Malware Analysis Report

2024-11-15 04:39

Sample ID 231111-a69d9adb48
Target NEAS.0aece04789b6892b13e1985bb08a7200.exe
SHA256 a6c6b2a4d581d6f5f1e661b0d0e390107ea79a7075700e48cfe41442c1e2eb06
Tags
umbral spyware stealer microsoft phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a6c6b2a4d581d6f5f1e661b0d0e390107ea79a7075700e48cfe41442c1e2eb06

Threat Level: Known bad

The file NEAS.0aece04789b6892b13e1985bb08a7200.exe was found to be: Known bad.

Malicious Activity Summary

umbral spyware stealer microsoft phishing

Umbral family

Detect Umbral payload

Umbral

Drops file in Drivers directory

Executes dropped EXE

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Detected potential entity reuse from brand microsoft.

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Detects videocard installed

Runs ping.exe

Enumerates system info in registry

Views/modifies file attributes

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-11 00:50

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A

Umbral family

umbral

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-11 00:50

Reported

2023-11-11 02:01

Platform

win7-20231025-en

Max time kernel

119s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe"

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Umbral

stealer umbral

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\system32\attrib.exe N/A
File created C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe N/A
File created C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F64CEA91-8035-11EE-AF1C-FA9360DBF9A1} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e717184000000000200000000001066000000010000200000004ec695e15ca33ccb78ffe41f663fc3fc625f41c6270826bea753f91f5a8575f2000000000e8000000002000020000000863544a6a114409a7bee37bbebee14af03a016c2f1a369973c4de2746ed313ce20000000fef107d48cb9aa3949aa7939c79415498cd5dbb9404f16fe95d2e8517e5b27014000000050b0a0dd41daf7d172e70fcbbabc0fd695216b224bc4c01ff38875ea25806df8a1a6ecbd25b11f54814ac26567fd643475270d0a9bdedb691a8c0c180b7c5b4d C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405829852" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906c75ce4214da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e717184000000000200000000001066000000010000200000009e8c38f9e1eccb9e7342cf01bf46456706a5142cf666fc2412eb68bb6f103fb4000000000e80000000020000200000004f58a6f4aa664d971170eff164f78977ec6eaa3a35756e60c4d786408858241490000000cbd3f0a1e4fac095cac4c162aea8fb949a0a42009f7e546a84d9888a56e9c267cfa62b0fc4ca5b1f18aaa6e4d5fb6a3896e86762aef45006ececd94977d36c77d80373b715d417c222910085c67529496fb06a2aaebf20c31fbf1911faa840455ab553efa6958d0d625dc7a4216620389d989695a45d95ebe8c39210e6383607b46e24bfb9bb5f4fd7338552256838fa40000000fcdb1b23bba49c621c50a80bb5ff619a47d73e557480edcee8168c7ad5a8d0eff6747fbfa1ff47cbce1b4aed4b0706a85c92e05372fab0040d57ff2c0b79559d C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2168 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe
PID 2168 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe
PID 2168 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe
PID 2168 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe
PID 2168 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe
PID 2168 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe
PID 2168 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe
PID 2168 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\system32\cmd.exe
PID 2168 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\system32\cmd.exe
PID 2168 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\system32\cmd.exe
PID 2984 wrote to memory of 2692 N/A C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2984 wrote to memory of 2692 N/A C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2984 wrote to memory of 2692 N/A C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2984 wrote to memory of 2692 N/A C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2692 wrote to memory of 2476 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2692 wrote to memory of 2476 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2692 wrote to memory of 2476 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2692 wrote to memory of 2476 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2568 wrote to memory of 2368 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\system32\attrib.exe
PID 2568 wrote to memory of 2368 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\system32\attrib.exe
PID 2568 wrote to memory of 2368 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\system32\attrib.exe
PID 2568 wrote to memory of 436 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 436 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 436 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1516 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1516 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1516 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1804 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1804 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1804 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2128 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2128 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2128 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1524 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 1524 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 1524 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 2868 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 2868 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 2868 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 3056 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 3056 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 3056 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 2872 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2872 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2872 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1280 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 1280 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 1280 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\System32\Wbem\wmic.exe
PID 2568 wrote to memory of 2292 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\system32\cmd.exe
PID 2568 wrote to memory of 2292 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\system32\cmd.exe
PID 2568 wrote to memory of 2292 N/A C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe C:\Windows\system32\cmd.exe
PID 2292 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2292 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2292 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe"

C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe

C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe

C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe

C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2

C:\Windows\system32\attrib.exe

"attrib.exe" +h +s "C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\system32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

Network

Country Destination Domain Proto
US 8.8.8.8:53 gstatic.com udp
NL 142.250.179.131:443 gstatic.com tcp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 142.250.179.131:443 gstatic.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp

Files

C:\Windows\System32\Speech\BoH67tHWD2j1mufsoo6RmaIfHEWHs5qN.exe

MD5 cebf7458dceffcbb81a290cf045beb27
SHA1 98c74fa610995d61d2ee78a2ea888e003e9f436d
SHA256 97d22321ba783bf6d2119320d38d776bbc6bef42fe3dadecf512e23bbdd29660
SHA512 144f0da1e8060e08340f1b349f7bbb17be298ee3d27d056d5603143125b8a9d7abb9485d0f5a2a26e2e50f0d5970ecf5fc3a9e665eece70414c6dc1504b04a91

C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe

MD5 ef2711e9aeeb23297016ef32b46a3c7e
SHA1 ba51f478c1118d7803620367cb97ce2ceba52a5a
SHA256 2fe65b8585389b60e44f688f755bbaefe5a3689737050a96c7586bd9b69a9759
SHA512 3c5453a308f0f8321141c2949540f7c3a7c9774eb9e8767210ee30e9745caee0e8bafa8806736f1ec04bd952aa411a5a38a6c97fe19bea3d8d86729571a7059f

C:\Windows\System32\Speech\dPQEUfH6rXRaK1QP66KXt95OCCpAJJcC.exe

MD5 ef2711e9aeeb23297016ef32b46a3c7e
SHA1 ba51f478c1118d7803620367cb97ce2ceba52a5a
SHA256 2fe65b8585389b60e44f688f755bbaefe5a3689737050a96c7586bd9b69a9759
SHA512 3c5453a308f0f8321141c2949540f7c3a7c9774eb9e8767210ee30e9745caee0e8bafa8806736f1ec04bd952aa411a5a38a6c97fe19bea3d8d86729571a7059f

memory/2568-10-0x0000000000090000-0x00000000000D0000-memory.dmp

memory/2568-11-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

memory/2568-12-0x000000001B000000-0x000000001B080000-memory.dmp

memory/2568-17-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabA46D.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\TarA4CD.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 13699b3f976fbd34af1eaa5490877986
SHA1 675f34d84e07fdea8cd0783478a4ca4c4ff743c1
SHA256 5541c858051dc975d0d553412a525df28a2c5b9eaf8fad3773fa80e438855103
SHA512 143e67c052e3a69e8ba214f7eed2148b531ec594f3e4316d3bffe101af9c4a252fc425eb6e2c6a6663cc70830613edafc4f96d6feb15c3eaddd2b072bc31a470

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8c97f2a463c01434e1a4911bc5397a95
SHA1 b06b34294f5dae41b3ea80c632cb58e7d4acb42f
SHA256 60b0b4df83ce548fec896208e6b8cf042ded6b63b2939fd4d9dc75511b9c7173
SHA512 41ae97854063ee0417bec5b1bbff96bf3e55198a21fdace422156dc4d13aca79e14a731c93905cf632f70f2a2a160885d0319c02091e8bdfcc07b63d5b48a6bc

memory/2568-98-0x000000001B000000-0x000000001B080000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b6d44260f643e03a3826f7766079005
SHA1 fc1664fec28ca6b7c919284ebda17137108c3212
SHA256 ad0de84afff5da704c72f1af62b4d9a400237db81b82c4d49b9891f2fe600c3c
SHA512 13406ed8a24d48663bff523ab2342fc843878596281929b33a5dffabdf4fdbae63c6c93a28365f7eb05fa2be853b55a4a983d17a9024318a4629c26ef3c37d22

