Malware Analysis Report

2025-05-28 16:27

Sample ID 230715-12b63acg7v
Target protmepls_BUT_BETTER_.exe
SHA256 dcfbfc44d17764159537d568afbe19e7bd981f08888c1e9fce9024a993858c28
Tags
themida agilenet evasion trojan
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

dcfbfc44d17764159537d568afbe19e7bd981f08888c1e9fce9024a993858c28

Threat Level: Likely malicious

The file protmepls_BUT_BETTER_.exe was found to be: Likely malicious.

Malicious Activity Summary

themida agilenet evasion trojan

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Themida packer

Checks computer location settings

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Executes dropped EXE

Checks BIOS information in registry

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-15 22:08

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-15 22:08

Reported

2023-07-15 22:11

Platform

win7-20230712-en

Max time kernel

117s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\protmepls.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A
N/A N/A C:\Users\Admin\protmepls.exe N/A
N/A N/A N/A N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 924 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 924 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 924 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 924 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 924 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Users\Admin\protmepls.exe
PID 924 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Users\Admin\protmepls.exe
PID 924 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Users\Admin\protmepls.exe
PID 924 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Users\Admin\protmepls.exe
PID 2108 wrote to memory of 836 N/A C:\Users\Admin\protmepls.exe C:\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe
PID 2108 wrote to memory of 836 N/A C:\Users\Admin\protmepls.exe C:\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe
PID 2108 wrote to memory of 836 N/A C:\Users\Admin\protmepls.exe C:\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe
PID 2108 wrote to memory of 836 N/A C:\Users\Admin\protmepls.exe C:\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe

Processes

C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe

"C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAbQBnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AdwBhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdQBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAaABxACMAPgA="

C:\Users\Admin\protmepls.exe

"C:\Users\Admin\protmepls.exe"

C:\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe

"C:\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe"

Network

N/A

Files

memory/924-54-0x0000000000400000-0x0000000001F4A000-memory.dmp

memory/924-55-0x00000000778A0000-0x00000000778A2000-memory.dmp

memory/924-56-0x0000000000400000-0x0000000001F4A000-memory.dmp

C:\Users\Admin\protmepls.exe

MD5 1bc9df12a338938019d8a42237566b5f
SHA1 4a1139848239d0fab1a07d2e328dc3732b92bdab
SHA256 f8759733e825b911c48356f73a1c4fe1b703ecad786a773a8963c4eeff4afc94
SHA512 506b56b43d271f38eba4612f8310ee1ec2ccb413e105a4cd493165aa975e0431900eef0be0eaa25d01081b9ce8117121e08ebdd0cde47178a7560afd6161e465

\Users\Admin\protmepls.exe

MD5 1bc9df12a338938019d8a42237566b5f
SHA1 4a1139848239d0fab1a07d2e328dc3732b92bdab
SHA256 f8759733e825b911c48356f73a1c4fe1b703ecad786a773a8963c4eeff4afc94
SHA512 506b56b43d271f38eba4612f8310ee1ec2ccb413e105a4cd493165aa975e0431900eef0be0eaa25d01081b9ce8117121e08ebdd0cde47178a7560afd6161e465

C:\Users\Admin\protmepls.exe

MD5 1bc9df12a338938019d8a42237566b5f
SHA1 4a1139848239d0fab1a07d2e328dc3732b92bdab
SHA256 f8759733e825b911c48356f73a1c4fe1b703ecad786a773a8963c4eeff4afc94
SHA512 506b56b43d271f38eba4612f8310ee1ec2ccb413e105a4cd493165aa975e0431900eef0be0eaa25d01081b9ce8117121e08ebdd0cde47178a7560afd6161e465

memory/924-62-0x0000000000400000-0x0000000001F4A000-memory.dmp

memory/2108-65-0x0000000000900000-0x0000000000984000-memory.dmp

memory/2108-66-0x0000000074230000-0x000000007491E000-memory.dmp

memory/2108-67-0x0000000004A00000-0x0000000004A40000-memory.dmp

memory/2108-70-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1500-71-0x0000000072230000-0x00000000727DB000-memory.dmp

memory/1500-72-0x0000000072230000-0x00000000727DB000-memory.dmp

memory/1500-73-0x00000000001D0000-0x0000000000210000-memory.dmp

memory/1500-74-0x00000000001D0000-0x0000000000210000-memory.dmp

memory/1500-97-0x00000000001D0000-0x0000000000210000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe

MD5 4b07d4daa90e051ca065e497c8d21346
SHA1 248cce5809f7dbde17402ecb36bced1b071f9972
SHA256 70795c1cda206491cafa049ad16bb7def36c08462e9133e7cea2ed55f1e61848
SHA512 0c765fd2d67fe215942b838acd27f23298645eed56acc73dce75f721501f5fa8b89e37a3303b6ce2a6a1f111885e8d28a280cfb985d1b6521698a7bb77622545

\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe

MD5 4b07d4daa90e051ca065e497c8d21346
SHA1 248cce5809f7dbde17402ecb36bced1b071f9972
SHA256 70795c1cda206491cafa049ad16bb7def36c08462e9133e7cea2ed55f1e61848
SHA512 0c765fd2d67fe215942b838acd27f23298645eed56acc73dce75f721501f5fa8b89e37a3303b6ce2a6a1f111885e8d28a280cfb985d1b6521698a7bb77622545

\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe

MD5 4b07d4daa90e051ca065e497c8d21346
SHA1 248cce5809f7dbde17402ecb36bced1b071f9972
SHA256 70795c1cda206491cafa049ad16bb7def36c08462e9133e7cea2ed55f1e61848
SHA512 0c765fd2d67fe215942b838acd27f23298645eed56acc73dce75f721501f5fa8b89e37a3303b6ce2a6a1f111885e8d28a280cfb985d1b6521698a7bb77622545

\Users\Admin\AppData\Local\Temp\protmepls_1a292930-93cd-4359-8cae-971b56d16345\OMM Loader.exe

MD5 4b07d4daa90e051ca065e497c8d21346
SHA1 248cce5809f7dbde17402ecb36bced1b071f9972
SHA256 70795c1cda206491cafa049ad16bb7def36c08462e9133e7cea2ed55f1e61848
SHA512 0c765fd2d67fe215942b838acd27f23298645eed56acc73dce75f721501f5fa8b89e37a3303b6ce2a6a1f111885e8d28a280cfb985d1b6521698a7bb77622545

memory/1500-177-0x0000000072230000-0x00000000727DB000-memory.dmp

memory/2108-178-0x0000000074230000-0x000000007491E000-memory.dmp

memory/2108-179-0x0000000004A00000-0x0000000004A40000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-15 22:08

Reported

2023-07-15 22:11

Platform

win10v2004-20230703-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 777007.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1644 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1644 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1644 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1644 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Windows\System32\CompPkgSrv.exe
PID 1644 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Windows\System32\CompPkgSrv.exe
PID 1644 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe C:\Windows\System32\CompPkgSrv.exe
PID 1648 wrote to memory of 3932 N/A C:\Windows\System32\CompPkgSrv.exe C:\Users\Admin\AppData\Local\Temp\protmepls_b69eae24-8547-42a0-be3a-b8f55eaf90b1\OMM Loader.exe
PID 1648 wrote to memory of 3932 N/A C:\Windows\System32\CompPkgSrv.exe C:\Users\Admin\AppData\Local\Temp\protmepls_b69eae24-8547-42a0-be3a-b8f55eaf90b1\OMM Loader.exe
PID 3932 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_b69eae24-8547-42a0-be3a-b8f55eaf90b1\OMM Loader.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3932 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\protmepls_b69eae24-8547-42a0-be3a-b8f55eaf90b1\OMM Loader.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2576 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2576 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3492 wrote to memory of 2668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe

"C:\Users\Admin\AppData\Local\Temp\protmepls_BUT_BETTER_.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAbQBnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AdwBhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAdQBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAaABxACMAPgA="

