hxxps://cdn[.]discordapp[.]com/attachments/1517642067260477622/1517807045149982800/kilcurrency-10[.]32-source[.]zip?ex=6a379f77&is=6a364df7&hm=c6e99c0c5d24ac52c0dd9d85898f447947163e76e32a003dae6a23494e8ea546&

Analysis

user interaction
yes
max time kernel
996s
max time network
948s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1517642067260477622/1517807045149982800/kilcurrency-10.32-source.zip?ex=6a379f77&is=6a364df7&hm=c6e99c0c5d24ac52c0dd9d85898f447947163e76e32a003dae6a23494e8ea546&
Sample260620-lwzb3sfv21

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1368	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 57 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa1a7503faf3b6479abc0c68cea414fb00000000020000000000106600000001000020000000990091b624af813e30ae5dcc43f20386a99633916243cfa3b51a1ab44ccdb679000000000e8000000002000020000000aa9ca51e84fc18347e1e25bb115656f2c056cf731186ac75feb61e3a108e68f42000000086a693518acbff57c3ba6f0ba517feb5f8d206f2b1fb7b63288b0e16873b403e40000000135bbb64ce8c53eabdb51a0a5106aa699d045bfaf84833697ca7ad3dd5b695629ecd8e0b79580d645a5f2777b08b5ab42cf784a45d38d8888475a4fca5433aa4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000002000000010000000083ffff0083ffffffffffffffffffff7a0000006400000043050000df030000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{223A84F4-6C90-11F1-B995-F23C4AB2DE8F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "488714230"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31260826"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04d5a36a300dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3555659952"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0be5c36a300dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3563628955"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31260826"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa1a7503faf3b6479abc0c68cea414fb0000000002000000000010660000000100002000000052dc1264de64d661795f4e4f0f205bc2d4d6086bd4bb739280f3cb9a9762f22c000000000e8000000002000020000000c5a7e27c835064eb5631117d8a183ef975d2e2c817402aa46ea0739975d97f79200000004c0ae2a90c38b303dce7276980701560debef69c24dc7e051ce8b75180634eb840000000369cbb658c78ae1ca83ebaf245fbb8078dd30bca3f8cdc50132986e9c55aef3b06812baa705729846fc7d498283dd6d6c9291bf338e68b56cd82570ba6c5111d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff7a0000006400000043050000df030000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06af446a500dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FF5D0398-6C8D-11F1-B995-F23C4AB2DE8F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa1a7503faf3b6479abc0c68cea414fb00000000020000000000106600000001000020000000d6fdfe5e842ea18af4aee83682b956beac5f3ccdd4c90d410c32b4de88b4218d000000000e80000000020000200000009fcb3f52eade8ddc84a98b43be83c378da9864aded52dce3c07b5f1cea351baf20000000b771a05b8f911c007708d410f55620f2fe92818afdfc4bc1071d70fbc134e548400000002a8cdaf6acc4298179876f1736c124d0655f8d9db4f0c47b975beed628b1ff57ed2643726858be0725de936097c4f6c83e03a0dfa6712e565433c198833608d2	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264228352551475"	msedge.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\䢘溨䜦鋁Ć\ = "yml_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\㝄턑─退ꖘȰ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\린Ȱ	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\yml_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\yml_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.java	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\java_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\yml_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\䢘溨䜦鋁Ć	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\java_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.java\ = "java_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\java_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\㝄턑─退ꖘȰ\ = "yml_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\yml_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\yml_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\輘셸Ǧ	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\კ放㰀蠀㑐셶Ǧ\ = "java_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\轀셸Ǧ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\java_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{7EE8C055-5B10-4786-B4D1-3729F081ABA6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\yml_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\yml_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Ǧ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\კ放㰀蠀㑐셶Ǧ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\籠쏬Ǧ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\java_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\yml_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\java_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\java_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.yml\ = "yml_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\მ旀㴀耀	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\java_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.yml	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\린Ȱ\ = "yml_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\籠쏬Ǧ\ = "java_auto_file"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Ǧ\ = "java_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\輘셸Ǧ\ = "java_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\轀셸Ǧ\ = "java_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\მ旀㴀耀\ = "java_auto_file"	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6120	msedge.exe
6120	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4124	OpenWith.exe
6092	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
1884	iexplore.exe
1884	iexplore.exe
3332	msedge.exe
3512	IEXPLORE.EXE
3512	IEXPLORE.EXE
4560	NOTEPAD.EXE
3408	NOTEPAD.EXE
5576	iexplore.exe
5576	iexplore.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3512	IEXPLORE.EXE
3512	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 49 IoCs

