URL:

https://mega.nz/file/KW5z3RxR#VK12T22AyB3Y1Y9-wZ9JkcuhR_KFjRR2yJg_SEdcW2E?uel=file.zip

Full analysis: https://app.any.run/tasks/be7f3105-fa36-417c-b4cc-780412134489
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: December 14, 2023, 07:49:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
privateloader
evasion
loader
stealc
opendir
lumma
smoke
smokeloader
sinkhole
amadey
botnet
ransomware
stop
miner
risepro
redline
socks5systemz
proxy
g0njxa
Indicators:
MD5:

007E2A08CB5CAEE709CE96064AF73426

SHA1:

2441E3B8F87D45E10F8CDFDE7F129C5AA543F747

SHA256:

B58C2E5598A568D84C591D5EEA97E4DB21DE36246F85C10D4F0E026567F866C8

SSDEEP:

3:N8X/irg2CUXxEcQaS/RGQl6usH3fQAMYV:2ig2CUXYB36usvQ3YV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • setup.exe (PID: 7096)
      • setup.exe (PID: 2116)
      • WW13_64.exe (PID: 4508)
      • R9xjSNTSHQc5MeswF4lWjJ5r.exe (PID: 6148)
      • sHt80OJEDP7kj8X5QS49OXo9.exe (PID: 5964)
      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • sHt80OJEDP7kj8X5QS49OXo9.tmp (PID: 6360)
      • DTPanelQT.exe (PID: 7368)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • zieHLA8NQI852wSb4lC7UHP2.exe (PID: 7836)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • aGwqlXg4MsSR82Qts0Wn9hrw.exe (PID: 7376)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • vQ6DLHi3GC4EYXblv6AP2N2V.exe (PID: 6044)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
      • LGm3L21BXa.exe (PID: 1452)
      • LGm3L21BXa.tmp (PID: 3860)
      • updater.exe (PID: 2608)
    • Connects to the CnC server

      • WW13_64.exe (PID: 6504)
      • WW13_64.exe (PID: 4508)
      • ZzPTu52Dp3p6gXRktdO1e23F.exe (PID: 880)
      • jveESZmOmFEXAAXKAFgccWxe.exe (PID: 8168)
      • 㡮癄稵䔶坮确䑺捺㍢ (PID: 7216)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • explorer.exe (PID: 4428)
      • RegSvcs.exe (PID: 7896)
      • explorer.exe (PID: 6432)
      • explorer.exe (PID: 7784)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • DTPanelQT.exe (PID: 7492)
    • PRIVATELOADER has been detected (SURICATA)

      • WW13_64.exe (PID: 6504)
      • WW13_64.exe (PID: 4508)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
    • Actions looks like stealing of personal data

      • WW13_64.exe (PID: 4508)
      • 㡮癄稵䔶坮确䑺捺㍢ (PID: 7216)
      • jveESZmOmFEXAAXKAFgccWxe.exe (PID: 8168)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • RegSvcs.exe (PID: 7896)
      • explorer.exe (PID: 6432)
    • STEALC has been detected (SURICATA)

      • ZzPTu52Dp3p6gXRktdO1e23F.exe (PID: 880)
    • Runs injected code in another process

      • KiJ3hN2hayADiMWAVzxMucME.exe (PID: 1416)
    • Application was injected by another process

      • explorer.exe (PID: 4428)
    • Creates a writable file in the system directory

      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • powershell.exe (PID: 5796)
    • Create files in the Startup directory

      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
    • Uses Task Scheduler to run other applications

      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • sHt80OJEDP7kj8X5QS49OXo9.tmp (PID: 6360)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 3952)
      • explorer.exe (PID: 4428)
    • Uses Task Scheduler to autorun other applications

      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
    • LUMMA has been detected (SURICATA)

      • jveESZmOmFEXAAXKAFgccWxe.exe (PID: 8168)
      • 㡮癄稵䔶坮确䑺捺㍢ (PID: 7216)
      • RegSvcs.exe (PID: 7896)
    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 4428)
      • explorer.exe (PID: 6432)
      • explorer.exe (PID: 7784)
    • Steals credentials from Web Browsers