C:\Users\Admin\protmepls.exe

"C:\Users\Admin\protmepls.exe"

C:\Users\Admin\AppData\Local\Temp\protmepls_b69eae24-8547-42a0-be3a-b8f55eaf90b1\OMM Loader.exe

"C:\Users\Admin\AppData\Local\Temp\protmepls_b69eae24-8547-42a0-be3a-b8f55eaf90b1\OMM Loader.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.13&gui=true

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5bd046f8,0x7ffc5bd04708,0x7ffc5bd04718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3468 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5908 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6648741069571374850,5797565471835798010,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6272 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 aka.ms udp
GB 104.89.84.63:443 aka.ms tcp
US 8.8.8.8:53 dotnet.microsoft.com udp
US 13.107.253.67:443 dotnet.microsoft.com tcp
US 8.8.8.8:53 67.253.107.13.in-addr.arpa udp
US 8.8.8.8:53 63.84.89.104.in-addr.arpa udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 13.107.246.67:443 js.monitor.azure.com tcp
NL 104.85.1.163:443 www.microsoft.com tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.67:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 67.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 163.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 160.252.72.23.in-addr.arpa udp
NL 104.85.1.163:443 www.microsoft.com tcp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 104.208.16.90:443 browser.events.data.microsoft.com tcp
US 104.208.16.90:443 browser.events.data.microsoft.com tcp
US 13.107.246.67:443 wcpstatic.microsoft.com tcp
US 104.208.16.90:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 download.visualstudio.microsoft.com udp
US 93.184.215.201:443 download.visualstudio.microsoft.com tcp
US 93.184.215.201:443 download.visualstudio.microsoft.com tcp
US 8.8.8.8:53 w.usabilla.com udp
US 18.215.195.247:443 w.usabilla.com tcp
US 104.208.16.90:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 247.195.215.18.in-addr.arpa udp
US 8.8.8.8:53 201.215.184.93.in-addr.arpa udp
US 8.8.8.8:53 17.211.227.13.in-addr.arpa udp
US 8.8.8.8:53 d6tizftlrpuof.cloudfront.net udp
NL 65.9.84.208:443 d6tizftlrpuof.cloudfront.net tcp
NL 65.9.84.208:443 d6tizftlrpuof.cloudfront.net tcp
N/A 224.0.0.251:5353 udp
NL 65.9.84.208:443 d6tizftlrpuof.cloudfront.net tcp
US 8.8.8.8:53 208.84.9.65.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp
US 8.8.8.8:53 254.143.241.8.in-addr.arpa udp
US 8.8.8.8:53 assets.msn.com udp
NL 2.19.195.194:443 assets.msn.com tcp
US 8.8.8.8:53 194.195.19.2.in-addr.arpa udp
US 8.8.8.8:53 161.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 westus2-0.in.applicationinsights.azure.com udp
US 20.9.155.150:443 westus2-0.in.applicationinsights.azure.com tcp
US 8.8.8.8:53 150.155.9.20.in-addr.arpa udp
US 20.9.155.150:443 westus2-0.in.applicationinsights.azure.com tcp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 assets.msn.com udp
NL 2.19.195.219:443 assets.msn.com tcp
US 8.8.8.8:53 219.195.19.2.in-addr.arpa udp

Files

memory/1644-133-0x0000000000400000-0x0000000001F4A000-memory.dmp

memory/1644-134-0x0000000076F44000-0x0000000076F46000-memory.dmp

memory/1644-135-0x0000000000400000-0x0000000001F4A000-memory.dmp

memory/4452-137-0x0000000004E90000-0x0000000004EC6000-memory.dmp

memory/4452-140-0x0000000073150000-0x0000000073900000-memory.dmp

C:\Users\Admin\protmepls.exe

MD5 1bc9df12a338938019d8a42237566b5f
SHA1 4a1139848239d0fab1a07d2e328dc3732b92bdab
SHA256 f8759733e825b911c48356f73a1c4fe1b703ecad786a773a8963c4eeff4afc94
SHA512 506b56b43d271f38eba4612f8310ee1ec2ccb413e105a4cd493165aa975e0431900eef0be0eaa25d01081b9ce8117121e08ebdd0cde47178a7560afd6161e465

memory/4452-141-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/4452-165-0x0000000005560000-0x0000000005B88000-memory.dmp

C:\Users\Admin\protmepls.exe

MD5 1bc9df12a338938019d8a42237566b5f
SHA1 4a1139848239d0fab1a07d2e328dc3732b92bdab
SHA256 f8759733e825b911c48356f73a1c4fe1b703ecad786a773a8963c4eeff4afc94
SHA512 506b56b43d271f38eba4612f8310ee1ec2ccb413e105a4cd493165aa975e0431900eef0be0eaa25d01081b9ce8117121e08ebdd0cde47178a7560afd6161e465

C:\Users\Admin\protmepls.exe

MD5 1bc9df12a338938019d8a42237566b5f
SHA1 4a1139848239d0fab1a07d2e328dc3732b92bdab
SHA256 f8759733e825b911c48356f73a1c4fe1b703ecad786a773a8963c4eeff4afc94
SHA512 506b56b43d271f38eba4612f8310ee1ec2ccb413e105a4cd493165aa975e0431900eef0be0eaa25d01081b9ce8117121e08ebdd0cde47178a7560afd6161e465

memory/1648-173-0x0000000073150000-0x0000000073900000-memory.dmp

memory/1648-172-0x0000000000F70000-0x0000000000FF4000-memory.dmp

memory/4452-169-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/1644-166-0x0000000000400000-0x0000000001F4A000-memory.dmp

memory/1648-174-0x0000000005F30000-0x00000000064D4000-memory.dmp

memory/1644-171-0x0000000000400000-0x0000000001F4A000-memory.dmp

memory/4452-175-0x0000000005340000-0x0000000005362000-memory.dmp

memory/4452-176-0x0000000005D40000-0x0000000005DA6000-memory.dmp

memory/4452-177-0x0000000005DB0000-0x0000000005E16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_21eyfy2p.j11.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4452-240-0x0000000006430000-0x000000000644E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\protmepls_b69eae24-8547-42a0-be3a-b8f55eaf90b1\OMM Loader.exe

MD5 4b07d4daa90e051ca065e497c8d21346
SHA1 248cce5809f7dbde17402ecb36bced1b071f9972
SHA256 70795c1cda206491cafa049ad16bb7def36c08462e9133e7cea2ed55f1e61848
SHA512 0c765fd2d67fe215942b838acd27f23298645eed56acc73dce75f721501f5fa8b89e37a3303b6ce2a6a1f111885e8d28a280cfb985d1b6521698a7bb77622545

C:\Users\Admin\AppData\Local\Temp\protmepls_b69eae24-8547-42a0-be3a-b8f55eaf90b1\OMM Loader.exe

MD5 4b07d4daa90e051ca065e497c8d21346
SHA1 248cce5809f7dbde17402ecb36bced1b071f9972
SHA256 70795c1cda206491cafa049ad16bb7def36c08462e9133e7cea2ed55f1e61848
SHA512 0c765fd2d67fe215942b838acd27f23298645eed56acc73dce75f721501f5fa8b89e37a3303b6ce2a6a1f111885e8d28a280cfb985d1b6521698a7bb77622545

memory/4452-384-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/1648-383-0x0000000073150000-0x0000000073900000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b950ebe404eda736e529f1b0a975e8db
SHA1 4d2c020f1aa70e2bcb666a2dd144d1f3588430b8
SHA256 bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4
SHA512 6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

memory/4452-391-0x0000000073150000-0x0000000073900000-memory.dmp

memory/4452-392-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/4452-393-0x0000000004F20000-0x0000000004F30000-memory.dmp

memory/4452-394-0x00000000069F0000-0x0000000006A22000-memory.dmp

memory/4452-395-0x0000000074090000-0x00000000740DC000-memory.dmp

memory/4452-405-0x0000000005190000-0x00000000051AE000-memory.dmp

memory/4452-414-0x0000000007DD0000-0x000000000844A000-memory.dmp

memory/4452-415-0x0000000007750000-0x000000000776A000-memory.dmp

\??\pipe\LOCAL\crashpad_3492_OOIXTGBOUZCKYJGP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e36e039f50948e516a4bf1e8cc40d133
SHA1 5276be39297f9a3d00870cbc001581747f7c0a46
SHA256 7920d9f15630d390d1fcced4623e85ea4d0d3026be0c5a96f14c98370c20fcd8
SHA512 70b7dfb125181cf759fb690921a30632db4b4d72fcc1acbe185536f36fa1e58f0617c58db2ef06f6ecac546888722ba885e0241c748239929748c9d93a0c1d8a

memory/4452-433-0x00000000077C0000-0x00000000077CA000-memory.dmp

memory/4452-434-0x00000000079E0000-0x0000000007A76000-memory.dmp

memory/4452-437-0x0000000007990000-0x000000000799E000-memory.dmp

memory/4452-440-0x0000000007A80000-0x0000000007A9A000-memory.dmp

memory/4452-441-0x00000000079D0000-0x00000000079D8000-memory.dmp

memory/4452-464-0x0000000073150000-0x0000000073900000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 eba69ab7fe8d519e18749c45003260dd
SHA1 9ff235e9ab44f70992ef0365dabf6c3378582f32
SHA256 e475f2fd372d8fd8f42ade1671abaa8ba55ad3aa7f59a3a47673e89ed8e61bd2
SHA512 b1d4f9454ab5f3362d550c8988ebac9a29953fec391bf9ebfda03c9e5abad4839e4d3665aea0c626330134108b8219a733afd689399de42b9244a83fc2bec406

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1f1201d0af416af593e6016773d4ba54
SHA1 ae03e0883c30cac82e1f667ac26b6f5855ceaf15
SHA256 c3dbd7fb2ef8cb860d73ea72b3e574fea2008ed1140d1be3470587ff89d3aebf
SHA512 268ced4d01a8563a3506b7a0793cff3bacaced3667dea7b8bdc6cc0e561262e2b08ca5b1bb8b015d08446aa1f42e7c720c82c916c3fe54c7e422c39f494f9fe3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 ca36933e6dea7aa507a272121b34fdbb
SHA1 3b4741ca0308b345de5ecf6c3565b1dbacb0fb86
SHA256 fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d
SHA512 5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4e1e881d7c9c1324b0167bff1d9b2bdb
SHA1 525a170e007249deefb64debf527eb23e13478c9
SHA256 0606da79fa1ce7d1f15f15899e55b660d8d5a7033fbc75d967d498da1faec264
SHA512 333fafbb0fcfcd45e50e8948e80627fb00173bc07b6dfc0d80dc61ced4e4ab2874363aee42bd7a3019ce3ab44c40a52e81e7fdc67ecc35e195e1f26d50aa794e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f795d2d5f0a5c3183f572d8061cd09a4
SHA1 04ad94973d70a787e17f78f57df7e2d6083e69ad
SHA256 1b619f65cf0c94ea434b5abc32feffb354c5dfd2f11662e07328aae31366fa82
SHA512 35998f7e829a3829a7098de9a6b0012f8c5e37846f8f1debac3c74766f849d1315bbef95898383c472132f5e1b6b8a59abe7ffebc1fb3893f21bd03a66474c7a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 e207c64d13183ce95d5951aa0945e575
SHA1 84388440602a28c0c20ec9c5a039dd87658adc38
SHA256 e343fd265dfb64ac866e7e5f9b8ce1ec4341983cb22aadcd10f37f007cd943c2
SHA512 ddffe6197733720434746b1683281c366409d60550f28ad552f980c413c5f6ee4e5eee648b70ada1cd1e4e70a12cc184ea391f59da86facbb9430c72c179005d