pid	Process
1884	iexplore.exe
1884	iexplore.exe
3512	IEXPLORE.EXE
3512	IEXPLORE.EXE
3512	IEXPLORE.EXE
3512	IEXPLORE.EXE
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
4124	OpenWith.exe
5880	OpenWith.exe
5880	OpenWith.exe
5880	OpenWith.exe
5880	OpenWith.exe
5880	OpenWith.exe
5880	OpenWith.exe
5880	OpenWith.exe
5880	OpenWith.exe
5880	OpenWith.exe
6092	OpenWith.exe
6092	OpenWith.exe
6092	OpenWith.exe
6092	OpenWith.exe
6092	OpenWith.exe
6092	OpenWith.exe
6092	OpenWith.exe
6092	OpenWith.exe
6092	OpenWith.exe
6092	OpenWith.exe
6092	OpenWith.exe
5576	iexplore.exe
5576	iexplore.exe
5556	IEXPLORE.EXE
5556	IEXPLORE.EXE
5556	IEXPLORE.EXE
5556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 2032	3332	msedge.exe	87
PID 3332 wrote to memory of 3412	3332	msedge.exe	88
PID 3332 wrote to memory of 1368	3332	msedge.exe	89
PID 3332 wrote to memory of 3412	3332	msedge.exe	88
PID 3332 wrote to memory of 3412	3332	msedge.exe	88
PID 3332 wrote to memory of 988	3332	msedge.exe	91
PID 3332 wrote to memory of 988	3332	msedge.exe	91
PID 3332 wrote to memory of 1804	3332	msedge.exe	92
PID 3332 wrote to memory of 1804	3332	msedge.exe	92
PID 3332 wrote to memory of 1804	3332	msedge.exe	92
PID 3332 wrote to memory of 3920	3332	msedge.exe	93
PID 3332 wrote to memory of 3920	3332	msedge.exe	93
PID 3332 wrote to memory of 3920	3332	msedge.exe	93
PID 3332 wrote to memory of 804	3332	msedge.exe	94
PID 3332 wrote to memory of 884	3332	msedge.exe	95
PID 3332 wrote to memory of 804	3332	msedge.exe	94
PID 3332 wrote to memory of 804	3332	msedge.exe	94
PID 3332 wrote to memory of 884	3332	msedge.exe	95
PID 3332 wrote to memory of 884	3332	msedge.exe	95
PID 3332 wrote to memory of 1860	3332	msedge.exe	99
PID 3332 wrote to memory of 1416	3332	msedge.exe	100
PID 3332 wrote to memory of 1860	3332	msedge.exe	99
PID 3332 wrote to memory of 1416	3332	msedge.exe	100
PID 3332 wrote to memory of 4284	3332	msedge.exe	101
PID 3332 wrote to memory of 4284	3332	msedge.exe	101
PID 3332 wrote to memory of 2168	3332	msedge.exe	102
PID 3332 wrote to memory of 2168	3332	msedge.exe	102
PID 3332 wrote to memory of 2168	3332	msedge.exe	102
PID 3332 wrote to memory of 2460	3332	msedge.exe	103
PID 3332 wrote to memory of 3824	3332	msedge.exe	106
PID 3060 wrote to memory of 1884	3060	MSOXMLED.EXE	118
PID 1884 wrote to memory of 3512	1884	iexplore.exe	119
PID 3332 wrote to memory of 4296	3332	msedge.exe	121
PID 3332 wrote to memory of 4520	3332	msedge.exe	122
PID 3332 wrote to memory of 5128	3332	msedge.exe	123
PID 3332 wrote to memory of 5636	3332	msedge.exe	125
PID 3332 wrote to memory of 5636	3332	msedge.exe	125
PID 3332 wrote to memory of 6120	3332	msedge.exe	126
PID 4124 wrote to memory of 4560	4124	OpenWith.exe	128
PID 5880 wrote to memory of 5924	5880	OpenWith.exe	130
PID 6092 wrote to memory of 464	6092	OpenWith.exe	133
PID 736 wrote to memory of 5576	736	MSOXMLED.EXE	146
PID 5576 wrote to memory of 5556	5576	iexplore.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1517642067260477622/1517807045149982800/kilcurrency-10.32-source.zip?ex=6a379f77&is=6a364df7&hm=c6e99c0c5d24ac52c0dd9d85898f447947163e76e32a003dae6a23494e8ea546&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe9e19c188,0x7ffe9e19c194,0x7ffe9e19c1a0
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11917954300825689749,8090852126387163445,262144 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,9436784478623723226,7813782316329857229,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,5560969848534533975,9529948266707407456,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,14602792652368875415,5016106857433558514,2097152 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,3218251491777643417,14260586038134731592,2097152 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,16515769605075287476,15876844996374987406,2097152 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,12712671373267602215,13079437070410374900,2097152 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,6300232366833256440,7945239464096867186,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,7963641740592064841,16519754406500372751,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,5838510885576771951,14244309965174782677,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5712,i,13784188370975272364,15743099632724787120,2097152 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,5711225662759031815,4929198303521363856,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,5730529363638852150,5814674079104893717,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,5730529363638852150,5814674079104893717,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,9603500712015356723,14637135822001876516,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,10805890590729390666,15802694536005561449,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,8461972381291918930,10341536598097302308,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,1720831832805311513,11891280586472510922,524288 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6068,i,14936546679194451727,2555467505925544064,262144 --field-trial-handle=2248,i,2682345200297110206,4067581648330175751,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2488

