amadey | 5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2022, 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d641e8215a82151e8925673bfb171a1.exe
Size

235KB
MD5

1d641e8215a82151e8925673bfb171a1
SHA1

12885d250304d50920b79a00524250eaac5a7741
SHA256

5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445
SHA512

b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce
SSDEEP

6144:LkwjBO99g6779r0psUhmiIuVyD2Ng8hJgN:0TrOh2uVyCN3hS

Score

10^/10

amadey redline upppppp555555 microsoft collection discovery infostealer persistence phishing spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.63

62.204.41.165/g8sjnd3xe/index.php

62.204.41.182/g9TTnd3bS/index.php

Extracted

Family

redline

Botnet

Upppppp555555

82.115.223.15:15486

Attributes

auth_value
58d5a32d8ed521ca3d8372d3101b7161

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 5 IoCs

resource	yara_rule
behavioral2/files/0x00060000000231ad-293.dat	amadey_cred_module
behavioral2/memory/3640-296-0x0000000000740000-0x0000000000764000-memory.dmp	amadey_cred_module
behavioral2/files/0x00060000000231ad-295.dat	amadey_cred_module
behavioral2/files/0x00060000000231ad-294.dat	amadey_cred_module
behavioral2/files/0x000400000001e861-299.dat	amadey_cred_module

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Blocklisted process makes network request 2 IoCs

flow	pid	Process
193	3640	rundll32.exe
199	2568	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 22 IoCs

pid	Process
4564	nbveek.exe
4748	slova.exe
4780	nbveek.exe
4908	linda5.exe
4352	nbveek.exe
3888	clim.exe
4572	anon.exe
4484	nbveek.exe
400	Legs.exe
3360	nbveek.exe
1252	nbveek.exe
1908	nbveek.exe
5808	msedgerecovery.exe
5880	MicrosoftEdgeUpdateSetup.exe
4596	MicrosoftEdgeUpdate.exe
5860	MicrosoftEdgeUpdate.exe
3328	MicrosoftEdgeUpdate.exe
5596	MicrosoftEdgeUpdateComRegisterShell64.exe
6000	MicrosoftEdgeUpdateComRegisterShell64.exe
5856	MicrosoftEdgeUpdateComRegisterShell64.exe
4720	MicrosoftEdgeUpdate.exe
4728	MicrosoftEdgeUpdate.exe

Registers COM server for autorun 1 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	linda5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Legs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	1d641e8215a82151e8925673bfb171a1.exe

Loads dropped DLL 16 IoCs

pid	Process
220	rundll32.exe
4656	rundll32.exe
3640	rundll32.exe
3640	rundll32.exe
2568	rundll32.exe
4596	MicrosoftEdgeUpdate.exe
5860	MicrosoftEdgeUpdate.exe
3328	MicrosoftEdgeUpdate.exe
5596	MicrosoftEdgeUpdateComRegisterShell64.exe
3328	MicrosoftEdgeUpdate.exe
6000	MicrosoftEdgeUpdateComRegisterShell64.exe
3328	MicrosoftEdgeUpdate.exe
5856	MicrosoftEdgeUpdateComRegisterShell64.exe
3328	MicrosoftEdgeUpdate.exe
4720	MicrosoftEdgeUpdate.exe
4728	MicrosoftEdgeUpdate.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\slova.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000002051\\slova.exe"	nbveek.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000004051\\linda5.exe"	nbveek.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\clim.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000006051\\clim.exe"	nbveek.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4564 set thread context of 4780	4564	nbveek.exe	86
PID 4564 set thread context of 4352	4564	nbveek.exe	90
PID 4564 set thread context of 4484	4564	nbveek.exe	95
PID 3888 set thread context of 5300	3888	clim.exe	123

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\psuser_64.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_uk.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_kk.dll	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_fa.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_gu.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_es.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_or.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_tt.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdateCore.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_bg.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_bn.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ta.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_sr-Cyrl-RS.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ug.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_am.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_mr.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_sl.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_gd.dll	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221225192333.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_bn-IN.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\psmachine.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_lv.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_kok.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ga.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_lo.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\EdgeUpdate.dat	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_hi.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_el.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_fr-CA.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_mk.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_de.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_es-419.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_hu.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ka.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\psmachine_64.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\psmachine_arm64.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_as.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_ca.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_kn.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_tr.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_sr-Latn-RS.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_th.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_bs.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\psuser_arm64.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_en.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_is.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7f912508-2f68-40fa-8a46-c7fa7d1160f2.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_km.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_mi.dll	MicrosoftEdgeUpdateSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5848	4780	WerFault.exe	86
5976	4748	WerFault.exe	85

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4968	schtasks.exe
2388	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E45E8446-680D-4668-A46C-D13892D6B640}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CurVer\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CurVer\ = "MicrosoftEdgeUpdate.CoreMachineClass.1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ServiceParameters = "/comsvc"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\CLSID\ = "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\MICROSOFTEDGEUPDATE.EXE	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{0CCB8559-9E10-4759-AEFD-51815C3677E3}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
2632	msedge.exe
2632	msedge.exe
4572	anon.exe
4572	anon.exe
4572	anon.exe
3888	clim.exe
3888	clim.exe
3888	clim.exe
3888	clim.exe
4780	nbveek.exe
4780	nbveek.exe
4748	slova.exe
4748	slova.exe
4780	nbveek.exe
4748	slova.exe
3668	identity_helper.exe
3668	identity_helper.exe
3640	rundll32.exe
3640	rundll32.exe
3640	rundll32.exe
3640	rundll32.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
4596	MicrosoftEdgeUpdate.exe
4596	MicrosoftEdgeUpdate.exe
4596	MicrosoftEdgeUpdate.exe
4596	MicrosoftEdgeUpdate.exe
4596	MicrosoftEdgeUpdate.exe
4596	MicrosoftEdgeUpdate.exe
4728	MicrosoftEdgeUpdate.exe
4728	MicrosoftEdgeUpdate.exe
4728	MicrosoftEdgeUpdate.exe
4728	MicrosoftEdgeUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	slova.exe
Token: SeDebugPrivilege	4780	nbveek.exe
Token: SeDebugPrivilege	3888	clim.exe
Token: SeDebugPrivilege	4572	anon.exe
Token: SeDebugPrivilege	5300	AppLaunch.exe
Token: SeDebugPrivilege	4596	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4596	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4728	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4352	nbveek.exe
4352	nbveek.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 4564	2760	1d641e8215a82151e8925673bfb171a1.exe	82
PID 2760 wrote to memory of 4564	2760	1d641e8215a82151e8925673bfb171a1.exe	82
PID 2760 wrote to memory of 4564	2760	1d641e8215a82151e8925673bfb171a1.exe	82
PID 4564 wrote to memory of 4968	4564	nbveek.exe	83
PID 4564 wrote to memory of 4968	4564	nbveek.exe	83
PID 4564 wrote to memory of 4968	4564	nbveek.exe	83
PID 4564 wrote to memory of 4748	4564	nbveek.exe	85
PID 4564 wrote to memory of 4748	4564	nbveek.exe	85
PID 4564 wrote to memory of 4748	4564	nbveek.exe	85
PID 4564 wrote to memory of 4780	4564	nbveek.exe	86
PID 4564 wrote to memory of 4780	4564	nbveek.exe	86
PID 4564 wrote to memory of 4780	4564	nbveek.exe	86
PID 4564 wrote to memory of 4780	4564	nbveek.exe	86
PID 4564 wrote to memory of 4780	4564	nbveek.exe	86
PID 4564 wrote to memory of 4780	4564	nbveek.exe	86
PID 4564 wrote to memory of 4780	4564	nbveek.exe	86
PID 4564 wrote to memory of 4780	4564	nbveek.exe	86
PID 4564 wrote to memory of 4908	4564	nbveek.exe	87
PID 4564 wrote to memory of 4908	4564	nbveek.exe	87
PID 4564 wrote to memory of 4908	4564	nbveek.exe	87
PID 4908 wrote to memory of 1068	4908	linda5.exe	88
PID 4908 wrote to memory of 1068	4908	linda5.exe	88
PID 4908 wrote to memory of 1068	4908	linda5.exe	88
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 4564 wrote to memory of 4352	4564	nbveek.exe	90
PID 1068 wrote to memory of 220	1068	control.exe	91
PID 1068 wrote to memory of 220	1068	control.exe	91
PID 1068 wrote to memory of 220	1068	control.exe	91
PID 4564 wrote to memory of 3888	4564	nbveek.exe	92
PID 4564 wrote to memory of 3888	4564	nbveek.exe	92
PID 4564 wrote to memory of 3888	4564	nbveek.exe	92
PID 4564 wrote to memory of 4572	4564	nbveek.exe	93
PID 4564 wrote to memory of 4572	4564	nbveek.exe	93
PID 4564 wrote to memory of 4572	4564	nbveek.exe	93
PID 4564 wrote to memory of 4484	4564	nbveek.exe	95
PID 4564 wrote to memory of 4484	4564	nbveek.exe	95
PID 4564 wrote to memory of 4484	4564	nbveek.exe	95
PID 4564 wrote to memory of 4484	4564	nbveek.exe	95
PID 4564 wrote to memory of 4484	4564	nbveek.exe	95
PID 4564 wrote to memory of 4484	4564	nbveek.exe	95
PID 4564 wrote to memory of 4484	4564	nbveek.exe	95
PID 4564 wrote to memory of 4484	4564	nbveek.exe	95
PID 4564 wrote to memory of 400	4564	nbveek.exe	99
PID 4564 wrote to memory of 400	4564	nbveek.exe	99
PID 4564 wrote to memory of 400	4564	nbveek.exe	99
PID 400 wrote to memory of 3360	400	Legs.exe	100
PID 400 wrote to memory of 3360	400	Legs.exe	100
PID 400 wrote to memory of 3360	400	Legs.exe	100
PID 220 wrote to memory of 1408	220	rundll32.exe	101
PID 220 wrote to memory of 1408	220	rundll32.exe	101
PID 3360 wrote to memory of 2388	3360	nbveek.exe	102
PID 3360 wrote to memory of 2388	3360	nbveek.exe	102
PID 3360 wrote to memory of 2388	3360	nbveek.exe	102
PID 1408 wrote to memory of 4656	1408	RunDll32.exe	104
PID 1408 wrote to memory of 4656	1408	RunDll32.exe	104

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\1d641e8215a82151e8925673bfb171a1.exe
"C:\Users\Admin\AppData\Local\Temp\1d641e8215a82151e8925673bfb171a1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
  "C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\1000002051\slova.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002051\slova.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1256
      4⤵
      Program crash
      PID:5976
- - C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 1212
      4⤵
      Program crash
      PID:5848
- - C:\Users\Admin\AppData\Local\Temp\1000004051\linda5.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004051\linda5.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\I~HF.cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\I~HF.cpl",
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:220
      - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\I~HF.cpl",
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\I~HF.cpl",
        7⤵
        Loads dropped DLL
        
        PID:4656
- - C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\1000006051\clim.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006051\clim.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:5244
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:5256
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5300
- - C:\Users\Admin\AppData\Local\Temp\1000007001\anon.exe
    "C:\Users\Admin\AppData\Local\Temp\1000007001\anon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
    "C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"
    3⤵
    - Executes dropped EXE
    PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=nbveek.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      Adds Run key to start application
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:2632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffd7e5346f8,0x7ffd7e534708,0x7ffd7e534718
        5⤵
        
        PID:3092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
        5⤵
        
        PID:2552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
        5⤵
        
        PID:2192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
        5⤵
        
        PID:2260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        5⤵
        
        PID:2728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4516 /prefetch:8
        5⤵
        
        PID:2644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
        5⤵
        
        PID:1328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3712 /prefetch:8
        5⤵
        
        PID:5224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
        5⤵
        
        PID:5340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
        5⤵
        
        PID:5360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
        5⤵
        
        PID:5784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
        5⤵
        
        PID:5872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
        5⤵
        
        PID:4464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:3888
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff63f595460,0x7ff63f595470,0x7ff63f595480
        6⤵
        
        PID:5280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6176 /prefetch:8
        5⤵
        
        PID:5372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5168 /prefetch:8
        5⤵
        
        PID:1768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 /prefetch:8
        5⤵
        
        PID:5348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2024,1240394862259613963,2810751374721608274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5468 /prefetch:8
        5⤵
        
        PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=nbveek.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      PID:5676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7e5346f8,0x7ffd7e534708,0x7ffd7e534718
        5⤵
        
        PID:5696
- - C:\Users\Admin\AppData\Local\Temp\1000009001\Legs.exe
    "C:\Users\Admin\AppData\Local\Temp\1000009001\Legs.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2388
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        5⤵
        Blocklisted process makes network request
        Loads dropped DLL
        Accesses Microsoft Outlook profiles
        outlook_win_path
        
        PID:2568
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4780 -ip 4780
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4748 -ip 4748
1⤵
PID:5896

C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
1⤵
- Executes dropped EXE
PID:1252

C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
1⤵
- Executes dropped EXE
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
PID:5676
- C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir5676_1532062963\msedgerecovery.exe
  "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir5676_1532062963\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.67 --sessionid={271ee9b7-2517-468c-9beb-5800115049dc} --system
  2⤵
  - Executes dropped EXE
  PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir5676_1532062963\MicrosoftEdgeUpdateSetup.exe
    "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir5676_1532062963\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:5880
  - - C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
      4⤵
      Executes dropped EXE
      Sets file execution options in registry
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4596
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5860
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3328
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Loads dropped DLL
        Modifies registry class
        
        PID:5596
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Loads dropped DLL
        Modifies registry class
        
        PID:6000
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Loads dropped DLL
        Modifies registry class
        
        PID:5856
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REVBNTFCNjctMjk0Ni00QUQ4LTkwQTQtMTU3RkVCRDA3QTIwfSIgdXNlcmlkPSJ7NTA0MjAyMjEtOEE1NC00QUY1LUI0MzAtQjM4MkU4M0JBQjU4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezg1MDY5RDc3LTdBNUYtNDAzRi05MjA4LTAxRjVBQTRFNDA4Rn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7bTQ2SzVLNXoxdnZrTkxIcjRjMXgvaENqZTdaUUxkcUt5WjVOd2d6VjNBOD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE2OS4zMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ3MDkyNDM5MSIgaW5zdGFsbF90aW1lX21zPSI4MzEiLz48L2FwcD48L3JlcXVlc3Q-
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4720
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir5676_1532062963\MicrosoftEdgeUpdateSetup.exe

Filesize
1.5MB

MD5
f70962a7883fefe8defa224c1ffdadfa

SHA1
efd06b7c1b5ead8cec2cd029a8d8ccb0c46ee2da

SHA256
3e726854ff0a0046de458afc2cd58cfc37430b4c7969395111398f47d8f63bb4

SHA512
678c10874e6089acde5c57cdc64e11a76cbc9b3e7c882f9c1eaa619f897675c8f145e4be4825d8197edb2e645035a0953c3ed5a34da3e84d013fea5599699761

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir5676_1532062963\MicrosoftEdgeUpdateSetup.exe

Filesize
1.5MB

MD5
f70962a7883fefe8defa224c1ffdadfa

SHA1
efd06b7c1b5ead8cec2cd029a8d8ccb0c46ee2da

SHA256
3e726854ff0a0046de458afc2cd58cfc37430b4c7969395111398f47d8f63bb4

SHA512
678c10874e6089acde5c57cdc64e11a76cbc9b3e7c882f9c1eaa619f897675c8f145e4be4825d8197edb2e645035a0953c3ed5a34da3e84d013fea5599699761

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir5676_1532062963\msedgerecovery.exe

Filesize
1.1MB

MD5
3b2bd3e2b22afa49576723c819a1185b

SHA1
41a1590e22600c717acd9e376b9020b3021dada6

SHA256
b2900c435244e948491cfab330b570b4326d1879c5c2be2aa35ce8bd49446d05

SHA512
a411b00da74a6c90d0a60a0d9a024a430c2c7483416dc95634bd62c5c29b9c9d1fd3310911f2da85df66aac08e9026df4aad00c083781ca22802b0236652d1d5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
172KB

MD5
b462ad181104b32ec56a6a1e1aa25622

SHA1
c26dbc70359be470fb63d50e12528e473749d9f7

SHA256
5b95e7e42a2df4c8cb8a1dfc9e71f81831ffc128408ad1a37f83ab76dcdf1afb

SHA512
5f6b37f4e88b617ca68762706423e38da4eccb820e82635eda3ed269efeb92ae3285e0b1285978f35dd8df004c801ebbca2f7c061ae055070bdbcba88c474e70

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdate.exe

Filesize
200KB

MD5
7bcf03ae20f6b4aab6efda45f6a0fa01

SHA1
6f1a63a994568c7cac224c6f44d41d19fe24a2e4

SHA256
23387b13f6386a095ae8f178c261f6565e5828fd7e67ef0cbb10e07224149ba6

SHA512
615d130b2f87d3f2ec125cc97391c6b318359a78f0135f10d0ffd5085062cde39935823865f139d767f9d7992dfa926358442369ab424fbe1d54b2c915992c4b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdate.exe

Filesize
200KB

MD5
7bcf03ae20f6b4aab6efda45f6a0fa01

SHA1
6f1a63a994568c7cac224c6f44d41d19fe24a2e4

SHA256
23387b13f6386a095ae8f178c261f6565e5828fd7e67ef0cbb10e07224149ba6

SHA512
615d130b2f87d3f2ec125cc97391c6b318359a78f0135f10d0ffd5085062cde39935823865f139d767f9d7992dfa926358442369ab424fbe1d54b2c915992c4b

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
205KB

MD5
fccf8ebd72efacc9566b7849d59512aa

SHA1
2d0cc03e7912578d1c0a01e1d338290a0d1c157e

SHA256
a6a3b7b77ec3fcbdd07b516457fcc7368282ed84e04792316d2ceeeb3b6c84fb

SHA512
6e0b2e27ae19c3100b789b8b22eb307072a902878d92cea426ac02c07c8338934b49c57012a858e01816617ec6c41ef39b7a390e63c8975e56c4504faa8b6b3a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
250KB

MD5
524a95f05f4c0def70fa61a5f0717e9c

SHA1
6ee3b87e60e865d21bc1b5e434fea12fe262c315

SHA256
e17a7d9e0dcb1a3d6a21009f8d9b41fe1986312d79ffc6728c6c3f500dd6434f

SHA512
cc5e21ce182489416c906fb3f16e808554b739908916682cef6afe11a748b02382bfb93d1359cdc0794c2fb4b6f3cb9d9c677215a904be79d4b1df573de99089

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
5f4cdf4268be23a984ee0b2feaad3dd3

SHA1
cc5aabfc567971d7d2b7a0a206925a59de79dad5

SHA256
bb92222715061ddc89332668248c696348b953a0251893ec7d36597099308d92

SHA512
41803d549742f3b22521d6b645adfafdc477c3fc315a88056b111d54cb0ba677db4a8162b793a19619f672b3580736d939367649d3729c129ef871b55900f0cd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdate.dll

Filesize
2.0MB

MD5
5f4cdf4268be23a984ee0b2feaad3dd3

SHA1
cc5aabfc567971d7d2b7a0a206925a59de79dad5

SHA256
bb92222715061ddc89332668248c696348b953a0251893ec7d36597099308d92

SHA512
41803d549742f3b22521d6b645adfafdc477c3fc315a88056b111d54cb0ba677db4a8162b793a19619f672b3580736d939367649d3729c129ef871b55900f0cd

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EUA0CF.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
ca88ea1e6a8ee2379ea2c8459c2b99e5

SHA1
dcf468473aa7ece0f106ab34bd7ae633097153d4

SHA256
1e61386dff70de6dabc71ec5d13f8d77ae7e1ac7350f6cc7977603415f29c46a

SHA512
d51e59ceb1e99f771ae7f45c986f77f9471e120b27f777056fb12e3b6add87e2540b838cf86ff5fcb76794f4eb5d922c72410204baa5ca3635f4f6157efc20b0

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
95KB

MD5
8f860d9ebf56104a16c164475d3d1891

SHA1
bed1b5e6efa8bacca3c7ffaadafca1da28ee5514

SHA256
bff1b9c40bca9897d1d02f70fc827d09565047256cd5c7194fbd2c918793b364

SHA512
16f5ed42e0c87de66b4a137e00c502ace17bab45d89ee57a5eabee85b179819e2f5710f5124e5d47671ce102f6907b8c6a990d33fcb3e9cebbdb3f3e1bc9be8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c671a6a3920cf5a5a7b5641546564b1

SHA1
a32dc7eb5fbcabfd80bd3cc83feb61cb439f3049

SHA256
88d8dd693b6f739068b9aff5c6cc8b036af8cd00f0f4df07fe339393045ec417

SHA512
10f63235b9b1d7bc0935ad1fbfd1dcf3d3fb25adba141d951f4fb99f1d01c870de7ed34cfc447598295fc8f051050e949f4eb663a435d3315f953a5896ef7c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
30e375798049100677ea16b7c578a4ee

SHA1
bcab7401a5f34ac0e6f795ece8d3ed12944ae99f

SHA256
ea5c90cfc97f429a2f9e0b1e9b16778b5b19bd8e83a896a30002de70af84e1ce

SHA512
f8ae930e26ecfe06dc30d4f39858b0eec6b4a81a8139883712505b5c6b58504d463d986ef58c7151a247fe157c6013b570b9d39e1d4a860061e37e0419900582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\1.3.169.31\recovery-component-inner.crx

Filesize
1.9MB

MD5
dcb0ab396e869708ca1ca663c6697b50

SHA1
83d2d79250a470d8c140259688ee35e6019c60f0

SHA256
083c44f154565469a742fe081b09ab19eb5f2a986936dbcef55ddd21f79e6beb

SHA512
e598653b4e6fa16f7ca3a96b44cc279fb010555102c3b661a88e44f6750242e43293a54af25c187445a6f65f7979d556285c16a0294530978f97327f8c1bdd68

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002051\slova.exe

Filesize
352KB

MD5
016594e2f42bb1fe404770fa379ae66b

SHA1
733327dced37f4550a27da9bacaabed5ed0da83f

SHA256
aba69915c2d185b610ba1f2ca085d9fea6c7a38c48a05c91ebaff5f93a78a6d8

SHA512
e4357515c88005a315a658ed7bce7d3a397cded440bed8c190db5e6df3bf6b6e3dd21b0fc93bb2bc2a145de328210bd67863862641f58f7de96323b51fcc96ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002051\slova.exe

Filesize
352KB

MD5
016594e2f42bb1fe404770fa379ae66b

SHA1
733327dced37f4550a27da9bacaabed5ed0da83f

SHA256
aba69915c2d185b610ba1f2ca085d9fea6c7a38c48a05c91ebaff5f93a78a6d8

SHA512
e4357515c88005a315a658ed7bce7d3a397cded440bed8c190db5e6df3bf6b6e3dd21b0fc93bb2bc2a145de328210bd67863862641f58f7de96323b51fcc96ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004051\linda5.exe

Filesize
1.5MB

MD5
949020ad55641ce97b698da83a9c4372

SHA1
28391d0d50a0cbf5353c3eb4c4f65f19de2e178f

SHA256
015484fa26f265516e42c34403a09461cbd821f8e62149dcd670766c215241b6

SHA512
60ce0ddca58dbd25bc716ab5477d162f06797b50fed5004fa155543a46102b2ce13cea4b2e7c95bec90bbe779894ffb13ebec6184358438b1ceffcd98f00acd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004051\linda5.exe

Filesize
1.5MB

MD5
949020ad55641ce97b698da83a9c4372

SHA1
28391d0d50a0cbf5353c3eb4c4f65f19de2e178f

SHA256
015484fa26f265516e42c34403a09461cbd821f8e62149dcd670766c215241b6

SHA512
60ce0ddca58dbd25bc716ab5477d162f06797b50fed5004fa155543a46102b2ce13cea4b2e7c95bec90bbe779894ffb13ebec6184358438b1ceffcd98f00acd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006051\clim.exe

Filesize
920KB

MD5
c6d73b5ece49beea2dfaae5d15aaf774

SHA1
a57c01512c78ae42cba8e604ac10e0e0f8dbf286

SHA256
c2f9fe4b1609463c3897a3813e0c787af7a50d100017c52f91172f6dadb5bdc9

SHA512
16d007178bf3d4a4b4b2af9c7dac52c65c85fb6f4058520eb9ca2bbec198ac01f3fb77d54dd5b1dcbdaa89498b1aa868f7f725eb11b409e5e685488a25f975fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006051\clim.exe

Filesize
920KB

MD5
c6d73b5ece49beea2dfaae5d15aaf774

SHA1
a57c01512c78ae42cba8e604ac10e0e0f8dbf286

SHA256
c2f9fe4b1609463c3897a3813e0c787af7a50d100017c52f91172f6dadb5bdc9

SHA512
16d007178bf3d4a4b4b2af9c7dac52c65c85fb6f4058520eb9ca2bbec198ac01f3fb77d54dd5b1dcbdaa89498b1aa868f7f725eb11b409e5e685488a25f975fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\anon.exe

Filesize
175KB

MD5
d644e121e4e3e53a46f2ddd843048c2d

SHA1
61f72a7d170f5a8f6ff1681b5a73b7819adc7c77

SHA256
6986b19f5c698ed5b8ff620d17a4abe7c498a89b56425162d652d9beac305dd1

SHA512
d90c95d532f0ea66bf96890a4cff11290b6d796a24095ad072660894c67ea644ae9dd24397d6f2748bb84ed69cee8d3c43f375f04311a6fd10625112c0bab5c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\anon.exe

Filesize
175KB

MD5
d644e121e4e3e53a46f2ddd843048c2d

SHA1
61f72a7d170f5a8f6ff1681b5a73b7819adc7c77

SHA256
6986b19f5c698ed5b8ff620d17a4abe7c498a89b56425162d652d9beac305dd1

SHA512
d90c95d532f0ea66bf96890a4cff11290b6d796a24095ad072660894c67ea644ae9dd24397d6f2748bb84ed69cee8d3c43f375f04311a6fd10625112c0bab5c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000009001\Legs.exe

Filesize
235KB

MD5
15f57d45fe2a1e8da248cf9b3723d775

SHA1
aafb9168ed62dc2ebeeb8428c3a39a6525142f6c

SHA256
bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

SHA512
aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000009001\Legs.exe

Filesize
235KB

MD5
15f57d45fe2a1e8da248cf9b3723d775

SHA1
aafb9168ed62dc2ebeeb8428c3a39a6525142f6c

SHA256
bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

SHA512
aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174

Download Submit
C:\Users\Admin\AppData\Local\Temp\I~HF.cpl

Filesize
1.5MB

MD5
84e1763773f42115b0c4751736ee23e0

SHA1
1876b14f4d8b958834527b66475c02df5d468f6f

SHA256
69aaa22d709ac7a8812da0c787b7aaf91693d15d08af1486bd6dc38d4c4a6e87

SHA512
291692744ed574a0c52b4fd6c2715167b82928262ec463db8ca785c07bd3debc7969513f523cc8d8b45d07b8356276f5ceaf1aeeca2822546a32f764580d1196

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe

Filesize
235KB

MD5
1d641e8215a82151e8925673bfb171a1

SHA1
12885d250304d50920b79a00524250eaac5a7741

SHA256
5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445

SHA512
b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe

Filesize
235KB

MD5
1d641e8215a82151e8925673bfb171a1

SHA1
12885d250304d50920b79a00524250eaac5a7741

SHA256
5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445

SHA512
b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe

Filesize
235KB

MD5
1d641e8215a82151e8925673bfb171a1

SHA1
12885d250304d50920b79a00524250eaac5a7741

SHA256
5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445

SHA512
b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe

Filesize
235KB

MD5
1d641e8215a82151e8925673bfb171a1

SHA1
12885d250304d50920b79a00524250eaac5a7741

SHA256
5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445

SHA512
b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe

Filesize
235KB

MD5
1d641e8215a82151e8925673bfb171a1

SHA1
12885d250304d50920b79a00524250eaac5a7741

SHA256
5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445

SHA512
b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

Filesize
235KB

MD5
15f57d45fe2a1e8da248cf9b3723d775

SHA1
aafb9168ed62dc2ebeeb8428c3a39a6525142f6c

SHA256
bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

SHA512
aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174

Download Submit
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

Filesize
235KB

MD5
15f57d45fe2a1e8da248cf9b3723d775

SHA1
aafb9168ed62dc2ebeeb8428c3a39a6525142f6c

SHA256
bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

SHA512
aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174

Download Submit
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

Filesize
235KB

MD5
15f57d45fe2a1e8da248cf9b3723d775

SHA1
aafb9168ed62dc2ebeeb8428c3a39a6525142f6c

SHA256
bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

SHA512
aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174

Download Submit
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

Filesize
235KB

MD5
15f57d45fe2a1e8da248cf9b3723d775

SHA1
aafb9168ed62dc2ebeeb8428c3a39a6525142f6c

SHA256
bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

SHA512
aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174

Download Submit
C:\Users\Admin\AppData\Local\Temp\i~hf.cpl

Filesize
1.5MB

MD5
84e1763773f42115b0c4751736ee23e0

SHA1
1876b14f4d8b958834527b66475c02df5d468f6f

SHA256
69aaa22d709ac7a8812da0c787b7aaf91693d15d08af1486bd6dc38d4c4a6e87

SHA512
291692744ed574a0c52b4fd6c2715167b82928262ec463db8ca785c07bd3debc7969513f523cc8d8b45d07b8356276f5ceaf1aeeca2822546a32f764580d1196

Download Submit
C:\Users\Admin\AppData\Local\Temp\i~hf.cpl

Filesize
1.5MB

MD5
84e1763773f42115b0c4751736ee23e0

SHA1
1876b14f4d8b958834527b66475c02df5d468f6f

SHA256
69aaa22d709ac7a8812da0c787b7aaf91693d15d08af1486bd6dc38d4c4a6e87

SHA512
291692744ed574a0c52b4fd6c2715167b82928262ec463db8ca785c07bd3debc7969513f523cc8d8b45d07b8356276f5ceaf1aeeca2822546a32f764580d1196

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
126KB

MD5
70134bf4d1cd851b382b2930a2e182ea

SHA1
8454d476c0d36564792b49be546593af3eab29f4

SHA256
5e4cb0cc51202cef27c4f5da63362ceee8c29a03e61ac19efda3c137b657d9ef

SHA512
1af07ab22359f69fe32e359883f7d31f3068582ba0eddcb1faf6bf7686f32f51e36cdf645ac9dd727a4bf9b8c390245d7e71faf17c1a18ff3054c55f19c770bd

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
126KB

MD5
70134bf4d1cd851b382b2930a2e182ea

SHA1
8454d476c0d36564792b49be546593af3eab29f4

SHA256
5e4cb0cc51202cef27c4f5da63362ceee8c29a03e61ac19efda3c137b657d9ef

SHA512
1af07ab22359f69fe32e359883f7d31f3068582ba0eddcb1faf6bf7686f32f51e36cdf645ac9dd727a4bf9b8c390245d7e71faf17c1a18ff3054c55f19c770bd

