837a61c307079a1b1e68104015d43e8f5a04b9d26ae64d870301904382c278491c4df1f08d5f6f69ce31484cd6f941aa5e5a54398803d3e4f1e41
SSDEEP 24:LmQqhNourHkXro1Z1kKZHLn0Sta7rLCKKt5yXPUYYRK4+S1GpK9fyX/IQENKIySK:FXKWEyl0K7YyFIKfoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 848665029f650c0525b36ceb778e100ec243979d50263a983e1d4d7a08344614
MD5 1cc74e57870cca24189143bea10f8a48
SHA1 9d2752164926b483a3e259554283936e701ff94f
SHA512 2fb18a313b0198bc2e281bdfd8580a079adb434ebb9f622e18d500c7bf6c14f9fa48612a0d7a447431e64cade1c4cf4fb5f9ecef1d5155f2ca69f9a330b92d2a
SSDEEP 384:nWE6iXXXM898lqOPGmuWJT5K+4Y1sNbILzMw1lSN5u0Ep/Mz4merC7OTV3ZEF6qi:WE6esE8lDldUG1jg7Ep/Mz4m0VZVqLkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 6KB
SHA256 bbae49a03a0b46f9eb6d2daec289b1206d9f6822317c2d832dd9c1064b700788
MD5 a16dcebf0bc5d3cf1a845ff791d812c9
SHA1 c1e730f23175b74d29339af669c66bd491d5a733
SHA512 97c8b8e257806b48c151d8d3af84944c180eb90512fab005e05c8ed9979c1c2e1bbbb34180afcab9c36375f2f913e2683aba91ae820a27f9187a64e971bbd35d
SSDEEP 192:LONbyynD9WiRUR/K/J2711UcF+lV7f7Bmi:LONbyyDFw/K/EpDMoi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 8e6fe319819f69f9e267d4aabf3aa7374a9ea06db9b68693f721b206ff3c61e0
MD5 f0ac165052f632d26820409f9e0aae91
SHA1 cc2b209b009c5b40dc4bbff642b886e80ca48936
SHA512 d3339f5a04b659103f122a36215a5b847e7f20f0d20031de5fc119d367ec16e3a70c3f6c7120f58fe6e3492b22aa621049d816a152be719aa9544f02d2a3a907
SSDEEP 96:gqONkCyUfLndKw5ih/cIVURLl8RotopV2IN7BiPhhvCwnJ2CUce1+E3PGbawtlBi:LONbyynw9WiRUMPk/J27119Pdrsuk+mi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3062fb27a2fb5706d8468943430cc228a401fbb45044dacbabbb82a9edfca146
MD5 f7e22293d108ea24545879d19d3d236e
SHA1 1af4e4ac7cae0d552a5f9fa23fba82fd021e6bcd
SHA512 7301cd536703a25d21d048cc44aee59b5a73531c9e7bf29357a1e48cf157f80965746086ba9fc65f1df2648083c28b133e21d04a3525ad10cde7d67328cb0594
SSDEEP 192:zbONbyynwNWiRU7m5Wy0J27119PdrsuZ+m2:zbONbyywVUm5D0Ep/hz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0145f133ffe9c07fdcf24e8abe6aeb212db49618ba3456afe97779b93230d2fe
MD5 c269ba56f4e213a6e54c2d397c5b5cb9
SHA1 58a587b059bcd83232d8d270119b3bfb424468c8
SHA512 5cf5eb5a3c0cfd3ab0495d655902a97752365fecf96c12fa61621be9a9d0b79589b41f1ac6533da0c987596d8397f5bb7d1210a30881f8f539823b256f644ba0
SSDEEP 192:zbONbyynwNWiRU7X5P8U0J27119PdrsuZ+m2:zbONbyywVUX5PH0Ep/hz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7a4bed03fa7a98c8a01c31ad04171d1cea66575498752b3d7ea4ae170439a663
MD5 c970237b5cfc4a3a776d20d0b8da3ab3
SHA1 7591ae1a93054585df93a5409ea08a39cb3b7ca6
SHA512 6e55bf4f9f818992dd1cd2672657c3c7cdd72b8c4ecb2c7e926da4247603ceb92eca9e54d6bb8795819a79f3e5f2b90406a11cc1ddc30c75f8f6fb4aa6330c7e
SSDEEP 192:zbONbyynwNWiRU7W5BZ0J27119PdrsuZ+m2:zbONbyywVUW5f0Ep/hz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5911e9594bb13b5c0e13481a38bc184785cefec0f5a36f61ca6c0ac21f44ae2
MD5 4764e79770c13be9b64cb05e67518db8
SHA1 0ecba4ecb88473efe59e3ebe57b51e29fda1ed07
SHA512 f91bed94fa88bb4d74d953a7d8972caebd19b55275574e558ee372161c6068d85e2adef54d61ce5aa8609e6815a2f4b4fba432f5fa251f513eb53faccc4d825e
SSDEEP 192:zesNbnklynwNWiRU7w5og0J27119PdrsuZ+mn:zesNbKywVUw5P0Ep/hzn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e4ef692e207447524ea38f79160faed11449c244c393ad421939629a7933acfd
MD5 153b4d00b953ea217daa5ef9063d8631
SHA1 4bd6098588c8fa125e4419457dab78be82387bef
SHA512 2c14a93a25cb016627338d258fba9bc834ab9b0a674125684aedb20f93ce9a94b97a6b6a9359688528ae157f7030bceb12c6fccff050cacb0abae3c9dd606993
SSDEEP 192:zbONbyynwNWiRU7J5110J27119PdrsuZ+m2:zbONbyywVUJ5P0Ep/hz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f955339e206c7146a2f3dd84489a429d6fac4afbd8cef945f09dd3592bfbda9a
MD5 40849fb13b20fd10af849af128896b86
SHA1 226b3b83d851decd011682e9e45d6b3672d96cb6
SHA512 b529ab6ee2b035549679ac4ddb6be12b8faa889d03feff760607ae4df674137dad31d54d6f8e630700f9c383eae4937dd43a4c2a5f33155e4bbc9c54eadb6423
SSDEEP 192:zesNb5CdtxRgnwNWiRU7K5KO0J27119PdrsuZ+mbsAl:zesNbEzMwVUK570Ep/hzQAl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9861e8bc477fb93e4985a0850179fc57ce458798949ad484f0447a8bb25d0d38
MD5 be6c28c65ca33e94e938834d40195152
SHA1 b4ad025a207215019f442135c8ffb0d9d97e17cc
SHA512 eb5bb36b2c76a21f8b84d26bd33c904bec81e6e30f912171cd07562c85782aa34680f435d9d67404ca14b73c4f9c6f6a260d49beb25d2dbde916f60474855530
SSDEEP 192:zbONbyynwNWiRU7n5T/0J27119PdrsuZ+m2:zbONbyywVUn5z0Ep/hz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 238a823cb85eacb4d2610a0c48e51255e7b7e19e120904aed9df0d2caf447fb4
MD5 1b3a53b8ff7626a2d6a0042f1e9fadf2
SHA1 c9fbbf2b011a702fc8337697d66dca80e69d2cf2
SHA512 ac8af9558a9332c6f742df9e1b01906694ab7ba6b419cec2fc8bc5653fd9358311e79297222844136b54eb7dab821795271589f872c96c79de5307051ca06aa9
SSDEEP 192:zesNbnkldtxRgnwNWiRU7r5Hr0J27119PdrsuZ+mn:zesNbKzMwVUr5L0Ep/hzn
MD5 SHA1 SHA512 SSDEEP