      • explorer.exe (PID: 6432)
    • Unusual connection from system programs

      • explorer.exe (PID: 6432)
    • Changes the autorun value in the registry

      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 3952)
    • AMADEY has been detected (SURICATA)

      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 3952)
    • Modifies files in the Chrome extension folder

      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
    • Adds path to the Windows Defender exclusion list

      • explorer.exe (PID: 4428)
    • Stop is detected

      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 4504)
    • Starts CMD.EXE for self-deleting

      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
    • RISEPRO has been detected (YARA)

      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
    • REDLINE has been detected (YARA)

      • AppLaunch.exe (PID: 3368)
    • SOCKS5SYSTEMZ has been detected (SURICATA)

      • DTPanelQT.exe (PID: 7492)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4880)
      • setup.exe (PID: 7096)
      • setup.exe (PID: 2116)
      • sHt80OJEDP7kj8X5QS49OXo9.tmp (PID: 6360)
      • zieHLA8NQI852wSb4lC7UHP2.exe (PID: 7836)
      • LGm3L21BXa.tmp (PID: 3860)
    • The process drops C-runtime libraries

      • setup.exe (PID: 7096)
      • setup.exe (PID: 2116)
    • Loads Python modules

      • WW13_64.exe (PID: 6504)
      • WW13_64.exe (PID: 4508)
    • Connects to the server without a host name

      • WW13_64.exe (PID: 6504)
      • WW13_64.exe (PID: 4508)
      • ZzPTu52Dp3p6gXRktdO1e23F.exe (PID: 880)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 3952)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
    • Checks for external IP

      • WW13_64.exe (PID: 4508)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
    • Executes application which crashes

      • KKEb5KiRt4h8VfeXgS2GBXIS.exe (PID: 896)
      • ZzPTu52Dp3p6gXRktdO1e23F.exe (PID: 880)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
    • Drops 7-zip archiver for unpacking

      • WW13_64.exe (PID: 4508)
      • sHt80OJEDP7kj8X5QS49OXo9.tmp (PID: 6360)
      • LGm3L21BXa.tmp (PID: 3860)
    • Process requests binary or script from the Internet

      • WW13_64.exe (PID: 4508)
    • Starts CMD.EXE for commands execution

      • WW13_64.exe (PID: 4508)
      • R9xjSNTSHQc5MeswF4lWjJ5r.exe (PID: 6148)
      • explorer.exe (PID: 4428)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
    • Executing commands from a ".bat" file

      • R9xjSNTSHQc5MeswF4lWjJ5r.exe (PID: 6148)
    • Reads the date of Windows installation

      • R9xjSNTSHQc5MeswF4lWjJ5r.exe (PID: 6148)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 3952)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
    • Application launched itself

      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 6696)
      • jveESZmOmFEXAAXKAFgccWxe.exe (PID: 7692)
      • explorer.exe (PID: 4428)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 3112)
    • The process checks if it is being run in the virtual environment

      • rundll32.exe (PID: 5908)
      • rundll32.exe (PID: 2764)
    • Checks Windows Trust Settings

      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 4504)
    • Reads the Windows owner or organization settings

      • sHt80OJEDP7kj8X5QS49OXo9.tmp (PID: 6360)
      • LGm3L21BXa.tmp (PID: 3860)
    • Reads security settings of Internet Explorer

      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 4504)
    • Process drops SQLite DLL files

      • sHt80OJEDP7kj8X5QS49OXo9.tmp (PID: 6360)
      • LGm3L21BXa.tmp (PID: 3860)
    • Connects to unusual port

      • 1b87UN0D0yUAptLOc31oMQiH.exe (PID: 6712)
      • Bn3Y5V0xUss2ym9T68bDhTaG.exe (PID: 6176)
      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • explorer.exe (PID: 2404)
      • AppLaunch.exe (PID: 3368)
      • DTPanelQT.exe (PID: 7492)
    • Starts application with an unusual extension

      • zieHLA8NQI852wSb4lC7UHP2.exe (PID: 7836)
    • Reads the BIOS version

      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
    • Searches for installed software