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
126KB

MD5
70134bf4d1cd851b382b2930a2e182ea

SHA1
8454d476c0d36564792b49be546593af3eab29f4

SHA256
5e4cb0cc51202cef27c4f5da63362ceee8c29a03e61ac19efda3c137b657d9ef

SHA512
1af07ab22359f69fe32e359883f7d31f3068582ba0eddcb1faf6bf7686f32f51e36cdf645ac9dd727a4bf9b8c390245d7e71faf17c1a18ff3054c55f19c770bd

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
126KB

MD5
1519cce56f4688c9479b100d690c5cbc

SHA1
27ebc6fc9b86e99a398e922d17d67975632c107b

SHA256
a23302d6242c9f2ae812d5f566f5ca0c82bcd17c698157fd6249e46f058722e2

SHA512
4f2c0c6e55e93ef0ccea1a3663f0e321ea176ffab475797e9b94afe7247cb399074df0172484d137d50df0bad6c833c9a4e30564e85b161466bb212708f5d902

Download Submit
memory/220-224-0x00000000024E0000-0x00000000025AA000-memory.dmp

Filesize
808KB

Download
memory/220-194-0x000000006BB30000-0x000000006BCB6000-memory.dmp

Filesize
1.5MB

Download
memory/220-191-0x0000000002A80000-0x0000000002C00000-memory.dmp

Filesize
1.5MB

Download
memory/220-220-0x0000000002400000-0x00000000024E0000-memory.dmp

Filesize
896KB

Download
memory/3640-296-0x0000000000740000-0x0000000000764000-memory.dmp

Filesize
144KB

Download
memory/3888-185-0x0000000000E10000-0x0000000000EFA000-memory.dmp

Filesize
936KB

Download
memory/4352-188-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-196-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-197-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-193-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-172-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-182-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-215-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-181-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-209-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-216-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-175-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-208-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-207-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-206-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-205-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-204-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-202-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-201-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-200-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-199-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-170-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-198-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-195-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-168-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-214-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-192-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-165-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-190-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-166-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-164-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-163-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-189-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-203-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-173-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-158-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-187-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-177-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-160-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-174-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-176-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-259-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4352-186-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4572-261-0x00000000070E0000-0x000000000760C000-memory.dmp

Filesize
5.2MB

Download
memory/4572-213-0x0000000000880000-0x00000000008B2000-memory.dmp

Filesize
200KB

Download
memory/4572-260-0x00000000069E0000-0x0000000006BA2000-memory.dmp

Filesize
1.8MB

Download
memory/4656-247-0x00000000030F0000-0x00000000031BA000-memory.dmp

Filesize
808KB

Download
memory/4656-238-0x0000000002A40000-0x0000000002BC0000-memory.dmp

Filesize
1.5MB

Download
memory/4656-239-0x0000000002890000-0x0000000002970000-memory.dmp

Filesize
896KB

Download
memory/4748-154-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4748-146-0x0000000000510000-0x000000000055B000-memory.dmp

Filesize
300KB

Download
memory/4748-251-0x00000000005CC000-0x00000000005FB000-memory.dmp

Filesize
188KB

Download
memory/4748-148-0x0000000004B70000-0x0000000005114000-memory.dmp

Filesize
5.6MB

Download
memory/4748-155-0x0000000005390000-0x00000000053CC000-memory.dmp

Filesize
240KB

Download
memory/4748-147-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4748-153-0x0000000005230000-0x000000000533A000-memory.dmp

Filesize
1.0MB

Download
memory/4748-152-0x00000000057D0000-0x0000000005DE8000-memory.dmp

Filesize
6.1MB

Download
memory/4748-287-0x00000000005CC000-0x00000000005FB000-memory.dmp

Filesize
188KB

Download
memory/4748-288-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4748-145-0x00000000005CC000-0x00000000005FB000-memory.dmp

Filesize
188KB

Download
memory/4780-234-0x00000000059E0000-0x0000000005A72000-memory.dmp

Filesize
584KB

Download
memory/4780-142-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4780-286-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4780-167-0x00000000010D0000-0x00000000010FE000-memory.dmp

Filesize
184KB

Download
memory/4780-285-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4780-235-0x0000000006070000-0x00000000060D6000-memory.dmp

Filesize
408KB

Download
memory/4780-240-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4780-140-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4780-143-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4780-277-0x0000000008560000-0x00000000085B0000-memory.dmp

Filesize
320KB

Download
memory/4780-276-0x00000000082E0000-0x0000000008356000-memory.dmp

Filesize
472KB

Download
memory/4780-144-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4780-157-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4780-169-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5300-274-0x0000000007910000-0x000000000791A000-memory.dmp

Filesize
40KB

Download
memory/5300-269-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download