gcleaner | ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2023 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

396KB
MD5

8786b658cc8531383511362b788f8f1c
SHA1

58da30ee843e7d5f51bdacca1ea495b84a7678fd
SHA256

ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059
SHA512

d99b28db09067135359de87244a56d039399591d29c0bcf8c7d2163f934a938c4248239d87fcb6e99b9f0bce7132e95d0581ae32e73603af489f8b1444a44f5f
SSDEEP

12288:iQi3Qa6m6URA3PhNOZm2K7YOY5p2tpNnnTIg:iQiA5hhVFf4y3Tp

Score

10^/10

gcleaner socelars evasion loader persistence spyware stealer

Malware Config

Extracted

Family

gcleaner

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

socelars

https://hdbywe.s3.us-west-2.amazonaws.com/sadef33/

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5320	7600	rundll32.exe	91

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023147-213.dat	family_socelars
behavioral2/files/0x0006000000023147-214.dat	family_socelars

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Flabs1.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	Flabs1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	Tysenaesesho.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	chenp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	gcleaner.exe

Executes dropped EXE 8 IoCs

pid	Process
404	file.tmp
5044	Flabs1.exe
2548	Tysenaesesho.exe
1460	Tysenaesesho.exe
8612	gcleaner.exe
9032	handdiy_2.exe
4424	chenp.exe
1464	chenp.exe

Loads dropped DLL 2 IoCs

pid	Process
404	file.tmp
5344	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Portable Devices\\Tysenaesesho.exe\""	Flabs1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\Tysenaesesho.exe	Flabs1.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js	handdiy_2.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230220202820.pma	setup.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html	handdiy_2.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png	handdiy_2.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\cfc6c4cc-d50c-4712-a727-7d1a5d420c6c.tmp	setup.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js	handdiy_2.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json	handdiy_2.exe
File opened for modification	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	handdiy_2.exe
File created	C:\Program Files\Windows Portable Devices\LBHNBRWPYB\poweroff.exe	Flabs1.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Tysenaesesho.exe.config	Flabs1.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js	handdiy_2.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js	handdiy_2.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js	handdiy_2.exe
File created	C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js	handdiy_2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
8872	8612	WerFault.exe	93
4252	8612	WerFault.exe	93
4100	8612	WerFault.exe	93
5304	8612	WerFault.exe	93
5404	5344	WerFault.exe	124
5500	8612	WerFault.exe	93
5656	8612	WerFault.exe	93
5912	8612	WerFault.exe	93
6320	8612	WerFault.exe	93
6464	8612	WerFault.exe	93