      • jveESZmOmFEXAAXKAFgccWxe.exe (PID: 8168)
      • 㡮癄稵䔶坮确䑺捺㍢ (PID: 7216)
      • RegSvcs.exe (PID: 7896)
      • LGm3L21BXa.tmp (PID: 3860)
    • Loads DLL from Mozilla Firefox

      • explorer.exe (PID: 7784)
    • Uses ICACLS.EXE to modify access control lists

      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
    • Starts POWERSHELL.EXE for commands execution

      • explorer.exe (PID: 4428)
    • Script adds exclusion path to Windows Defender

      • explorer.exe (PID: 4428)
    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 5908)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 5144)
      • cmd.exe (PID: 5544)
    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 3056)
      • cmd.exe (PID: 3708)
    • The process executes via Task Scheduler

      • updater.exe (PID: 2608)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 488)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 6264)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 7484)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 6752)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 5148)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 5100)
      • dbcgshj (PID: 3180)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 5400)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6880)
    • The process creates files with name similar to system file names

      • powershell.exe (PID: 5796)
    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 2608)
  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 1276)
      • setup.exe (PID: 7096)
      • WW13_64.exe (PID: 6504)
      • setup.exe (PID: 2116)
      • WW13_64.exe (PID: 4508)
      • KKEb5KiRt4h8VfeXgS2GBXIS.exe (PID: 896)
      • KiJ3hN2hayADiMWAVzxMucME.exe (PID: 1416)
      • ZzPTu52Dp3p6gXRktdO1e23F.exe (PID: 880)
      • R9xjSNTSHQc5MeswF4lWjJ5r.exe (PID: 6148)
      • Bn3Y5V0xUss2ym9T68bDhTaG.exe (PID: 6176)
      • 1b87UN0D0yUAptLOc31oMQiH.exe (PID: 6712)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 6696)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • h662quGI9oQwZm68YiQjblSe.exe (PID: 6344)
      • sHt80OJEDP7kj8X5QS49OXo9.tmp (PID: 6360)
      • sHt80OJEDP7kj8X5QS49OXo9.exe (PID: 5964)
      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • DTPanelQT.exe (PID: 7368)
      • DTPanelQT.exe (PID: 7492)
      • jveESZmOmFEXAAXKAFgccWxe.exe (PID: 7692)
      • zieHLA8NQI852wSb4lC7UHP2.exe (PID: 7836)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • jveESZmOmFEXAAXKAFgccWxe.exe (PID: 8168)
      • 㡮癄稵䔶坮确䑺捺㍢ (PID: 7216)
      • aGwqlXg4MsSR82Qts0Wn9hrw.exe (PID: 7376)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • RegSvcs.exe (PID: 7896)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 3952)
      • vQ6DLHi3GC4EYXblv6AP2N2V.exe (PID: 6044)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 3112)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 4504)
      • updater.exe (PID: 2608)
      • LGm3L21BXa.exe (PID: 1452)
      • LGm3L21BXa.tmp (PID: 3860)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 488)
      • AppLaunch.exe (PID: 3368)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 6264)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 7484)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 6752)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 5100)
      • dbcgshj (PID: 3180)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 5400)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 5148)
    • Application launched itself

      • msedge.exe (PID: 3752)
    • The process uses the downloaded file

      • msedge.exe (PID: 2816)
      • msedge.exe (PID: 3752)
      • WinRAR.exe (PID: 4880)
    • Reads the computer name

      • identity_helper.exe (PID: 1276)
      • setup.exe (PID: 7096)
      • WW13_64.exe (PID: 4508)
      • ZzPTu52Dp3p6gXRktdO1e23F.exe (PID: 880)
      • KKEb5KiRt4h8VfeXgS2GBXIS.exe (PID: 896)
      • R9xjSNTSHQc5MeswF4lWjJ5r.exe (PID: 6148)
      • Bn3Y5V0xUss2ym9T68bDhTaG.exe (PID: 6176)
      • 1b87UN0D0yUAptLOc31oMQiH.exe (PID: 6712)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • sHt80OJEDP7kj8X5QS49OXo9.tmp (PID: 6360)
      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • DTPanelQT.exe (PID: 7368)
      • zieHLA8NQI852wSb4lC7UHP2.exe (PID: 7836)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • jveESZmOmFEXAAXKAFgccWxe.exe (PID: 8168)
      • 㡮癄稵䔶坮确䑺捺㍢ (PID: 7216)
      • aGwqlXg4MsSR82Qts0Wn9hrw.exe (PID: 7376)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • setup.exe (PID: 2116)
      • RegSvcs.exe (PID: 7896)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 3952)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 4504)
      • LGm3L21BXa.tmp (PID: 3860)
      • AppLaunch.exe (PID: 3368)
      • DTPanelQT.exe (PID: 7492)
    • Create files in a temporary directory