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bb967dd6770140d01d820ae57d5b3631
SHA1 c58683480f33f1106d0960d31cd09d72f858206f
SHA256 8a5e9248682fe1c25189d1594ba83653ba428f2bd1aebf019c76faf4cf3abfe6
SHA512 87dd7bba4dba4681e0d995ac81b2a7b3a41aa077dc3bff21c4943e2bdf49e788ce2f4451a2debddc6a90f120a37f374f808a906f112e272c6bcf0587a79f554c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0def9e6583cd3465dbc9486baa461407
SHA1 fa87156e453490d50dd42bfa84530f1261ff47c9
SHA256 bda672dc60bf1ef5e84d88217d10f3149092f558e2bdfcbda703905a57123f6e
SHA512 f247f103f80af658aa3219c87248509c08da490b8746c2fd5c11f28ec22ca9ac62fbb64a9f32edd5027e2f768dabbce6eccb78897f07e1b7279a308fd32435c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 527be69b1c92bda1f0f375d02a8963ef
SHA1 28f7cb5d6783aa51abe6e9caba74feb4d754e036
SHA256 b5c8789683741de0049eaea2a12109eee01d3179361fb49f0f910b2f0e07dafa
SHA512 759fcfcdf05a59cf581789bcb150f22b110fe15ed201fe19ab260653222af25bb7172920f197d2d091f3436fb27aa613808f2eafd2299129af118680afe04fa9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b2c98fd95f1c25047d41de8e19783c3f
SHA1 3fccd63952b64d5dd8c11e78cd9b6963d48f296c
SHA256 7f0b826eaba60333fd94502e951f58da9f1b61471f91601c37f453c50fa3a359
SHA512 182365ab947c2ba71221cd5b5a55df9894fdda55aed2622e4bb8512cf0826e9f7aca2bbbde44ed8062d9342931064bd9822529463d52d95c88abe97fa9eaa54a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 06911c821c30aa148c59770329570383
SHA1 621c859ca755412d79bc64d9f7be7da02514471d
SHA256 9e0bd3f2582e89f69237fec42d56755dd8bc8745fb5747ef4a1adaad8315c08e
SHA512 33958c4ede10816d5918c4f44172c5a2dca7539607e6c9baf67596aa5eda95a720035f4f9879c70a05863cc41316e34e04a8adc373cfbb7bff358b1ed507d0c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29897bd8438a40f6763f6a53e5239c28
SHA1 6ea2881da4b509384763f7e392c6be1862b8a92c
SHA256 1c440f5dad22a05f238d995c6e20e91132adb0407ba1c9dd63fe4a86a3ac8f16
SHA512 b480404a723520fafc78a306e1d1a9bcf4d8fe4fd54b5e53b18b7da6e6f9385d79e5efe2b3ea2610f6fa6c5dbccb6fcd7a0a3ab33b07d6c853ad91501cfcaa31

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d42de2c2e3254588adcb965d8b1b51f
SHA1 609a94001ca268999b0d0368c034a52a65f38977
SHA256 83c2797696fb78165ff51b9124d58a0ed86dd7b54fe70fd84952e66edef0748b
SHA512 725d8ed0f76575e45f3a1b4bc74f17afc4dc4241bc88c7c10669ef69dcd4d193bac08ee8d426507fc9fcdc07eda2958eee62c858c18079c0910c5537129ae940

memory/436-452-0x000007FEED350000-0x000007FEEDCED000-memory.dmp

memory/436-451-0x000000001B310000-0x000000001B5F2000-memory.dmp

memory/436-454-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

memory/436-453-0x0000000002860000-0x00000000028E0000-memory.dmp

memory/436-455-0x000007FEED350000-0x000007FEEDCED000-memory.dmp

memory/436-457-0x0000000002860000-0x00000000028E0000-memory.dmp

memory/436-456-0x0000000002860000-0x00000000028E0000-memory.dmp

memory/436-458-0x0000000002860000-0x00000000028E0000-memory.dmp

memory/436-459-0x000007FEED350000-0x000007FEEDCED000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 cd6a785b6c9c19c7ca10d02f8d333583
SHA1 373c9a53d18f56efa1ecc02060431bac5a7f261a
SHA256 6e83316d9bd22d37c0740bb033cc7e87fe524eee79fa318a6cce0bab52c8b0b7
SHA512 8fef336c8d236acdc06c43810ca997639a1609b61e8b35b81b0755b2a8268f0b917f2ce5d14d22ffa0715093903f29bbf3ed30c7ecb1e9733015a9afb0f6c47b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K6PS3BVB1ZC5FJNI93QM.temp