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\pom.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\pom.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\resources\config.yml
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:4560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\resources\plugin.yml
  2⤵
  PID:5924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\java\de\tim\killcurrency\KillCurrencyPlugin.java
  2⤵
  PID:464

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\java\de\tim\killcurrency\papi\KillCurrencyExpansion.java
1⤵
PID:6120

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\java\de\tim\killcurrency\shop\TraderManager.java
1⤵
PID:4912

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\java\de\tim\killcurrency\listener\CurrencyListener.java
1⤵
PID:3812

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\java\de\tim\killcurrency\listener\PvPManagerHook.java
1⤵
PID:3664

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\java\de\tim\killcurrency\listener\PvPManagerHook.java
1⤵
PID:5060

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\java\de\tim\killcurrency\listener\PvPManagerHook.java
1⤵
PID:3756

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\java\de\tim\killcurrency\command\KillCurrencyCommand.java
1⤵
PID:5424

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\java\de\tim\killcurrency\data\DataManager.java
1⤵
PID:5644

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\resources\config.yml
1⤵
PID:1444

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\resources\plugin.yml
1⤵
- Suspicious use of FindShellTrayWindow
PID:3408

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\pom.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:736
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\pom.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5576 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5556

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_kilcurrency-10.32-source.zip\kilcurrency-10.32\src\main\java\de\tim\killcurrency\command\KillCurrencyCommand.java
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 a42556b441c1905e24b49c018f80f2a53a0220ed1c5ab1401d4a674e28944d87
MD5 b3b6a79be9111d5afffd2ab71fb74589
SHA1 bb181e9d6138b164d4a03276a9031801f274efc3
SHA512 9c7273e38f4378ae960a3c7e5303738045f28bba3b5079941faf8c5b24b9ad4c602fd1881e1d7105d4617ba35e2c1dac631621057e1ce6c230eb230b1c3f76bf
TLSH
T149F09703C0BFF456AFA084EC429A067D2230A33A18200A19B278A1A648A4A78DE33428
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 a5da9d22c0446a650085a1b326384346dc33353fdc9c4a3f1850c190a67bbed5
MD5 6769951763c01127c220081c474b73e6
SHA1 9f64f6cdc27511ae28f14412f6169b16be381e0d
SHA512 2097f88c4c4879e23e9d7e22d88c98f7fd3d75152a9c79bf67a98c12a1dfd2c1d204470aef0b68a37cf933071f4ca59c43af99718d902c39f38fd932f9a83503
TLSH
T189E0C03811FE826FE9E8D43587D57925845AF022041C92F83AC88B04F702640BC13E29
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0071a5b824c69f9f8fd1c370daf89a470342be2d9c3584b898147c7badb22068
MD5 303aacb6b94cdb9fdedfdb0daad63e4d
SHA1 3262e620104fafb8380232c40e235ef741abd9c5
SHA512 7ef946d11217238d733f7776865b4bcef9fad817ad343d5c46e84fc338dce6c0290f8bc2e4dac605c8eac7302c67c736af416d3a4c7244929ade38da083779ca
TLSH
T10BD023103835B8C0D135003948108214510CC7432733820BF600840DDC3744063C19C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88591c08100dfa5b8d164cca9be4e1a5f0fa49eaae439e4dad8fdc7282e93ac7
MD5 b1d990f24c5ee7fa5a8408ff2ab9dd14
SHA1 6418d8cfefd7b697a52281bb1ab0b52e3d7d6977
SHA512 cb4e3374cbe9c979e2bfbfbabea2c837e0eebc63ed1a18f4d2b519db94afd374f7758c83f9b7f729e10e4cd860d5eb99683ad2412502434d07dda3037bb3e291
TLSH
T145712B3806960DECF35D033E6CF2065274B489E8F423EEFA3160E874E828F106609DB9
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b62067d85ee5164fb6dd1b499dacbba7171894c67ac876f9fd818b7283ed7912
MD5 7333c29b9fca8ef3d291aefb867cd5f8
SHA1 aa2c0d0494ad33f7eca2dae76809a94336135754
SHA512 3b2db6c7bab6a7b8bb6a6d03880f6cce59e254a62524946850c0f911fdb1e1b9fa7cf45d65cb637f7d18e7a98a5fa44c397fb2bc135ea16805e8378e16c99019
SSDEEP 3:MsEllllkEthXllkl2zExllgn3l/:/M/xT02z1t
TLSH
T1FC440404FFD00705C51010304033C3550F70D5110513F7433CD145137CC55444C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 aa6e3620c108d134f1b3baa55c9385e9e052a70929e0d9687c619b8ca6d00315
MD5 9e8fce52417d4ecf1ecae884507e9703
SHA1 2f7227662a0bcd6af7fce92f2d4640861c58ea4d
SHA512 b90fe9c3d0c2d5c84ff40eb4509f3aadf4daa684e650efe2a401689894988af8265aaa473834447134101e44c519fa343aef4750a3b7a55aa7443cac896d243b
TLSH
T154219BF7C3D5866EC95146F07A247E1BCE2D095442283C1B89E4EF5BD7E34A5F001A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b4c1b05827703478752505bc090d71c588956f4bf4fe8e53954608a1fba5501d
MD5 7adadbd41c55253c1bff7bc89d148e00
SHA1 7382162ab82c65d226c39e76a88edde21a01ab6f
SHA512 b1c7e0aba1e9f5641e0a03239f989617e247ee728bdf861311cfe82a8c5f867077200abff2c568e033fba4773845f8b6f5e94beb5cc6cde24a48815803bad5c3
SSDEEP 192:sxZrRfyM/jK1Ml8M92/fdsq4woIdpJHW6+WNGYCImLiCIgrJ:sxZrz12/fdsq4wZJHbGln9
TLSH
T1F342D811AA349977CCCBD209F955BF53D6F91572A2900E54A9FCCA0C04E6EED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0e4e16b5cc29c801ad7c1b9e36f58b7ff759672663fbe10f69518cb66e0c4c95
MD5 65c4b38790442ed9f511a5bf1c7ef375
SHA1 227292a665261ed16af6c5371cb79111f01119f7
SHA512 f1e727608e2e4dfc6ef3dd34f758a93e3ed7ea31c8d831777dc78554d3d86fb9344fcb2adcf8fbfe6a7bf993918fd48e2e3422d940e42c9780b1df4c56585985
SSDEEP 192:sxZrRfyM/jK1Ml8UQ792/fds+WpVE4HoIdpLHW6+WNGYCzaJZM8gIgbGJ:sxZrzqJ2/fds+WvE4HZLHbGzzW
TLSH
T12452D9126A349977CCDBD20DFA557F63D6F90472A2911E4499FCCA0C04E6EED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ac7f2a176e0721ce651897256023df9b9a7c1d9e73f31a10185e8b9f614f1461
MD5 7f1c57dad259cf2097ba1646565aaa09
SHA1 206bbee88933fc42c684744e718541c128c98a4e
SHA512 2ca51bc1b3025a938733b6e59d457c9c8ab8e101fe3cb2dc31853bb30b85b93ecc9466fb26ed45df67af7f91881f87b2d769f3fc3bce4828b44bbc87b4190c6f
SSDEEP 192:sxZrRfyM/jK1Ml8UQv92/fdsw4HoIdpLHW6+WNGYCRa7ZMiCIg5GJ:sxZrzql2/fdsw4HZLHbGXnA
TLSH
T1D752D712AA349977CCDBD209FA45BF53D6F95472A2900E44A9FCCB0C05E6EED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1dbc82393a3e34761a8ac266ab3b460d5fd4f14360fb52b221c191a1b867d59f
MD5 60bdee7b43ce948ab005d3dc9ebef937
SHA1 259687d804072c62899001510e19e78bb07287ac
SHA512 0a89823d48b652d076ae8f8c4b682772ed0a3de4b79a6ece9537e1ba1e2a92f2b0493954d1c9c755ef6c3be012cca26c519693ccbc1096a437df25e90a9617ba
SSDEEP 768:b88bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV0roRn:b88bqn+WvSCt6u1jaCZLbWVfRn
TLSH
T184D20B3B280CCB7E4F845E5CED266F962DD801CB6B988D4447FA894C03CB6EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 775cd1621dbb94b4c0a491872d0f8bc7fd6a4bbdf0da17c628ed53125d560802
MD5 17fd12bae6e4d992284fc4b4f9d4539c
SHA1 b6584744ced28929c5601071c92de75ece542ba7
SHA512 197d57d68757f58e1e32ed2b758d6f9c6a28b9dcfbcb4a55959f7378ea4995bcd3fe534656c3b640eade94771593fe3282919077d89d2c688c8bee925a97c49e
SSDEEP 24:KdXtVQfXtV3XtVkXtVVaXtVadXtVCXtVCXtV+4XtpXtl+XtQIjXtZXtdKiXtqhaW:K4aIfK3qAry1/IxKkY87yB4InK52ET
TLSH
T10691292732B7034128BD250DA2D996779E4531A33428A56F7BF820F55F6AE216CFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b0f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b0f7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a38795bb0e0932df2478927cef0699f96bb2dc606bc2d74e417703bcc268d8be
MD5 f6d5c07ddf39d0d6cb1ce69665e8a108
SHA1 3bbcb56f389928678d75f6c9c4ff7b1b9c46c219
SHA512 fb0ff08ceff9464c90fa4f0785fa0ec257986c8a157232f20c2a8076f7f3ef1369bfc6af386ed558f16454d80a1e4d8f2e8f8616cccb41ff0c0f135639a2ce93
SSDEEP 384:PtNn/s3n9SrsNa704r3Ea+qOfZOw+ITGT0ILQx95:Pj+98t0afOROw+i+0lv5
TLSH
T19B928D336938EC675DA29099F44B372B1EF440ABA5C63F9595EC6F0C04CE6AC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 0aef3d86c2f426bea52244d91301935a8c664a044e5f87c04bdf7b8ec85d2a7c
MD5 38b802fd1b86ec626f96f0fc5cc7a1a3
SHA1 6cca2ddacecbce5294447d9df221a6e91507b060
SHA512 b2a1db1301cb27e5e233054ff4f3fe41482d2227ba34842d5de7518d09317edbb66ada36ea9f8141a306212f32540bcd1a80933f0c22a7811c68130a14bfd897
SSDEEP 384:viFztNn/s3n9Sl3sNi8TUNTUlIlK04r3Ea+qOfZLw+ITGT0ILQx95:6Fzj+9a/wgm0afORLw+i+0lv5
TLSH
T1DBA27D335968DD7BAEA24A88F54A332B5EF400A7D5C67A95E6DC5F0C00CB6EC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 dab69d928843dc2a4345c9a9a570fc3c73d71b9392f5dad4ef4d9d6b22b4d445
MD5 fe7d4c545156bace7235fbe4d7c8b5cf
SHA1 e13889d17381e4e63814cfba567ce2c1a6565a22
SHA512 0449ae07266ed3d22c4bc0d69b5c50137bdb91bb61f8b81e4bf004e6d610155df02465fd0d23fa95b3d1f81217951f44c87776353f7d13fa737f5c9b4728e4ed
SSDEEP 384:viFPtNn/s3n9SlGsNh8TUNTUlIlK0Oo3Ea+qOfZiiovFA8BnA/oz5mkc9ITGT0IA:6FPj+97awgh0afORib68rz5U9i+0lv5
TLSH
T104D26B7398588DEB58A0DAC8A54AF2172DB00177C58A6A9CE2FC7E3C309F5FC4346D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e33d717893b5053cc9cd688e4b9cc028b86890550c5e3ac9e4d902f14e8afebf
MD5 3138a2be5d211ce1386aea63ecedd7da
SHA1 e4946028d471f4563e33a50ba992ba039f9a836c
SHA512 a422c4baf6882abd635b1a84f237d0088927662c8735e8910b5bbef5dbbe276ad326b9b3bffb0fca823fb6904cb6679ffa0d39d306d979bf2333d224843ab70a
SSDEEP 384:ZtNn/s3n9SrsNaK04r3Ea+qOfZOw+ITGT0ILQx95:Zj+98G0afOROw+i+0lv5
TLSH
T103928C336938DC675DA29099F44B372B5EF440ABA5C63F9595EC6F0C04CE6AC230BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8daf4c1d1cc6f8c24aeb2ed9ae7d4337cebed3da2248e189acee9cdf1ec35011
MD5 7a111bcf4b9826882742d80fa891d7a1
SHA1 ed8e0eeb0d98c977a25218fa765aeb48eb5676b7
SHA512 c5d223f35d9e19e34f673289462154d20cc999c6cc66581b24c54bac5366eb10181f98c4f934e10d24c581f3d86c5fa69a2d9d14f700e0aa6facab62e0ff40d2
SSDEEP 192:4ONr6DbDQmiUykUFBa+jeOmEtmy8eNzwHqZU6:4ONr69UFBa+qOfZDw+U6
TLSH
T14D121A36787C9C775DE29588F48736275EE4516BEA8A7B90D5CC2F0C01DFA9C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9c2d589a32ecbe0ddeac6276f9204e66d1e86908be1b7c1adeec9642fcc0ce9b
MD5 8c51ab0974eff087050079e6a0bfbd02
SHA1 f1445676ae206db63f31c5b57f9475f633528755
SHA512 6d157de6a7093b624f315f683033fe26ac3419f2e0604ee0141e96f07ad2d61063f6a144f9f4528b24379268faae3ed56cb61742777ba472ab15b5e3dc90cc1c
SSDEEP 192:vONI6Db6QmiUyUUHBa+jeOmEtm8RgwdDU6:vONI6u+HBa+qOfWwNU6
TLSH
T1F302E835697C6CB79EB2AE49F88737276F94203BD9562F84DAD81F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

RecoveryStore.{FF5D0398-6C8D-11F1-B995-F23C4AB2DE8F}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FF5D0398-6C8D-11F1-B995-F23C4AB2DE8F}.dat
Size 5KB
SHA256 c2bb75c0bfd27804cac24edce8c0e89caa8712cebbb16133e37b1e940b13fa9b
MD5 ea7b8a93dfd03de9c0e1468d56c70f69
SHA1 1b264dd3db65317d4445ae91e6b7b99647285e89
SHA512 32b0cca205aee321e0141fad6a6fe9f12e904bc0964eb5d03289ae9342b889b08b333793ac4e9c193c1128b9d27c6199c053cf3cd0d24df0cc92a3e5fdab0ce2
SSDEEP 24:rEQG//z827G//z82Q82qMJC482qMJh9lW5M/Qy9lW5F:rjG/b8YG/b8X8Tn48TP5M4r5F
TLSH
T1BEC1C564F36AE091EDA83A31EDB1C285B736BE706E44F20734A2370F79361C19B92495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 157782a28e4283dc81a11361c5626a23c529db7ff863c68c1a8484c729f74106
MD5 f9964c258db2871eef0edd0d639ec715
SHA1 911eea91fefb1e2d0e9b1de4a886007b3b4bea0b
SHA512 22ae69959ebbff3299457c781a1d49177dfb6f846e8ee2489da3e323eefa88e90cc9bd1c29ee51ffd95cf904d62214a4306463f2a9998d40f8974e124eac7730
TLSH
T1DC413758AAF92148B3B76E5AABF6686D843FB9372F16D49D00010D4E0623B40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CIEGT0C5\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kilcurrency-10.32-source.zip.crdownload

Path C:\Users\Admin\Downloads\kilcurrency-10.32-source.zip.crdownload
Size 22KB
SHA256 ec3fc1f07781c0394d71418560add5cc5f42e4879b87f9d6b77e2ebcbbe90576
MD5 e1302af1e8d6b7c9ef55e2ac9b17e374
SHA1 ad4141d4388efaa970b9452fc112f8247346c3eb
SHA512 7684853898e311bd1329ff30b4b2129ac2b5e3841e09386ed0f66793cfdbac877a1b03f6b3f103c23e52b1f27f451820897bb6b198d1343d6fc8b0fff45f751c
SSDEEP 384:FXTSHI26+q5hVA2+zp825R0y11mp2VEecgjIdVts5KyOViY2nxrbP5n2qhXaBOx9:fhxeX1q29M9sYyOViY2n5d5T9
TLSH
T1E9A24B3CC108A5F6C53EA57DE42A036E6A739A3E341262D009CC99673747918AF3D93F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/736-425-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/736-432-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/736-433-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/736-430-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/736-431-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/736-429-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/736-428-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/736-427-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/736-426-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/3060-200-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/3060-201-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/3060-203-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/3060-204-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/3060-205-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/3060-206-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/3060-208-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/3060-207-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download

memory/3060-202-0x00007FFE7A550000-0x00007FFE7A560000-memory.dmp

Download