      • setup.exe (PID: 7096)
      • setup.exe (PID: 2116)
      • R9xjSNTSHQc5MeswF4lWjJ5r.exe (PID: 6148)
      • sHt80OJEDP7kj8X5QS49OXo9.tmp (PID: 6360)
      • sHt80OJEDP7kj8X5QS49OXo9.exe (PID: 5964)
      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • zieHLA8NQI852wSb4lC7UHP2.exe (PID: 7836)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • aGwqlXg4MsSR82Qts0Wn9hrw.exe (PID: 7376)
      • explorer.exe (PID: 6432)
      • LGm3L21BXa.exe (PID: 1452)
      • LGm3L21BXa.tmp (PID: 3860)
    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4880)
      • msedge.exe (PID: 6888)
      • explorer.exe (PID: 4428)
    • Checks proxy server information

      • WW13_64.exe (PID: 6504)
      • WW13_64.exe (PID: 4508)
      • ZzPTu52Dp3p6gXRktdO1e23F.exe (PID: 880)
      • WerFault.exe (PID: 5152)
      • WerFault.exe (PID: 2868)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • explorer.exe (PID: 4428)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • explorer.exe (PID: 7784)
      • explorer.exe (PID: 6432)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 3952)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 4504)
      • DTPanelQT.exe (PID: 7492)
    • The executable file from the user directory is run by the CMD process

      • KKEb5KiRt4h8VfeXgS2GBXIS.exe (PID: 896)
      • R9xjSNTSHQc5MeswF4lWjJ5r.exe (PID: 6148)
      • ZzPTu52Dp3p6gXRktdO1e23F.exe (PID: 880)
      • KiJ3hN2hayADiMWAVzxMucME.exe (PID: 1416)
      • Bn3Y5V0xUss2ym9T68bDhTaG.exe (PID: 6176)
      • 1b87UN0D0yUAptLOc31oMQiH.exe (PID: 6712)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 6696)
      • h662quGI9oQwZm68YiQjblSe.exe (PID: 6344)
      • sHt80OJEDP7kj8X5QS49OXo9.exe (PID: 5964)
      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • jveESZmOmFEXAAXKAFgccWxe.exe (PID: 7692)
      • zieHLA8NQI852wSb4lC7UHP2.exe (PID: 7836)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • aGwqlXg4MsSR82Qts0Wn9hrw.exe (PID: 7376)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
    • Process checks computer location settings

      • R9xjSNTSHQc5MeswF4lWjJ5r.exe (PID: 6148)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 3952)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
    • Reads the machine GUID from the registry

      • Bn3Y5V0xUss2ym9T68bDhTaG.exe (PID: 6176)
      • 1b87UN0D0yUAptLOc31oMQiH.exe (PID: 6712)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • aGwqlXg4MsSR82Qts0Wn9hrw.exe (PID: 7376)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 4504)
      • AppLaunch.exe (PID: 3368)
    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6312)
      • WerFault.exe (PID: 5152)
      • WerFault.exe (PID: 5504)
      • WerFault.exe (PID: 6936)
      • WerFault.exe (PID: 7136)
      • WerFault.exe (PID: 2728)
      • WerFault.exe (PID: 2868)
      • WerFault.exe (PID: 5036)
      • DqT7nYPunqBMkuRLL7edn9lt.exe (PID: 1084)
      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • explorer.exe (PID: 4428)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • aGwqlXg4MsSR82Qts0Wn9hrw.exe (PID: 7376)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 4504)
      • WerFault.exe (PID: 3116)
      • WerFault.exe (PID: 5372)
      • WerFault.exe (PID: 4944)
    • Reads the software policy settings

      • WerFault.exe (PID: 5152)
      • WerFault.exe (PID: 2868)
      • 5yJ27pEysT6fJzdq6LJ09com.exe (PID: 2856)
      • IBAKBWA1bGabG21m0w3Vytqc.exe (PID: 7652)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
    • Creates files in the program directory

      • sHt80OJEDP7kj8X5QS49OXo9.tmp (PID: 6360)
      • uO3Nuz5ET3PKxtPnAXeI4Rex.exe (PID: 4320)
      • DTPanelQT.exe (PID: 7368)
      • mDhAmrjuJ0RbtfDpFce1HKra.exe (PID: 7912)
      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • vQ6DLHi3GC4EYXblv6AP2N2V.exe (PID: 6044)
      • LGm3L21BXa.tmp (PID: 3860)
      • DTPanelQT.exe (PID: 7492)
      • updater.exe (PID: 2608)
    • Process checks are UAC notifies on

      • 7nsBhSw3KD_7P95n7b_NuX9p.exe (PID: 7816)
      • Nrpb1aPFZTZwcMYNO3f044Q6.exe (PID: 7696)
    • Reads Environment values

      • lV3SG2WiNRxQz1eD7GGPcp15.exe (PID: 3952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RisePro

(PID) Process(4320) uO3Nuz5ET3PKxtPnAXeI4Rex.exe
C2193.233.132.51
(PID) Process(7912) mDhAmrjuJ0RbtfDpFce1HKra.exe
C2195.20.16.45

RedLine

(PID) Process(3368) AppLaunch.exe
C2 (1)45.15.156.187:23929
BotnetLogsDiller Cloud (Telegram: @logsdillabot)
Options
ErrorMessage
Keys
XorScuffs
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
366
Monitored processes
205
Malicious processes
58
Suspicious processes
3

Behavior graph

Click at the process to see the details
start inject msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs msedge.exe no specs msedge.exe no specs setup.exe no specs setup.exe #PRIVATELOADER ww13_64.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs setup.exe no specs setup.exe #PRIVATELOADER ww13_64.exe msedge.exe no specs cmd.exe no specs conhost.exe no specs #STEALC zzptu52dp3p6gxrktdo1e23f.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs kkeb5kirt4h8vfexgs2gbxis.exe werfault.exe cmd.exe no specs conhost.exe no specs kij3hn2hayadimwavzxmucme.exe no specs werfault.exe cmd.exe no specs conhost.exe no specs r9xjsntshqc5meswf4lwjj5r.exe no specs cmd.exe no specs conhost.exe no specs control.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs bn3y5v0xuss2ym9t68bdhtag.exe cmd.exe no specs conhost.exe no specs 1b87un0d0yuaptloc31omqih.exe cmd.exe no specs conhost.exe no specs dqt7nypunqbmkurll7edn9lt.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs 5yj27peyst6fjzdq6lj09com.exe no specs werfault.exe no specs 5yj27peyst6fjzdq6lj09com.exe cmd.exe no specs conhost.exe no specs h662qugi9oqwzm68yiqjblse.exe no specs cmd.exe no specs conhost.exe no specs sht80ojedp7kj8x5qs49oxo9.exe no specs sht80ojedp7kj8x5qs49oxo9.tmp no specs cmd.exe no specs conhost.exe no specs #RISEPRO uo3nuz5et3pkxtpnaxei4rex.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs dtpanelqt.exe no specs conhost.exe no specs net.exe no specs #SOCKS5SYSTEMZ dtpanelqt.exe conhost.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs jveeszmomfexaaxkafgccwxe.exe no specs cmd.exe no specs conhost.exe no specs ziehla8nqi852wsb4lc7uhp2.exe no specs cmd.exe no specs conhost.exe no specs #RISEPRO mdhamrjuj0rbtfdpfce1hkra.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs #LUMMA jveeszmomfexaaxkafgccwxe.exe #LUMMA 㡮癄稵䔶坮确䑺捺㍢ cmd.exe no specs conhost.exe no specs agwqlxg4mssr82qts0wn9hrw.exe no specs cmd.exe no specs conhost.exe no specs 7nsbhsw3kd_7p95n7b_nux9p.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs #PRIVATELOADER nrpb1apfztzwcmyno3f044q6.exe #PRIVATELOADER ibakbwa1bgabg21m0w3vytqc.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs #SMOKE explorer.exe #LUMMA regsvcs.exe #SMOKE explorer.exe #SMOKE explorer.exe #AMADEY lv3sg2winrxqz1ed7ggpcp15.exe schtasks.exe no specs conhost.exe no specs vq6dlhi3gc4eyxblv6ap2n2v.exe no specs icacls.exe no specs chrome.exe no specs 5yj27peyst6fjzdq6lj09com.exe no specs powershell.exe conhost.exe no specs #STOP 5yj27peyst6fjzdq6lj09com.exe rundll32.exe no specs rundll32.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe powershell.exe conhost.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe conhost.exe no specs updater.exe no specs lgm3l21bxa.exe no specs lgm3l21bxa.tmp no specs werfault.exe no specs werfault.exe no specs cmd.exe no specs werfault.exe no specs conhost.exe no specs taskkill.exe no specs powershell.exe conhost.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powershell.exe conhost.exe no specs lv3sg2winrxqz1ed7ggpcp15.exe no specs conhost.exe explorer.exe applaunch.exe no specs #REDLINE applaunch.exe lv3sg2winrxqz1ed7ggpcp15.exe no specs filecoauth.exe no specs lv3sg2winrxqz1ed7ggpcp15.exe no specs lv3sg2winrxqz1ed7ggpcp15.exe no specs lv3sg2winrxqz1ed7ggpcp15.exe no specs lv3sg2winrxqz1ed7ggpcp15.exe no specs dbcgshj no specs lv3sg2winrxqz1ed7ggpcp15.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1668 --field-trial-handle=1964,i,16138432378268198214,11264646325332633625,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
111.0.1661.62
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\111.0.1661.62\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
488"C:\Users\admin\Pictures\Minor Policy\lV3SG2WiNRxQz1eD7GGPcp15.exe"C:\Users\admin\Pictures\Minor Policy\lV3SG2WiNRxQz1eD7GGPcp15.exesvchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\pictures\minor policy\lv3sg2winrxqz1ed7ggpcp15.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
528"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1964,i,16138432378268198214,11264646325332633625,131072 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
111.0.1661.62
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\111.0.1661.62\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
596"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2464 --field-trial-handle=1964,i,16138432378268198214,11264646325332633625,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
111.0.1661.62
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\111.0.1661.62\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
872"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5536 --field-trial-handle=1964,i,16138432378268198214,11264646325332633625,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
111.0.1661.62
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\111.0.1661.62\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
880"C:\Users\admin/Documents\Minor Policy\ZzPTu52Dp3p6gXRktdO1e23F.exe" ""C:\Users\admin\Documents\Minor Policy\ZzPTu52Dp3p6gXRktdO1e23F.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\documents\minor policy\zzptu52dp3p6gxrktdo1e23f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
896"C:\Users\admin/Documents\Minor Policy\KKEb5KiRt4h8VfeXgS2GBXIS.exe" ""C:\Users\admin\Documents\Minor Policy\KKEb5KiRt4h8VfeXgS2GBXIS.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3762504530
Modules
Images
c:\users\admin\documents\minor policy\kkeb5kirt4h8vfexgs2gbxis.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1084"C:\Users\admin/Documents\Minor Policy\DqT7nYPunqBMkuRLL7edn9lt.exe" ""C:\Users\admin\Documents\Minor Policy\DqT7nYPunqBMkuRLL7edn9lt.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1998805824
Modules
Images
c:\users\admin\documents\minor policy\dqt7nypunqbmkurll7edn9lt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
75 449
Read events
75 018
Write events
309
Delete events
122

Modification events

(PID) Process:(3752) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3752) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3752) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3752) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3752) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(3752) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3752) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
(PID) Process:(3752) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
BC8CC635B5602F00
(PID) Process:(3752) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3752) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:urlstats
Value:
0
Executable files
321
Suspicious files
259
Text files
197
Unknown types
0

Dropped files

PID
Process
Filename
Type
3752msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF14e444.TMP
MD5:
SHA256:
3752msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old
MD5:
SHA256:
3752msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF14e444.TMP
MD5:
SHA256:
3752msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old
MD5:
SHA256:
3752msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF14e405.TMP
MD5:
SHA256:
3752msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old
MD5:
SHA256:
3752msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State~RF14e3b7.TMPbinary
MD5:24FF6E5F1AF64C692D70F012A3E20124
SHA256:58CCCC4BB42783B62792010C13BA4A724FCB140F082D7996626F17E533E20452
3752msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RF14e415.TMPtext
MD5:D480C74EE54A756F9A0AE4C42DC88EE1
SHA256:61F10687C404E33B9D61AB49E0B9FCD809F3DA06E7471164BF8DA209A05DFF78
3752msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Last Versiontext
MD5:D6DB6EA02FE506F2DA98F1C137243587
SHA256:126173A7D7D0F54A9FCE5465180BC49DB023E723A41BB55A0F9497BE76FBAA28
3752msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local Statebinary
MD5:945543C71C06061EA24A252AD024CC58
SHA256:E9E2449EB7A0A5DDAA1E87D291FF95CFF8739E2458F7AC46AEA3ED2714E899F5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
298
TCP/UDP connections
6 570
DNS requests
173
Threats
6 560

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2556
svchost.exe
GET
206
87.248.205.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/26b10680-9c99-4cf8-93c0-fca56709a250?P1=1703084393&P2=404&P3=2&P4=jW0H8LoGs3n2lTnS%2f9sPkkTTj4wiXHOUgKaRbkrTWnJ4Fa1lajrpm6JkkTki57PjJCbvsDuy2Gj4eZi%2bocM2Ow%3d%3d
unknown
binary
1.09 Kb
unknown
2556
svchost.exe
HEAD
200
87.248.205.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/26b10680-9c99-4cf8-93c0-fca56709a250?P1=1703084393&P2=404&P3=2&P4=jW0H8LoGs3n2lTnS%2f9sPkkTTj4wiXHOUgKaRbkrTWnJ4Fa1lajrpm6JkkTki57PjJCbvsDuy2Gj4eZi%2bocM2Ow%3d%3d
unknown
unknown
2556
svchost.exe
GET
206
87.248.205.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/36151317-54d8-4560-8ee4-12ea19526cd0?P1=1703084493&P2=404&P3=2&P4=DAfrMd%2fKvkPcVooMElEAGdWRUQ7awgrJVBqV6%2fd6eReTj%2bXlCKtIVXE4lF4mmg8yvbcyGhVRwBS%2bfMiI7nsdqg%3d%3d
unknown
binary
101 Kb
unknown
2556
svchost.exe
HEAD
200
87.248.205.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b6784df7-c744-43b7-ad1e-24d3b6b3457d?P1=1703084393&P2=404&P3=2&P4=gIodB0yTWl%2fQnCz8J5t9kYeAUugFNr10xFGaAk6ME6VqY8Ed2eTYk9OFQhWbnTlQ4yaSQoEMQ39xvpGVCQNR6A%3d%3d
unknown
binary
48.6 Kb
unknown
2556
svchost.exe
GET
206
87.248.205.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/26b10680-9c99-4cf8-93c0-fca56709a250?P1=1703084393&P2=404&P3=2&P4=jW0H8LoGs3n2lTnS%2f9sPkkTTj4wiXHOUgKaRbkrTWnJ4Fa1lajrpm6JkkTki57PjJCbvsDuy2Gj4eZi%2bocM2Ow%3d%3d
unknown
binary
236 b
unknown
6504
WW13_64.exe
GET
195.20.16.45:80
http://195.20.16.45/api/tracemap.php
unknown
unknown
2556
svchost.exe
GET
206
87.248.205.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/26b10680-9c99-4cf8-93c0-fca56709a250?P1=1703084393&P2=404&P3=2&P4=jW0H8LoGs3n2lTnS%2f9sPkkTTj4wiXHOUgKaRbkrTWnJ4Fa1lajrpm6JkkTki57PjJCbvsDuy2Gj4eZi%2bocM2Ow%3d%3d
unknown
binary
3.30 Kb
unknown
6504
WW13_64.exe
GET
200
46.35.111.154:80
http://46.35.111.154/UserCheck/PortalMain?IID=4ABE1015-5037-4E91-63A5-13E80B548392&origUrl=aHR0cDovLzE5NS4yMC4xNi40NS9hcGkvdHJhY2VtYXAucGhw
unknown
html
106 Kb
unknown
2556
svchost.exe
GET
206
87.248.205.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/26b10680-9c99-4cf8-93c0-fca56709a250?P1=1703084393&P2=404&P3=2&P4=jW0H8LoGs3n2lTnS%2f9sPkkTTj4wiXHOUgKaRbkrTWnJ4Fa1lajrpm6JkkTki57PjJCbvsDuy2Gj4eZi%2bocM2Ow%3d%3d
unknown
binary
9.81 Kb
unknown
6504
WW13_64.exe
GET
200
46.35.111.154:80
http://46.35.111.154/UserCheck/PortalMain?IID=DE5C2409-4C10-75E6-B8CA-F22DF6071B93&origUrl=aHR0cDovLzc3LjEwNS4xNDcuMTMwL2FwaS90cmFjZW1hcC5waHA
unknown
html
106 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
3240
svchost.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3752
msedge.exe
239.255.255.250:1900
whitelisted
528
msedge.exe
31.216.144.5:443
mega.nz
Datacenter Luxembourg S.A.
LU
unknown
528
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
528
msedge.exe
20.105.95.163:443
nav-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
528
msedge.exe
51.104.176.40:443
data-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3764
svchost.exe
239.255.255.250:1900
whitelisted
528
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
528
msedge.exe
89.44.169.134:443
eu.static.mega.co.nz
Datacenter Luxembourg S.A.
LU
unknown

DNS requests

Domain
IP
Reputation
mega.nz
  • 31.216.144.5
  • 31.216.145.5
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.105.95.163
whitelisted
data-edge.smartscreen.microsoft.com
  • 51.104.176.40
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
eu.static.mega.co.nz
  • 89.44.169.134
  • 89.44.169.132
  • 66.203.127.11
  • 66.203.124.37
  • 66.203.127.13
shared
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.19.96.90
  • 2.19.96.75
  • 2.19.96.98
  • 2.19.96.80
  • 2.19.96.97
  • 2.19.96.88
  • 2.19.96.82
  • 2.19.96.96
  • 2.19.96.91
  • 104.126.37.176
  • 104.126.37.162
  • 104.126.37.177
  • 104.126.37.154
  • 104.126.37.161
  • 104.126.37.153
  • 104.126.37.155
  • 104.126.37.163
  • 104.126.37.168
  • 92.122.215.53
  • 92.122.215.65
  • 2.20.142.251
  • 2.20.142.187
  • 2.20.142.3
  • 2.20.142.180
  • 92.122.215.57
  • 2.20.142.4
  • 2.20.142.154
  • 2.19.96.121
  • 2.19.96.123
  • 2.19.96.120
  • 2.19.96.122
  • 2.19.96.8
  • 2.19.96.130
  • 2.19.96.16
  • 2.19.96.128
  • 104.126.37.171
  • 104.126.37.178
  • 104.126.37.184
  • 104.126.37.170
  • 104.126.37.186
  • 104.126.37.123
  • 104.126.37.179
  • 104.126.37.185
  • 104.126.37.130
  • 104.126.37.136
  • 104.126.37.146
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.144
  • 104.126.37.137
  • 104.126.37.138
  • 104.126.37.131
whitelisted
g.api.mega.co.nz
  • 66.203.125.12
  • 66.203.125.15
  • 66.203.125.14
  • 66.203.125.13
  • 66.203.125.11
  • 66.203.125.16
shared
edgeassetservice.azureedge.net
  • 13.107.213.63
  • 13.107.246.63
  • 13.107.246.45
  • 13.107.213.45
whitelisted

Threats

PID
Process
Class
Message
528
msedge.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
528
msedge.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
528
msedge.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
528
msedge.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
528
msedge.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
528
msedge.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
528
msedge.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
528
msedge.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
528
msedge.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
528
msedge.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
36 ETPRO signatures available at the full report
No debug info