MD5 cd6a785b6c9c19c7ca10d02f8d333583
SHA1 373c9a53d18f56efa1ecc02060431bac5a7f261a
SHA256 6e83316d9bd22d37c0740bb033cc7e87fe524eee79fa318a6cce0bab52c8b0b7
SHA512 8fef336c8d236acdc06c43810ca997639a1609b61e8b35b81b0755b2a8268f0b917f2ce5d14d22ffa0715093903f29bbf3ed30c7ecb1e9733015a9afb0f6c47b

memory/1516-465-0x000000001B230000-0x000000001B512000-memory.dmp

memory/1516-466-0x00000000023A0000-0x00000000023A8000-memory.dmp

memory/1516-467-0x000007FEEC9B0000-0x000007FEED34D000-memory.dmp

memory/1516-468-0x0000000001E90000-0x0000000001F10000-memory.dmp

memory/1516-471-0x0000000001E90000-0x0000000001F10000-memory.dmp

memory/1516-470-0x0000000001E90000-0x0000000001F10000-memory.dmp

memory/1516-469-0x000007FEEC9B0000-0x000007FEED34D000-memory.dmp

memory/1516-472-0x0000000001E90000-0x0000000001F10000-memory.dmp

memory/1516-473-0x0000000001E90000-0x0000000001F10000-memory.dmp

memory/1516-474-0x000007FEEC9B0000-0x000007FEED34D000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bb0d5b279e1f86ff162dce6d3082adf6
SHA1 df7094a215388e6c66dd33a3e544eac120972722
SHA256 a094494151922c5cbef3daecb5382464ae80632b28800bfe26a17585578fc454
SHA512 39f285dd68541044f045bdaefef04d329fc9184c5b8c45653f7dcc60145fcbbaea7fe436ebc103098c77387b5e67287510e7f4870ba0b10f0e3b19d987d7898c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7231e4df82b2cbcb6ef4a506a55c9358
SHA1 c97cefc5d0510d24e941e5b2beab49f1bb22c9f0
SHA256 e793b5b08ba50ef1e86bbfa104a391376b1a858978e778567abc19807fe4a91b
SHA512 3c21550cd598818c173ca6b063489747d9314f4a9459937a153db86b5c2d34f3c675ce0b67cce7192a5008e3e76049bc3517f9a8a8ae2f91dae7745526874af3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d41879425caec850736b5ac2257173d7
SHA1 743209f3435385373a929f63479624e0d7eb9061
SHA256 8fa578f9e5756ccd8c0c87d32868135d055e9749b12d5cdc4d1120010b3ef353
SHA512 899956b62cdc5d96ededf81e6356356a9d51f13c2dc3043389fd6bd61cc2b4d4e6bec181c4e4ff9c948893cf7361ccbe933f4a9e511115d8470ff7bd286e7892

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c2d4d3d387c8398035809164caf442b7
SHA1 84f133cccf2553e6938f496722a86a9d205943ab
SHA256 1f19c67daa83c0b17ce6f14833220b1387a9357354c096a48be3850653d31d89
SHA512 02b7398e9018340dd0e1a041a0569e84ecad515d281b1a9a856f41d844044a5128bc1c853ad9f9820a5556bd164c3aabbf51a61208fdc8fa3bcebfdd8f4b2164

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4b475ef362a48cdae692e6b42e1fc4c2
SHA1 7b037915f06ad97c109a9f3b8ffb47589aab3323
SHA256 854bc89a91037abcfa5b44bd14e5dc28fa9603143459ea6540a88d815913eb13
SHA512 e307992a11726da392ef795a31492a70a36dfd62d35cb792ecd3c7da16c0f1a8224c3652017cee98d37d3cf123e004f5d1cba0054d5027643d603a70fd1d745e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b7af0dc62a58a4734ec05c6112d3340
SHA1 df3e1b506b951b13d42225b22f15a3dd3c67f738
SHA256 9ce95436930284d899d0b2b0bfae08523c71b53e7aefe1292c7d9a9d4a03737a
SHA512 a4e3e72c0c2ba4c29299c17809b7698b4359c892fc04eaf87aa633d0e639bfa792cba4d0cb99e234f80eb9860996df68808abb3a67d00fee436d1b408d3e70eb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 26d50cb532a85e75684d973331c06cc8
SHA1 dc21d4a0f294ae40348f401e04972377d4571da4
SHA256 b87d20a4541b60556d03f0e4cfca717e8fb478848021d8434716e145e4d2930d
SHA512 dc644fef27527d5c30dcdf5b0c210d0098c343311b343c8ce4cdad1939068897d7398898a4f8a7d49ab67a45a1730a3c9d5d8aa9e6505f9aad4e7aab4afcf2dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67311ba2bc7ddf310310100f62785048
SHA1 7ad4365f6ade43acf26f76f3336fa286d7b7c97c
SHA256 97fdc02311e2155fed8574a2032fe65ef2d0dd2dbf7137b006e02be438c034cf
SHA512 3fc9db9a762bac6d5960dd510c1f8edb40450bf165162d38b480fb1ae1666b93a6363049b93e8316e9b393c9daadc1f8cc6f7abcc7ac0722f3ed2947271ed4bf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8490e263eba512006a7cfe1075afebdd
SHA1 0baa9b30b8cc672ca22059c260f95248a3d9201b
SHA256 ff867e2f64a74bd3d507d9303bf4a439ccfdfcd8d9c8c64707f23266caecc2d5
SHA512 0b3c9f588793a13c42c858abc7bd5ca9ac65a3d0b060736ac66f14b8b9d32c38f0d8d27a4cf5003334ad3bb450756f32df4032a04429583f3eeccd7353ae64a3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab81b9dc36825e4d255380b3adbd0d78
SHA1 9cf81a34da9c560b944a1345084ee7dd38d12eaf
SHA256 542b6a61c7bc944bfa94de35e9e097c31bbd95414d27d1ad057c34052dbbf145
SHA512 a4bb004dbe758784c94dc1c3e67a1f165614782dfb4e86a42c8a4040c476f9ba32746173347d4d0ca9da912d955d2dd62e7fa593ac0b7b8fff90b45f3bd831c0

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 cd6a785b6c9c19c7ca10d02f8d333583
SHA1 373c9a53d18f56efa1ecc02060431bac5a7f261a
SHA256 6e83316d9bd22d37c0740bb033cc7e87fe524eee79fa318a6cce0bab52c8b0b7
SHA512 8fef336c8d236acdc06c43810ca997639a1609b61e8b35b81b0755b2a8268f0b917f2ce5d14d22ffa0715093903f29bbf3ed30c7ecb1e9733015a9afb0f6c47b

memory/1804-918-0x000007FEED350000-0x000007FEEDCED000-memory.dmp

memory/1804-919-0x00000000028C0000-0x0000000002940000-memory.dmp

memory/1804-922-0x000007FEED350000-0x000007FEEDCED000-memory.dmp

memory/1804-923-0x00000000028C0000-0x0000000002940000-memory.dmp

memory/1804-924-0x00000000028C0000-0x0000000002940000-memory.dmp

memory/1804-925-0x00000000028C0000-0x0000000002940000-memory.dmp

memory/1804-926-0x000007FEED350000-0x000007FEEDCED000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 cd6a785b6c9c19c7ca10d02f8d333583
SHA1 373c9a53d18f56efa1ecc02060431bac5a7f261a
SHA256 6e83316d9bd22d37c0740bb033cc7e87fe524eee79fa318a6cce0bab52c8b0b7
SHA512 8fef336c8d236acdc06c43810ca997639a1609b61e8b35b81b0755b2a8268f0b917f2ce5d14d22ffa0715093903f29bbf3ed30c7ecb1e9733015a9afb0f6c47b