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5004	taskkill.exe
6488	taskkill.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	102	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe
1460	Tysenaesesho.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
8076	msedge.exe
8076	msedge.exe
8076	msedge.exe
8076	msedge.exe
8076	msedge.exe
8076	msedge.exe
8076	msedge.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	Flabs1.exe
Token: SeDebugPrivilege	2548	Tysenaesesho.exe
Token: SeDebugPrivilege	1460	Tysenaesesho.exe
Token: SeCreateTokenPrivilege	9032	handdiy_2.exe
Token: SeAssignPrimaryTokenPrivilege	9032	handdiy_2.exe
Token: SeLockMemoryPrivilege	9032	handdiy_2.exe
Token: SeIncreaseQuotaPrivilege	9032	handdiy_2.exe
Token: SeMachineAccountPrivilege	9032	handdiy_2.exe
Token: SeTcbPrivilege	9032	handdiy_2.exe
Token: SeSecurityPrivilege	9032	handdiy_2.exe
Token: SeTakeOwnershipPrivilege	9032	handdiy_2.exe
Token: SeLoadDriverPrivilege	9032	handdiy_2.exe
Token: SeSystemProfilePrivilege	9032	handdiy_2.exe
Token: SeSystemtimePrivilege	9032	handdiy_2.exe
Token: SeProfSingleProcessPrivilege	9032	handdiy_2.exe
Token: SeIncBasePriorityPrivilege	9032	handdiy_2.exe
Token: SeCreatePagefilePrivilege	9032	handdiy_2.exe
Token: SeCreatePermanentPrivilege	9032	handdiy_2.exe
Token: SeBackupPrivilege	9032	handdiy_2.exe
Token: SeRestorePrivilege	9032	handdiy_2.exe
Token: SeShutdownPrivilege	9032	handdiy_2.exe
Token: SeDebugPrivilege	9032	handdiy_2.exe
Token: SeAuditPrivilege	9032	handdiy_2.exe
Token: SeSystemEnvironmentPrivilege	9032	handdiy_2.exe
Token: SeChangeNotifyPrivilege	9032	handdiy_2.exe
Token: SeRemoteShutdownPrivilege	9032	handdiy_2.exe
Token: SeUndockPrivilege	9032	handdiy_2.exe
Token: SeSyncAgentPrivilege	9032	handdiy_2.exe
Token: SeEnableDelegationPrivilege	9032	handdiy_2.exe
Token: SeManageVolumePrivilege	9032	handdiy_2.exe
Token: SeImpersonatePrivilege	9032	handdiy_2.exe
Token: SeCreateGlobalPrivilege	9032	handdiy_2.exe
Token: 31	9032	handdiy_2.exe
Token: 32	9032	handdiy_2.exe
Token: 33	9032	handdiy_2.exe
Token: 34	9032	handdiy_2.exe
Token: 35	9032	handdiy_2.exe
Token: SeDebugPrivilege	5004	taskkill.exe
Token: SeDebugPrivilege	6488	taskkill.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe
Token: SeCreatePagefilePrivilege	6192	chrome.exe
Token: SeShutdownPrivilege	6192	chrome.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
8076	msedge.exe
8076	msedge.exe
8076	msedge.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe
6192	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4424	chenp.exe
4424	chenp.exe
1464	chenp.exe
1464	chenp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 404	4568	file.exe	83
PID 4568 wrote to memory of 404	4568	file.exe	83
PID 4568 wrote to memory of 404	4568	file.exe	83
PID 404 wrote to memory of 5044	404	file.tmp	84
PID 404 wrote to memory of 5044	404	file.tmp	84
PID 5044 wrote to memory of 2548	5044	Flabs1.exe	85
PID 5044 wrote to memory of 2548	5044	Flabs1.exe	85
PID 5044 wrote to memory of 1460	5044	Flabs1.exe	86
PID 5044 wrote to memory of 1460	5044	Flabs1.exe	86
PID 1460 wrote to memory of 7536	1460	Tysenaesesho.exe	89
PID 1460 wrote to memory of 7536	1460	Tysenaesesho.exe	89
PID 7536 wrote to memory of 8612	7536	cmd.exe	93
PID 7536 wrote to memory of 8612	7536	cmd.exe	93
PID 7536 wrote to memory of 8612	7536	cmd.exe	93
PID 2548 wrote to memory of 8076	2548	Tysenaesesho.exe	92
PID 2548 wrote to memory of 8076	2548	Tysenaesesho.exe	92
PID 8076 wrote to memory of 8664	8076	msedge.exe	94
PID 8076 wrote to memory of 8664	8076	msedge.exe	94
PID 1460 wrote to memory of 8940	1460	Tysenaesesho.exe	99
PID 1460 wrote to memory of 8940	1460	Tysenaesesho.exe	99
PID 8940 wrote to memory of 9032	8940	cmd.exe	101
PID 8940 wrote to memory of 9032	8940	cmd.exe	101
PID 8940 wrote to memory of 9032	8940	cmd.exe	101
PID 1460 wrote to memory of 1544	1460	Tysenaesesho.exe	102
PID 1460 wrote to memory of 1544	1460	Tysenaesesho.exe	102
PID 1544 wrote to memory of 4424	1544	cmd.exe	104
PID 1544 wrote to memory of 4424	1544	cmd.exe	104
PID 1544 wrote to memory of 4424	1544	cmd.exe	104
PID 9032 wrote to memory of 1764	9032	handdiy_2.exe	105
PID 9032 wrote to memory of 1764	9032	handdiy_2.exe	105
PID 9032 wrote to memory of 1764	9032	handdiy_2.exe	105
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107
PID 8076 wrote to memory of 1820	8076	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\is-VDGRB.tmp\file.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VDGRB.tmp\file.tmp" /SL5="$801C4,146662,62976,C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Users\Admin\AppData\Local\Temp\is-NVDHI.tmp\Flabs1.exe
    "C:\Users\Admin\AppData\Local\Temp\is-NVDHI.tmp\Flabs1.exe" /S /UID=flabs1
    3⤵
    - Drops file in Drivers directory
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\d0-e140a-cb0-9ca81-63c9f621b7284\Tysenaesesho.exe
      "C:\Users\Admin\AppData\Local\Temp\d0-e140a-cb0-9ca81-63c9f621b7284\Tysenaesesho.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        5⤵
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:8076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb067b46f8,0x7ffb067b4708,0x7ffb067b4718
        6⤵
        
        PID:8664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        6⤵
        
        PID:1820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
        6⤵
        
        PID:3484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
        6⤵
        
        PID:4660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
        6⤵
        
        PID:4728
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
        6⤵
        
        PID:5032
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
        6⤵
        
        PID:5620
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
        6⤵
        
        PID:6532
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
        6⤵
        
        PID:6544
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
        6⤵
        
        PID:6604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
        6⤵
        
        PID:6632
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
        6⤵
        
        PID:9152
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        Drops file in Program Files directory
        
        PID:4776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6a9755460,0x7ff6a9755470,0x7ff6a9755480
        7⤵
        
        PID:1692
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
        6⤵
        
        PID:1372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4176633023469162719,8617786544819764097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 /prefetch:2
        6⤵
        
        PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\46-1e486-b8b-833a2-14d8c96f3568f\Tysenaesesho.exe
      "C:\Users\Admin\AppData\Local\Temp\46-1e486-b8b-833a2-14d8c96f3568f\Tysenaesesho.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ewhquw5y.x0n\gcleaner.exe /mixfive & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\ewhquw5y.x0n\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\ewhquw5y.x0n\gcleaner.exe /mixfive
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:8612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 452
        7⤵
        Program crash
        
        PID:8872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 764
        7⤵
        Program crash
        
        PID:4252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 772
        7⤵
        Program crash
        
        PID:4100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 820
        7⤵
        Program crash
        