Submit Download

3eff87ce-092c-4fd8-af84-1db3e423806c.tmp

Path C:\Users\Admin\AppData\Local\Temp\3eff87ce-092c-4fd8-af84-1db3e423806c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

eba9bb12-6bb5-4600-8b37-767bdbc2e235.tmp

Path C:\Users\Admin\AppData\Local\Temp\eba9bb12-6bb5-4600-8b37-767bdbc2e235.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

fb4924af-17b6-48e5-b490-9e0baa4856d4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4972_1567934434\fb4924af-17b6-48e5-b490-9e0baa4856d4.tmp
Size 152KB
SHA256 fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
MD5 dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1 d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA512 65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
SSDEEP 3072:5TTj3gXV7obSP3uAxchhBoi+dmTfabSnVf8nik5jqfGc:5HUtoQuAx2cjsMeGiyjuGc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/992-756-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1092-238-0x0000000000EB0000-0x0000000000EB6000-memory.dmp

Download

memory/1092-226-0x00000000005B0000-0x00000000005F4000-memory.dmp

Download

memory/2340-269-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2584-263-0x0000000000AC0000-0x0000000000AE0000-memory.dmp

Download

memory/3248-243-0x0000000000970000-0x0000000000990000-memory.dmp

Download

memory/4092-255-0x0000000000A60000-0x0000000000A80000-memory.dmp

Download

memory/4712-275-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4924-244-0x0000000007C80000-0x0000000007CCC000-memory.dmp

Download

memory/4924-235-0x00000000063C0000-0x00000000069D8000-memory.dmp

Download

memory/4924-236-0x0000000006340000-0x0000000006352000-memory.dmp

Download

memory/4924-237-0x0000000007D50000-0x0000000007E5A000-memory.dmp

Download

memory/4924-241-0x0000000007C40000-0x0000000007C7C000-memory.dmp

Download

memory/4924-197-0x0000000000FC0000-0x0000000000FE0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads