Malware Analysis Report

2025-08-05 14:34

Sample ID 221126-3nar7add32
Target 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d
SHA256 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d
Tags
nanocore keylogger persistence spyware stealer trojan microsoft phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d

Threat Level: Known bad

The file 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d was found to be: Known bad.

Malicious Activity Summary

nanocore keylogger persistence spyware stealer trojan microsoft phishing

NanoCore

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

AutoIT Executable

Detected potential entity reuse from brand microsoft.

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-26 23:39

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-26 23:39

Reported

2022-11-27 17:07

Platform

win7-20220812-en

Max time kernel

117s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1108 set thread context of 960 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000331126ddb6d31640a6a032b98ff4e0ef00000000020000000000106600000001000020000000bc3acb2698163e8290d1cf2b32e24cb4456a46cb49274f63e48b011bf2e8fc29000000000e8000000002000020000000fb5d9bc80368ca2d6b1cf92723d9f637cda1de4edc2053c642a32e3a98d2bc69200000000f7d7eefb3751e977f8ee79760bdfbacf9187d6d6eb2a5d7ac6949f64ac897e340000000aaab6c06016d580eae40a4d35042a461b641fea9aa7a9f5f429f0d132ed1778081706362894063cd53ca3e17e06a880ff3823f1e18786c2c29c908592756eff2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a743e18a02d901 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000331126ddb6d31640a6a032b98ff4e0ef000000000200000000001066000000010000200000001ea2417990666b42e9aa5f4594bc780bc6164b5fcc964f13dbc88520a4140089000000000e8000000002000020000000a1e2329c70fde387d7f748a921bd4320f03e515b31c490a3781c929e8a2437da90000000336c5872df0cdfdf4c14ab0fb75ca33e7e25aab045cc96863c6031739d3c010b1594cc4a1412991455067d8ab7739b5aa69ad5008e6020558f80612b8772fbc37bb3666e9538cdb715e11b54b7b9026968a6579feda091b8ba95a30ffe1b68062697fd7a7fffa915204eaa9f63dc1feb410c1156e92d7310b15e4524d9c91ff9114b6635fcbf020d3575b8ea71f7686140000000be050080364f8a4676fca16e3a6be6be091919813a53112f87c344d6714a5e3264425cbc43ceac1801c414ad2c10e4809927af9e80c15dcb6a9579897a2f2e5e C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{074FB401-6E7E-11ED-979E-6A94EDCEDC7A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376337284" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1652 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
PID 1652 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
PID 1652 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
PID 1652 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
PID 1108 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1108 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1108 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1108 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1108 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1108 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1108 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1108 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1108 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 624 wrote to memory of 1192 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 624 wrote to memory of 1192 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 624 wrote to memory of 1192 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 624 wrote to memory of 1192 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe

"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"

C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe

"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\lf2" "C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" "742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"

C:\Windows\SysWOW64\WerFault.exe

"C:\Windows\SysWOW64\WerFault.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WerFault.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 learn.microsoft.com udp
N/A 104.74.231.47:443 learn.microsoft.com tcp
N/A 104.74.231.47:443 learn.microsoft.com tcp
N/A 104.74.231.47:443 learn.microsoft.com tcp
N/A 104.74.231.47:443 learn.microsoft.com tcp
N/A 104.74.231.47:443 learn.microsoft.com tcp
N/A 104.74.231.47:443 learn.microsoft.com tcp
N/A 104.74.231.47:443 learn.microsoft.com tcp
N/A 104.74.231.47:443 learn.microsoft.com tcp
N/A 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/1652-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

memory/1108-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\lf2

MD5 4ff1ccdb9061a9ee17931de9cc506a0f
SHA1 18246065474565a991de8b76043dca47c6afb51a
SHA256 b513a4cace0f3b588f32baba51b487d774de220503746f56ae9a655737a6d532
SHA512 6de408adf1dd625fe2917771aac3fbe5c88b1342382ee608684940e928392752ee4d7917667d25542ce982f2f86c6e06f14c6accdccba14921978ab399750886

C:\Users\Admin\AppData\Local\Temp\ger

MD5 62cddffde88715a338548dbfa47b555c
SHA1 17d9eed664beee32f9fa62d61daaaac931885e51
SHA256 06538639dc35c0781397871581f21949a11afd5080d0f6a69b5c09c8d278cb8a
SHA512 0fe70f5fae9ca1fee043b00bd0119dc1c5a7055881c1ed91a725a8cf7476c365e0b0d621ce35b5e6ff9e07687e5fa8901c47c4496297723288b10b39bbaa5442

memory/960-60-0x0000000000400000-0x0000000000438000-memory.dmp

memory/960-59-0x0000000000400000-0x0000000000438000-memory.dmp

memory/960-62-0x0000000000400000-0x0000000000438000-memory.dmp

memory/960-63-0x0000000000400000-0x0000000000438000-memory.dmp

memory/960-65-0x0000000000400000-0x0000000000438000-memory.dmp

memory/960-66-0x000000000041E792-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VKRSBZW2.txt

MD5 2651c96a3257575cb931b8e4fb14ffc7
SHA1 6c87e74d8d25ed07049f1accb0ac16ba1f80e5ab
SHA256 5a90db3e066ee772457401b1fbbb37fe48f98518eb3d2343546cb4d7bf5fa118
SHA512 c7c40294d88d174114653524945e59adf16a65d9ba5ed742eede51e0ebd040136ca20682eab7f8164467dc05f25ffe324dbf8420f1622dee7097acf526442657

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-26 23:39

Reported

2022-11-27 17:07

Platform

win10v2004-20220812-en

Max time kernel

151s

Max time network

172s

Command Line

"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Detected potential entity reuse from brand microsoft.

phishing microsoft

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4976 set thread context of 4852 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\646b890e-56a4-4aa3-bb0a-c2ea9f964066.tmp C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221127180609.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2348 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
PID 2348 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
PID 2348 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
PID 4976 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 4976 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 4976 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 4976 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 4976 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 4976 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 4976 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 4976 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe C:\Windows\SysWOW64\WerFault.exe
PID 3112 wrote to memory of 4492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 4492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4588 wrote to memory of 3900 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4588 wrote to memory of 3900 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 3772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 1832 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 1832 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 4756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 4756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 4756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 4756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 4756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 4756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3112 wrote to memory of 4756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe

"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"

C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe

"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\lf2" "C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" "742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"

C:\Windows\SysWOW64\WerFault.exe

"C:\Windows\SysWOW64\WerFault.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WerFault.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x9c,0x7fff264546f8,0x7fff26454708,0x7fff26454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WerFault.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff264546f8,0x7fff26454708,0x7fff26454718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,13604194932714758585,14896589861932787475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,13604194932714758585,14896589861932787475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5376 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5904 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7e4a65460,0x7ff7e4a65470,0x7ff7e4a65480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6744 /prefetch:2

Network

Country Destination Domain Proto
N/A 93.184.220.29:80 tcp
N/A 93.184.220.29:80 tcp
N/A 8.8.8.8:53 dns.google udp
N/A 8.8.8.8:443 dns.google tcp
N/A 8.8.8.8:443 dns.google tcp
N/A 8.8.8.8:443 dns.google tcp
N/A 8.8.8.8:443 dns.google tcp
N/A 8.8.8.8:443 dns.google tcp
N/A 8.8.8.8:443 dns.google tcp
N/A 8.8.8.8:53 nav.smartscreen.microsoft.com udp
N/A 20.67.219.150:443 nav.smartscreen.microsoft.com tcp
N/A 20.67.219.150:443 nav.smartscreen.microsoft.com tcp
N/A 8.8.8.8:53 smartscreen-prod.microsoft.com udp
N/A 20.82.250.189:443 smartscreen-prod.microsoft.com tcp
N/A 20.82.250.189:443 smartscreen-prod.microsoft.com tcp
N/A 20.82.250.189:443 smartscreen-prod.microsoft.com tcp
N/A 8.8.8.8:443 dns.google tcp
N/A 8.8.8.8:443 dns.google tcp
N/A 8.8.8.8:443 dns.google tcp
N/A 8.8.8.8:53 nav.smartscreen.microsoft.com udp
N/A 20.86.249.62:443 nav.smartscreen.microsoft.com tcp
N/A 20.86.249.62:443 nav.smartscreen.microsoft.com tcp
N/A 8.8.8.8:443 dns.google udp
N/A 131.253.33.200:443 tcp
N/A 104.74.231.47:443 learn.microsoft.com tcp
N/A 8.8.8.8:53 nav.smartscreen.microsoft.com udp
N/A 20.67.219.150:443 nav.smartscreen.microsoft.com tcp
N/A 20.67.219.150:443 nav.smartscreen.microsoft.com tcp
N/A 13.107.246.67:443 tcp
N/A 13.107.219.67:443 tcp
N/A 131.253.33.239:443 tcp
N/A 224.0.0.251:5353 udp
N/A 51.11.192.50:443 tcp
N/A 51.11.192.50:443 tcp
N/A 23.73.0.144:443 assets.msn.com tcp
N/A 23.73.0.144:443 tcp
N/A 23.73.0.144:443 assets.msn.com tcp
N/A 104.109.143.75:443 tcp
N/A 18.65.39.70:443 tcp
N/A 204.79.197.200:443 tcp
N/A 20.234.93.27:443 tcp
N/A 13.107.21.200:443 tcp
N/A 104.80.225.205:443 tcp
N/A 8.8.8.8:443 dns.google udp
N/A 204.79.197.239:443 tcp
N/A 8.8.8.8:443 dns.google udp
N/A 104.109.143.22:443 deff.nelreports.net tcp
N/A 104.109.143.75:443 tcp
N/A 104.109.143.75:443 tcp
N/A 104.109.143.75:443 tcp
N/A 23.51.68.110:443 tcp
N/A 204.79.197.239:443 tcp
N/A 93.184.220.29:80 tcp
N/A 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
N/A 104.109.143.13:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp

Files

memory/4976-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\lf2

MD5 4ff1ccdb9061a9ee17931de9cc506a0f
SHA1 18246065474565a991de8b76043dca47c6afb51a
SHA256 b513a4cace0f3b588f32baba51b487d774de220503746f56ae9a655737a6d532
SHA512 6de408adf1dd625fe2917771aac3fbe5c88b1342382ee608684940e928392752ee4d7917667d25542ce982f2f86c6e06f14c6accdccba14921978ab399750886

C:\Users\Admin\AppData\Local\Temp\ger

MD5 62cddffde88715a338548dbfa47b555c
SHA1 17d9eed664beee32f9fa62d61daaaac931885e51
SHA256 06538639dc35c0781397871581f21949a11afd5080d0f6a69b5c09c8d278cb8a
SHA512 0fe70f5fae9ca1fee043b00bd0119dc1c5a7055881c1ed91a725a8cf7476c365e0b0d621ce35b5e6ff9e07687e5fa8901c47c4496297723288b10b39bbaa5442

memory/4852-135-0x0000000000000000-mapping.dmp

memory/4852-136-0x0000000000400000-0x0000000000438000-memory.dmp

memory/4492-137-0x0000000000000000-mapping.dmp

memory/3900-138-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 af05481b81fdeb6c34b41fa28542b8e1
SHA1 30982103d4ad165cda1b492f96da553b0d5a8663
SHA256 61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA512 6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 71b657795f1d63721f304fcf46915016
SHA1 d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256 f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512 dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

memory/3772-142-0x0000000000000000-mapping.dmp

memory/1832-143-0x0000000000000000-mapping.dmp

\??\pipe\LOCAL\crashpad_3112_MASOSVRYIYAOIUXV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4756-147-0x0000000000000000-mapping.dmp

memory/4808-149-0x0000000000000000-mapping.dmp

memory/4432-150-0x0000000000000000-mapping.dmp

\??\pipe\LOCAL\crashpad_4588_DSBMQNIHGBKUHPCA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

MD5 a69e4ee0072e3cb212e468f14886311a
SHA1 b84d2ca5e7225b91520f339e177aff66428eef45
SHA256 cc2e41a8086eb84d9dcdfbbd3b4eb9e33d8bab2978da4c07e7abe71127243ee4
SHA512 75875cddcccae57c29c23ad379785b02d547dea833a9efb38374d63b0d7a9e41dc3b6e6160b0744ab9c83e33dabc144dd9f704b1c338013a932c5a962a63d4fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

MD5 8212d70c86ce431d59072c64f70a8279
SHA1 b221f0de1fb741bff50d0536566f1a9602757ee1
SHA256 b43ab742a745a5293b46de337819f22995835f52e29656ff8fb2eb5a1f569229
SHA512 08925c1502691ca0eebc03dcf82ba0efba59a3c480edbe7ace5632fcd2cb4d03895bb3babd41effa627b162bd3d88d51b8daeeadd657e49d39b4ebb202281d0e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 243c3736c5a812414cf59bf5600d3f4d
SHA1 f52022f1d87b8777bf4c52aa49f7e4a50f809920
SHA256 d2ce657b337b662618cd98db06cacf588e5740ed3eb2bea3b4692409a331a43a
SHA512 ed507ee2ec851004e2b27eb16b1da05aa06848754c4adf2327f8802bf018d34822fba75049fb34d8a054387a9994900c86d5c41678155881460818d885e3dd77

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 71b657795f1d63721f304fcf46915016
SHA1 d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256 f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512 dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

memory/4908-157-0x0000000000000000-mapping.dmp

memory/4772-159-0x0000000000000000-mapping.dmp

memory/4196-161-0x0000000000000000-mapping.dmp

memory/4844-163-0x0000000000000000-mapping.dmp

memory/904-165-0x0000000000000000-mapping.dmp

memory/2508-167-0x0000000000000000-mapping.dmp

memory/3140-169-0x0000000000000000-mapping.dmp

memory/3596-171-0x0000000000000000-mapping.dmp

memory/2256-173-0x0000000000000000-mapping.dmp

memory/2344-174-0x0000000000000000-mapping.dmp

memory/800-175-0x0000000000000000-mapping.dmp

memory/2192-176-0x0000000000000000-mapping.dmp

memory/1200-177-0x0000000000000000-mapping.dmp