        PID:5304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 828
        7⤵
        Program crash
        
        PID:5500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 984
        7⤵
        Program crash
        
        PID:5656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 1016
        7⤵
        Program crash
        
        PID:5912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 1360
        7⤵
        Program crash
        
        PID:6320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ewhquw5y.x0n\gcleaner.exe" & exit
        7⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 1380
        7⤵
        Program crash
        
        PID:6464
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mc5jaxhe.v4n\handdiy_2.exe & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\mc5jaxhe.v4n\handdiy_2.exe
        
        C:\Users\Admin\AppData\Local\Temp\mc5jaxhe.v4n\handdiy_2.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:9032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        7⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        7⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:6192
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xe8,0x108,0x7ffb035d9758,0x7ffb035d9768,0x7ffb035d9778
        8⤵
        
        PID:6228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:2
        8⤵
        
        PID:6916
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:8
        8⤵
        
        PID:6956
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:8
        8⤵
        
        PID:7060
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3168 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:1
        8⤵
        
        PID:7228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3304 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:1
        8⤵
        
        PID:7244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3840 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:1
        8⤵
        
        PID:7352
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4728 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:1
        8⤵
        
        PID:7824
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4856 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:8
        8⤵
        
        PID:7952
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5012 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:8
        8⤵
        
        PID:8012
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:8
        8⤵
        
        PID:8392
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5312 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:8
        8⤵
        
        PID:8416
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:8
        8⤵
        
        PID:8796
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:8
        8⤵
        
        PID:6284
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:8
        8⤵
        
        PID:6316
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1832,i,12604653438890324242,14719051563700193004,131072 /prefetch:2
        8⤵
        
        PID:8440
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dmd1ce5v.s2k\chenp.exe & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\dmd1ce5v.s2k\chenp.exe
        
        C:\Users\Admin\AppData\Local\Temp\dmd1ce5v.s2k\chenp.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\dmd1ce5v.s2k\chenp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dmd1ce5v.s2k\chenp.exe" -h
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8612 -ip 8612
1⤵
PID:8796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 8612 -ip 8612
1⤵
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 8612 -ip 8612
1⤵
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 8612 -ip 8612
1⤵
PID:5272

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:5320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:5344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 604
    3⤵
    - Program crash
    PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5344 -ip 5344
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 8612 -ip 8612
1⤵
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 8612 -ip 8612
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 8612 -ip 8612
1⤵
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 8612 -ip 8612
1⤵
PID:6280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 8612 -ip 8612
1⤵
PID:6408

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:7500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html

Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png

Filesize
6KB

MD5
362695f3dd9c02c83039898198484188

SHA1
85dcacc66a106feca7a94a42fc43e08c806a0322

SHA256
40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca

SHA512
a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js

Filesize
13KB

MD5
4ff108e4584780dce15d610c142c3e62

SHA1
77e4519962e2f6a9fc93342137dbb31c33b76b04

SHA256
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

SHA512
d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js

Filesize
20KB

MD5
09c79b00daf1dbeb3ddd130ab5e816d1

SHA1
83d65f836d05a3febad1f70e01c3ef5348c47a69

SHA256
417a6314684a9d7d998526450fcc5950f7a87e6a7fbdb49498b31eb9e72c1b83

SHA512
f2704ee3dd5cbd2af819f3702728666e5e94278f5f35eb55809083c75b38339785fa6c48984297030e568ae5e399b49b8cd80db40f2cfae00e422b6df4e4aabd

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js

Filesize
3KB

MD5
c31f14d9b1b840e4b9c851cbe843fc8f

SHA1
205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4

SHA256
03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54

SHA512
2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js

Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js

Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js

Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json

Filesize
1KB

MD5
05bfb082915ee2b59a7f32fa3cc79432

SHA1
c1acd799ae271bcdde50f30082d25af31c1208c3

SHA256
04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1

SHA512
6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
5953d7fc88c4ecded1ac833a521472d7

SHA1
8b8402eeca680511d46b4c9733128a2f26f898dc

SHA256
8f55adc16cb5f0df2ff27ddd88f85551c2585c804faef846a1e00fe7abe001ac

SHA512
371cf1b0832d5346c49e14037d21112f9b2c6c9facde31271b9de318900914fd04916138976f9990a61b6e128cc03eab2975ab7eac091e99cfe79212931de4a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0861fde93f2288e73377be21260a59f7

SHA1
2de9939699717df9e81d0781216d73a34f030b96

SHA256
957f0124199b847a48d9c63ce32cde6a9a565b7b2d47ea4dced137606f87265a

SHA512
b4bbe01c2351508fa27dd14241240057ceeb4de587301c48cb32e93a470ea6e1309ca380056830e832657c9389c657b52ae1a3e353857824efebb264429f65ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
707B

MD5
f4bc2229bfd3dc42f84336828c96c571

SHA1
928f8e7ae5d31729aaf7c5913c6ccdeddd782d0a

SHA256
5859e0f11e82c7642ab988cd7fccf190a3fb45fd44d7c97624f52184451804fb

SHA512
23a0756f70effd90743ea4a54900021916c9865964af125663dd5e8ab6e9abe169dbd79694040991d0863e3b35052361a73e79d1866b60f867b33013abefbcde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
5d2993def93c99bd43c26de207c81643

SHA1
e3d4de67e8c1c17c909dcb42eff99ff0ec7ba5dc

SHA256
46af73f654ac36bd1a99d791df1f06d19c4f639ed95d0787ffb81639b6e3a2de

SHA512
50f871dfee83a58e675621b0db82af42db71c7cb138a12644a1b40e2a98ff871a86d1fac8fb79917801b1fb4bbec52cdbb0c6e3a4a46023f0e5df345c5a503c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
9a25e9115019293e5d1c707db497ebaf

SHA1
aabfc863b09f6ba3c192764feccdffceeb624521

SHA256
dc4bd0b1aee380af0b3912fd3fdab54d4d8ddcb051d594e90814c68c97d0587a

SHA512
6ad40dc1eed4734ca15bc5d7197c883472e78c730e216b3506f22ebb1361e0bb5576040d103bd4e5d067589a1df9866bb97126adb1d7b70b58db41e254efd45a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
691c602c524101ac1a89c7a7099a0d83

SHA1
cca1934caeda95ac74c4cfe670a1baf5525e9701

SHA256
0432af424dbaeac605c79e9e9dcb29c6e035b65462602ba312c4e65ae29ef549

SHA512
89c6d6371a56e2ceb641718e4fee1fba867e8253b3503703e408c68be81ec1f8b43d91c38ce06d424b4dd87ca014d3d3f4abee3538db6c2f6aa1cfadb81e063c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3f81041d92a086e1d643bdd54e5f15ef

SHA1
9519a4e90fd40ad7ef1ba7f2c1f6088afd792232

SHA256
df8eb733b2acc337738a351f9006a409dc7882a49b0f29d9a5c861a6603657d6

SHA512
c08f30845a86f401fc48a1e1f2685b7a45823fc5b65ba0c05ef84942bc1d69eaa13c9afc490593f77644947bb517bcb5f02ec202185335ecaff020093f09f905

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7edf9a210527d5c3e0c708d8129503d9

SHA1
263d13883239416f20b140bb66ee0613ffd27299

SHA256
8ffea6912c8a8012eefc2bac5fc09d6238c5ee0a572bd0afdfc3e4441a42c3f2

SHA512
209a6967291e6b0cc9e9ef114619e9c85e4f237eb174d0ae963e4c880cb8b6cb93540f9bbeb20e4a6062fca6e92b1011d1c6b39559aeee60bb4fc21f969aebb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
1cb8a8299921d6e0c6aebf0d6d422bda

SHA1
84772e39f1361d103801faaeea9ba09a66d0ed2a

SHA256
6130dcd359cad8069de8f4b0dbfcccc8489af3e4be81cfa1862f6276e4172e33

SHA512
62069d87faf3568de4efff4512b088b9b9bc35816818d44c205ac95d6142102be664fd3fe929960548c420940c05b68bf238dadd8ac123b6334a2cb378e560f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
adef652e6d2a75f1a55e1e1eec8926c7

SHA1
e641500e871f486f74da63e8d38226931fc09d62

SHA256
c5aa5657e4efcaa830509f3413e9675f65bf9355810a7db3f5a03cc74402b9b9

SHA512
dc7fde1f86ad846a8d53338344a02f391dbb4132236e8af0c7644c96c2f71f73861a636af9f6a739a10c60b9549f505b401e349bbbcdcd909c8ab429f5f94922

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
145KB

MD5
3bc61d742a30b0db3e042748a23fd306

SHA1
c941f3f5bc387251d0c1af88d71200b460be8d32

SHA256
836ca6d3187d852dfa2a904ae53416fd9183ca716da1823ce25dbff3ab2568e9

SHA512
28ce434da960e95e0f87a7a40ef82689a886bd12989848a4be5c698673643cb5dc0e26928f527fb21c09d54a2d724c8850b0a2434aef1e70d557929e60897629

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
144KB

MD5
a6e974ce5cd0d34be0f45d233eaf5d2e

SHA1
8013788c5644958494a19917d443efffecd88bdc

SHA256
d4d76392d5ea98f5a822a16a75539e531e60efab60ed3a3719243321f4b2c877

SHA512
d731f779ef5b3f8381fc172aa01248ab81e23f2648063c0d5ddda16fb0d75fbc5ef82bbb85c24441b4f7f1c2bb47d563570311cb7111983319eaf27b55386bdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
72KB

MD5
d663ca010de0b01d66fe375355ed594a

SHA1
c73928e2717a88938b6cbea4d97132776ed44e0e

SHA256
27ff660827cbceb6eddefc8542a5256f4e37ff4f94f0f5294e26fc9d3fae080d

SHA512
6ba4cee10f9962988d68d8c7bdcc27970713d545b027c6d1c15fc759bea26d4d6f43adb3895fa4ee5064114330335bc031dd1c54a33d7593c64a17893d046d60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cd4f5fe0fc0ab6b6df866b9bfb9dd762

SHA1
a6aaed363cd5a7b6910e9b3296c0093b0ac94759

SHA256
3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

SHA512
7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73c23821-f866-46cc-97c7-28490f28ef14.tmp

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
3a2123e2045446217e88abdea7413fbc

SHA1
925d90fc397127264fd917263dabf655f99a7490

SHA256
c386e4dcb399ed222a928b4f0fadba6f7720e9e64d62317f0c8aa7b90b3b4c20

SHA512
d768cab4e1467f49767920f10a0f1cefde237a817dc6e96c83b4eb4420b8ea79d9c56e4e23bdad67993df6bf4b212edc84b1f34b6b9b42c13289e22d99e49010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
13cc579b7006f96943a0f739c2206497

SHA1
dcbf2b5e912521170b2f0f38e1d8ca6dc9e2cc98

SHA256
0547669307f01aa3d7079e1c696d57380a219e5ea368e219ca5c8974a3e56421

SHA512
d375bfcbc6779648954e06902031f233e82514a6dd9c52e531457449db04cf58b8a5956eb38602ff59308dfa7b121644752b089b4dce789b137542bb0d518b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
50ba3883fa2ee39bb9413b2b397e0ba7

SHA1
994064e1bd774ae1d38467c003caae058cc95df6

SHA256
b300cd4ca25c2558965d58ec115d5c377f84b222e8c48caa26067e2d2b48ed15

SHA512
c92312e8d343784749c59f9f0a4e00ddb9416ad183ec65c28276cf1f14f34e7e005a97282c7ee2a3e316d0e96f3d742ccca8a71203fb11f6d2f6d8a8b86dc77d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
682B

MD5
6691c8bdf7e0faf124197918d9c2170e

SHA1
2fe6309f2e52653acc4ab94a79f5d44233005285

SHA256
dc39eeae9bcff2025d4a1b19d819f10936123f7fe575ce0483c79302a156e79c

SHA512
e32dd471bd66c79bc7719c2f7b9f7a5c486c1d5cb63ec84b8c79773a7a87be15bf33844d8ee834f83cb892075eb7be23c3e7805b3bf4dd22998bc54f79ec5cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
5803342cd34853a5b762ec28b3a17f53

SHA1
f355a96cadf7ea225f96c020d2ad3fe8b2d8f8bf

SHA256
6ec2e16a14996b94aa5d11f9481835e2110cc306305ea1245fe5d8c98bd5918a

SHA512
253be140247271d08e529407422595246f48193889c1008be179160721f6a31d41fbb93ecf2ee26a1b11e0b3fda9fc6bf3da3a782d88e2bc45f5ddb46526c5f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97a3b0dc656d7e8ec6151b266b566ce5

SHA1
1224a89290030b9c547ed441d4a02b94d01a599b

SHA256
1b0cbd3e3779973cde845f8d7121a75275444202db43d12551c4e1241b26ed67

SHA512
9eaf520640cf6ad5009cc3bc9b760e90b5e9ec2048a29e77468c3df391127d2bd91f1a97266235fb8db50b2819421a77bb151e8c9cba51e61b8a580a513c2cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f05404f60da546b0bb310658fc2f779

SHA1
83a104e594cf286766e7783a92eab345f736bec0

SHA256
c3e76525f7625fe32922d3dee0b5f60b121fda5854c1b87a0158287014b34a30

SHA512
35e037756a85b95457c5101e62727f873616ad0e8358a2f5c6bd4fcef0ba104868ff93555c492b031f1cc999966a174e24ecd63475cf02206b3988c85690106d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1463bf2a54e759c40d9ad64228bf7bec

SHA1
2286d0ac3cfa9f9ca6c0df60699af7c49008a41f

SHA256
9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df

SHA512
33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
2eb335fd17d537cb2674503d20cfc888

SHA1
6b3f05d34809b7b24f3faa01364d6da747490447

SHA256
8e7bbf976b986568a72283e0955f344dc37d705eaa99a69e71e60d6b6534a352

SHA512
f4e38a69af239a996935ae360a48e42e6bba0833193c80d42efafb4a7b669d91f2a304d0623802ab31563905a5a2a37b9f70efa0e1ca98e6237171e1e16a6b08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5709f3.TMP

Filesize
48B

MD5
5d977a55f39e47294f88153ccc32ba9f

SHA1
b402b08811e58d360a803492f17f058337276338

SHA256
8f550817a15332e2b7fc770f960358bcca132f8a6aa817a3be243184479d0cd9

SHA512
39f6069a9c4ae84f79898008a8c59ec80982e59cc3aaffc6806f8ff7fbe3a85f18b67652c8a28534145dc5766221d092bc0f59bba8535613f33b27d8d21f9321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
a7480b903f0041c2ba9e45b3fb6ba638

SHA1
db3ff541cddcb27103a633c394888bd72edcbebd

SHA256
c9b47dcad14becc33225c80b922b7a36032ae9c3469b2d464312b1816951ed54

SHA512
758d9a9b792efec6e8cc7ec714ca84919f15fc29d16fe94e567cc0fe6036b7c706e87420fdbc704d6b654e0895f604e6571f3ab8629b1c13dbf5ac0eb60a445a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3355534eda80e206f0250beb5a81c48a

SHA1
a92c83aeb2cd87ad684c6cabf38f82f65102b5da

SHA256
8d73a887355fc771f6a10d21b2651220a74e0d532982febdc568b37b9801748e

SHA512
8ed8e06ef8e2ce46994b87198079c79a1241f084e803eee01ed996ce77ff42f5c9a578f44c0f181480ce8de38ccf6104f54f65dd1447e295fad1999d628e912f

Download Submit
C:\Users\Admin\AppData\Local\Temp\46-1e486-b8b-833a2-14d8c96f3568f\Kenessey.txt

Filesize
9B

MD5
97384261b8bbf966df16e5ad509922db

SHA1
2fc42d37fee2c81d767e09fb298b70c748940f86

SHA256
9c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c

SHA512
b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21

Download Submit
C:\Users\Admin\AppData\Local\Temp\46-1e486-b8b-833a2-14d8c96f3568f\Tysenaesesho.exe

Filesize
463KB

MD5
fba3b4b12a0c6c9924132b149147a0a2

SHA1
a776068968a89ff9503e794e4ab0c04bbee6e5f6

SHA256
7403a6d53688cddeb84997cf90f616a3f25e79681b9c47074b5534f4e8b45890

SHA512
a1a41956ee97b4e590795a319d357f7f1b22115f5f663211af71cb14ffae879cb0fda743c7a016bb1a479d64dacee2f865e67f29d589d30d10b928a2bbb628ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\46-1e486-b8b-833a2-14d8c96f3568f\Tysenaesesho.exe

Filesize
463KB

MD5
fba3b4b12a0c6c9924132b149147a0a2

SHA1
a776068968a89ff9503e794e4ab0c04bbee6e5f6

SHA256
7403a6d53688cddeb84997cf90f616a3f25e79681b9c47074b5534f4e8b45890

SHA512
a1a41956ee97b4e590795a319d357f7f1b22115f5f663211af71cb14ffae879cb0fda743c7a016bb1a479d64dacee2f865e67f29d589d30d10b928a2bbb628ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\46-1e486-b8b-833a2-14d8c96f3568f\Tysenaesesho.exe

Filesize
463KB

MD5
fba3b4b12a0c6c9924132b149147a0a2

SHA1
a776068968a89ff9503e794e4ab0c04bbee6e5f6

SHA256
7403a6d53688cddeb84997cf90f616a3f25e79681b9c47074b5534f4e8b45890

SHA512
a1a41956ee97b4e590795a319d357f7f1b22115f5f663211af71cb14ffae879cb0fda743c7a016bb1a479d64dacee2f865e67f29d589d30d10b928a2bbb628ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\46-1e486-b8b-833a2-14d8c96f3568f\Tysenaesesho.exe.config

Filesize
1KB

MD5
98d2687aec923f98c37f7cda8de0eb19

SHA1
f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

SHA256
8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

SHA512
95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0-e140a-cb0-9ca81-63c9f621b7284\Tysenaesesho.exe

Filesize
399KB

MD5
1e8e3939ec32c19b2031d50cc9875084

SHA1
83cc7708448c52f5c184cc329fa11f4cfe9c2823

SHA256
5988245cd9d0c40bcb12155b966cb8ddd86da1107bca456341de5bd5fb560808

SHA512
0d3ad7c0865e421fad34e27a47108fdc9e359f8603c4c01f6d789d3ead6e6ac5815f979301870f8157fedaf8178ed34873fbff807807d46698249f098fc78caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0-e140a-cb0-9ca81-63c9f621b7284\Tysenaesesho.exe

Filesize
399KB

MD5
1e8e3939ec32c19b2031d50cc9875084

SHA1
83cc7708448c52f5c184cc329fa11f4cfe9c2823

SHA256
5988245cd9d0c40bcb12155b966cb8ddd86da1107bca456341de5bd5fb560808

SHA512
0d3ad7c0865e421fad34e27a47108fdc9e359f8603c4c01f6d789d3ead6e6ac5815f979301870f8157fedaf8178ed34873fbff807807d46698249f098fc78caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0-e140a-cb0-9ca81-63c9f621b7284\Tysenaesesho.exe

Filesize
399KB

MD5
1e8e3939ec32c19b2031d50cc9875084

SHA1
83cc7708448c52f5c184cc329fa11f4cfe9c2823

SHA256
5988245cd9d0c40bcb12155b966cb8ddd86da1107bca456341de5bd5fb560808

SHA512
0d3ad7c0865e421fad34e27a47108fdc9e359f8603c4c01f6d789d3ead6e6ac5815f979301870f8157fedaf8178ed34873fbff807807d46698249f098fc78caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0-e140a-cb0-9ca81-63c9f621b7284\Tysenaesesho.exe.config

Filesize
1KB

MD5
98d2687aec923f98c37f7cda8de0eb19

SHA1
f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

SHA256
8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

SHA512
95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dat

Filesize
557KB

MD5
76c3dbb1e9fea62090cdf53dadcbe28e

SHA1
d44b32d04adc810c6df258be85dc6b62bd48a307

SHA256
556fd54e5595d222cfa2bd353afa66d8d4d1fbb3003afed604672fceae991860

SHA512
de4ea57497cf26237430880742f59e8d2a0ac7e7a0b09ed7be590f36fbd08c9ced0ffe46eb69ec2215a9cff55720f24fffcae752cd282250b4da6b75a30b3a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\dmd1ce5v.s2k\chenp.exe

Filesize
308KB

MD5
b5e1e946ebad560b876703e9675ca326

SHA1
c0e2e24a911a4d8e9cbc5a483ef8876fbabfa772

SHA256
c33ecac87bf07fc75b6768b76622daac389e05ef718c457e0393238d646bb130

SHA512
8ee9e9af2731eb83af3f17aa19b9a74547429f026882fb6d592d74d97ed958f990f46c5be5371e06360503672e9f8ca00ccf9d64ed59d11475c86a6f35ac1ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dmd1ce5v.s2k\chenp.exe

Filesize
308KB

MD5
b5e1e946ebad560b876703e9675ca326

SHA1
c0e2e24a911a4d8e9cbc5a483ef8876fbabfa772

SHA256
c33ecac87bf07fc75b6768b76622daac389e05ef718c457e0393238d646bb130

SHA512
8ee9e9af2731eb83af3f17aa19b9a74547429f026882fb6d592d74d97ed958f990f46c5be5371e06360503672e9f8ca00ccf9d64ed59d11475c86a6f35ac1ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dmd1ce5v.s2k\chenp.exe

Filesize
308KB

MD5
b5e1e946ebad560b876703e9675ca326

SHA1
c0e2e24a911a4d8e9cbc5a483ef8876fbabfa772

SHA256
c33ecac87bf07fc75b6768b76622daac389e05ef718c457e0393238d646bb130

SHA512
8ee9e9af2731eb83af3f17aa19b9a74547429f026882fb6d592d74d97ed958f990f46c5be5371e06360503672e9f8ca00ccf9d64ed59d11475c86a6f35ac1ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewhquw5y.x0n\gcleaner.exe

Filesize
376KB

MD5
2269a6f3d0cede0cf190c0424ab5b853

SHA1
d70ffdf1db784115ce479a778e1eeec184460e4b

SHA256
241e61a533e5de6485fbd2f5c6bce8fdfca5081a4f81bc89113f50c302494e0b

SHA512
4f6d546a93734af2a85d2409ac28f09786ea05eefc2986250064854bd430ca7ddf6cbe70a1274c8d9c541b60276e01cb2f0f8a78d67e33fc83eae57fca98bd1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewhquw5y.x0n\gcleaner.exe

Filesize
376KB

MD5
2269a6f3d0cede0cf190c0424ab5b853

SHA1
d70ffdf1db784115ce479a778e1eeec184460e4b

SHA256
241e61a533e5de6485fbd2f5c6bce8fdfca5081a4f81bc89113f50c302494e0b

SHA512
4f6d546a93734af2a85d2409ac28f09786ea05eefc2986250064854bd430ca7ddf6cbe70a1274c8d9c541b60276e01cb2f0f8a78d67e33fc83eae57fca98bd1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NVDHI.tmp\Flabs1.exe

Filesize
303KB

MD5
ee726f15ff7c438fc1faf75032a81028

SHA1
86fdbb74d64fce06fe518ee220f5f5bafced7214

SHA256
4c78cca2ac2fa4d8f2e0c47e0f2785242825da458f00e5337cd56f157ff4bd97

SHA512
d9c16d6e027dadd8f8e7ed90e9993a20c4244dc7475a2e5674c1be7a43218824250a3453f97220a960fd886c0760a32d9cfb848e94055a82f7af3dcc401bb0de

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NVDHI.tmp\Flabs1.exe

Filesize
303KB

MD5
ee726f15ff7c438fc1faf75032a81028

SHA1
86fdbb74d64fce06fe518ee220f5f5bafced7214

SHA256
4c78cca2ac2fa4d8f2e0c47e0f2785242825da458f00e5337cd56f157ff4bd97

SHA512
d9c16d6e027dadd8f8e7ed90e9993a20c4244dc7475a2e5674c1be7a43218824250a3453f97220a960fd886c0760a32d9cfb848e94055a82f7af3dcc401bb0de

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NVDHI.tmp\idp.dll

Filesize
216KB

MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VDGRB.tmp\file.tmp

Filesize
700KB

MD5
98d2d99fc3af8c3cf275413037eba7da

SHA1
a922a0f5a229990301f0cf53b74c4b69fa9e82e3

SHA256
a6657d272d82dc1da0704c458274e4cf1e94a465569bc17abc8e7ae2f5d31003

SHA512
125fef09f222e154568b7dcff309381f2f7ca5e3536b98a8995563d642d56a787ba9808a144f6d83e84a2a44e279359213ea034ab7f9637fd43e3952e54a3618

Download Submit
C:\Users\Admin\AppData\Local\Temp\mc5jaxhe.v4n\handdiy_2.exe

Filesize
1.4MB

MD5
c40e098b934dd5baaff26717530d6d4d

SHA1
c11ef5cc4723bd97d34bc6f11bdfc11cb2ddf480

SHA256
e9c3b78b6059b1decae5365a506fc39b21e5babd13dbfd21920f4406c3217c1c

SHA512
0da40ffcf2674dc46784b499eedb8eb3c2aabf18a1fa1af2433599a3b886cec21f027b9be6e7e6461fb4cbeebebe0dd418f50319174f971d4324b252b4d37f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mc5jaxhe.v4n\handdiy_2.exe

Filesize
1.4MB

MD5
c40e098b934dd5baaff26717530d6d4d

SHA1
c11ef5cc4723bd97d34bc6f11bdfc11cb2ddf480

SHA256
e9c3b78b6059b1decae5365a506fc39b21e5babd13dbfd21920f4406c3217c1c

SHA512
0da40ffcf2674dc46784b499eedb8eb3c2aabf18a1fa1af2433599a3b886cec21f027b9be6e7e6461fb4cbeebebe0dd418f50319174f971d4324b252b4d37f8c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
50e8c89e07bf9b2d8dfc59b386187e65

SHA1
5eeab86165ee4fe428ab3f454d37904a2a0d71af

SHA256
a8e0363a19d6c236338222d25fd69e6ff91a761eb2fbe0372d3d29f0d18ed419

SHA512
e8e58b767b8b9cd06e20ca0f066f76287f42cb10bcb2c4cbf4b89d64f7976730a35a83998f5636d7aaa2db2029e5cb6f05bd463bdc94ae75b07461053be7871e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
35a44fbb8485a73d42c2c891ac16ac14

SHA1
dd5c53762850fb2e53f761fa0b8398cc6c3bfea1

SHA256
ea8554b2569e65ebc5bd524047c5335dbbdaa0c39aeb507ea0ae15b300bba78b

SHA512
da437ae89889898364ffd8f895a004473b29b830ee5bcefd0a9038b5708bd7e18a8e21f57d3aae1de5b8ee889f9f47fc3673b3f6836898da435093834b2cc853

Download Submit
memory/404-189-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/404-146-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/1460-200-0x000000001FFC0000-0x00000000202CE000-memory.dmp

Filesize
3.1MB

Download
memory/1460-201-0x0000000000D10000-0x0000000000D20000-memory.dmp

Filesize
64KB

Download
memory/1460-193-0x00000000001F0000-0x000000000026A000-memory.dmp

Filesize
488KB

Download
memory/1460-195-0x0000000000A30000-0x0000000000A96000-memory.dmp

Filesize
408KB

Download
memory/1460-196-0x000000001B8B0000-0x000000001BD7E000-memory.dmp

Filesize
4.8MB

Download
memory/1460-394-0x0000000000D10000-0x0000000000D20000-memory.dmp

Filesize
64KB

Download
memory/1460-361-0x0000000000D10000-0x0000000000D20000-memory.dmp

Filesize
64KB

Download
memory/1460-197-0x000000001BF20000-0x000000001BFBC000-memory.dmp

Filesize
624KB

Download
memory/1460-198-0x000000001C8C0000-0x000000001C8C8000-memory.dmp

Filesize
32KB

Download
memory/1460-199-0x000000001CA10000-0x000000001CA6E000-memory.dmp

Filesize
376KB

Download
memory/1460-203-0x00000000203F0000-0x0000000020452000-memory.dmp

Filesize
392KB

Download
memory/1820-239-0x00007FFB255B0000-0x00007FFB255B1000-memory.dmp

Filesize
4KB

Download
memory/2548-360-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

Filesize
64KB

Download
memory/2548-194-0x0000000000520000-0x000000000058A000-memory.dmp

Filesize
424KB

Download
memory/2548-192-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

Filesize
64KB

Download
memory/4568-133-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4568-191-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5044-155-0x000000001B4C0000-0x000000001B4D0000-memory.dmp

Filesize
64KB

Download
memory/5044-154-0x0000000000750000-0x00000000007A2000-memory.dmp

Filesize
328KB

Download
memory/6916-406-0x00007FFB255B0000-0x00007FFB255B1000-memory.dmp

Filesize
4KB

Download
memory/7952-470-0x00007FFB24D40000-0x00007FFB24D41000-memory.dmp

Filesize
4KB

Download
memory/7952-469-0x00007FFB24C40000-0x00007FFB24C41000-memory.dmp

Filesize
4KB

Download
memory/8440-711-0x000002243FE50000-0x000002243FE51000-memory.dmp

Filesize
4KB

Download
memory/8440-710-0x000002243FE50000-0x000002243FE51000-memory.dmp

Filesize
4KB

Download
memory/8440-712-0x000002243FE50000-0x000002243FE51000-memory.dmp

Filesize
4KB

Download
memory/8440-717-0x000002243FE50000-0x000002243FE51000-memory.dmp

Filesize
4KB

Download
memory/8440-716-0x000002243FE50000-0x000002243FE51000-memory.dmp

Filesize
4KB

Download
memory/8440-719-0x000002243FE50000-0x000002243FE51000-memory.dmp

Filesize
4KB

Download
memory/8440-718-0x000002243FE50000-0x000002243FE51000-memory.dmp

Filesize
4KB

Download
memory/8440-721-0x000002243FE50000-0x000002243FE51000-memory.dmp

Filesize
4KB

Download
memory/8440-720-0x000002243FE50000-0x000002243FE51000-memory.dmp

Filesize
4KB

Download
memory/8440-722-0x000002243FE50000-0x000002243FE51000-memory.dmp

Filesize
4KB

Download
memory/8612-212-0x0000000000660000-0x00000000006A0000-memory.dmp

Filesize
256KB

Download
memory/8612-395-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download