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2128-933-0x000007FEEC9B0000-0x000007FEED34D000-memory.dmp

memory/2128-934-0x0000000002970000-0x00000000029F0000-memory.dmp

memory/2128-935-0x000007FEEC9B0000-0x000007FEED34D000-memory.dmp

memory/2128-936-0x0000000002970000-0x00000000029F0000-memory.dmp

memory/2128-937-0x0000000002970000-0x00000000029F0000-memory.dmp

memory/2128-938-0x000007FEEC9B0000-0x000007FEED34D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 cd6a785b6c9c19c7ca10d02f8d333583
SHA1 373c9a53d18f56efa1ecc02060431bac5a7f261a
SHA256 6e83316d9bd22d37c0740bb033cc7e87fe524eee79fa318a6cce0bab52c8b0b7
SHA512 8fef336c8d236acdc06c43810ca997639a1609b61e8b35b81b0755b2a8268f0b917f2ce5d14d22ffa0715093903f29bbf3ed30c7ecb1e9733015a9afb0f6c47b

memory/2872-947-0x000000001B2B0000-0x000000001B592000-memory.dmp

memory/2872-948-0x0000000002490000-0x0000000002498000-memory.dmp

memory/2872-949-0x000007FEED350000-0x000007FEEDCED000-memory.dmp

memory/2872-950-0x0000000002570000-0x00000000025F0000-memory.dmp

memory/2872-951-0x000007FEED350000-0x000007FEEDCED000-memory.dmp

memory/2872-952-0x0000000002570000-0x00000000025F0000-memory.dmp

memory/2872-953-0x0000000002570000-0x00000000025F0000-memory.dmp

memory/2872-954-0x0000000002570000-0x00000000025F0000-memory.dmp

memory/2872-955-0x000007FEED350000-0x000007FEEDCED000-memory.dmp

memory/2568-959-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-11-11 00:50

Reported

2023-11-11 02:01

Platform

win10v2004-20231020-en

Max time kernel

150s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe"

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Umbral

stealer umbral

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Detected potential entity reuse from brand microsoft.

phishing microsoft

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe N/A
File created C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe N/A
File opened for modification C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe C:\Windows\SYSTEM32\attrib.exe N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2904 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe
PID 2904 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe
PID 2904 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe
PID 2904 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe
PID 2904 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe
PID 2904 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\system32\cmd.exe
PID 2904 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe C:\Windows\system32\cmd.exe
PID 1708 wrote to memory of 3156 N/A C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe C:\Windows\SYSTEM32\attrib.exe
PID 1708 wrote to memory of 3156 N/A C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe C:\Windows\SYSTEM32\attrib.exe
PID 1708 wrote to memory of 4164 N/A C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1708 wrote to memory of 4164 N/A C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1708 wrote to memory of 1612 N/A C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1708 wrote to memory of 1612 N/A C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1708 wrote to memory of 4800 N/A C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1708 wrote to memory of 4800 N/A C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 2500 N/A C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 544 wrote to memory of 2500 N/A C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 2568 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 2568 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 2932 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 2932 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 3828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 3828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2500 wrote to memory of 3828 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.0aece04789b6892b13e1985bb08a7200.exe"

C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe

C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe

C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe

C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffdf83746f8,0x7ffdf8374708,0x7ffdf8374718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf83746f8,0x7ffdf8374708,0x7ffdf8374718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4935652992047608845,8984732390519308521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
NL 142.250.179.131:443 gstatic.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
US 8.8.8.8:53 98.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 139.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 8.8.8.8:53 mscom.demdex.net udp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
US 8.8.8.8:53 target.microsoft.com udp
IE 52.211.35.76:443 mscom.demdex.net tcp
US 8.8.8.8:53 67.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 76.35.211.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 20.42.65.88:443 browser.events.data.microsoft.com tcp
US 20.42.65.88:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 121.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 121.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp

Files

C:\Windows\System32\Speech\NyeboS6hcbf4NolSo6l9d99ae4iQNXt3.exe

MD5 cebf7458dceffcbb81a290cf045beb27
SHA1 98c74fa610995d61d2ee78a2ea888e003e9f436d
SHA256 97d22321ba783bf6d2119320d38d776bbc6bef42fe3dadecf512e23bbdd29660
SHA512 144f0da1e8060e08340f1b349f7bbb17be298ee3d27d056d5603143125b8a9d7abb9485d0f5a2a26e2e50f0d5970ecf5fc3a9e665eece70414c6dc1504b04a91

C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe

MD5 ef2711e9aeeb23297016ef32b46a3c7e
SHA1 ba51f478c1118d7803620367cb97ce2ceba52a5a
SHA256 2fe65b8585389b60e44f688f755bbaefe5a3689737050a96c7586bd9b69a9759
SHA512 3c5453a308f0f8321141c2949540f7c3a7c9774eb9e8767210ee30e9745caee0e8bafa8806736f1ec04bd952aa411a5a38a6c97fe19bea3d8d86729571a7059f

C:\Windows\System32\Speech\UgU7YPJ0LSBeveEXVcrVWyH7L9ZS8EA6.exe

MD5 ef2711e9aeeb23297016ef32b46a3c7e
SHA1 ba51f478c1118d7803620367cb97ce2ceba52a5a
SHA256 2fe65b8585389b60e44f688f755bbaefe5a3689737050a96c7586bd9b69a9759
SHA512 3c5453a308f0f8321141c2949540f7c3a7c9774eb9e8767210ee30e9745caee0e8bafa8806736f1ec04bd952aa411a5a38a6c97fe19bea3d8d86729571a7059f

memory/1708-9-0x0000012423510000-0x0000012423550000-memory.dmp

memory/1708-10-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

memory/1708-11-0x000001243DAB0000-0x000001243DAC0000-memory.dmp

memory/4164-17-0x000002695ABE0000-0x000002695AC02000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0uwkk52c.mgx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4164-18-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

memory/4164-19-0x00000269731E0000-0x00000269731F0000-memory.dmp

memory/4164-20-0x00000269731E0000-0x00000269731F0000-memory.dmp

memory/4164-25-0x00000269731E0000-0x00000269731F0000-memory.dmp

memory/4164-28-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

memory/1612-31-0x0000028942110000-0x0000028942120000-memory.dmp

memory/1612-30-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

memory/1708-32-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1fabe117b9df3e717a1a47eea4ab315d
SHA1 8cf9173bbc9a86f33abd6219eaf6956da55cd080
SHA256 b35e27b7e9fbdf2096563e70e59d299b9354d34668e50cfd7cebb3a870d92c0b
SHA512 936a10b3d8685c5f3817b6d32ca262e262a104dc16b036c4a92d91ea60cf8be221a2a2121cf040a0fb470d76e779ba9ce4e82b42a075b365b1e2fdb782171a51

memory/1612-43-0x0000028942110000-0x0000028942120000-memory.dmp

memory/1612-44-0x0000028942110000-0x0000028942120000-memory.dmp

memory/1612-46-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

memory/1708-49-0x000001243DD90000-0x000001243DE06000-memory.dmp

memory/1708-50-0x000001243DD10000-0x000001243DD60000-memory.dmp

memory/1708-51-0x00000124252A0000-0x00000124252BE000-memory.dmp

memory/4800-52-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

memory/4800-53-0x00000212EDDE0000-0x00000212EDDF0000-memory.dmp

memory/4800-54-0x00000212EDDE0000-0x00000212EDDF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 df6c4e5c3091c14551e6c92f07717617
SHA1 1ea87111035496c1b2b74cef8b5c62d00ac072c9
SHA256 b79dc75372707ff84a643a9e4cff6fad2d1a936b54d458088850c62c96e2f231
SHA512 ab861efd0ff28a4bae3513a884d5b00c1b68d8f0bd54a00428bbb65a6954f8778e8f5300362025265251cb425c5ed77608b10776f382c3b392916ae46e38db35

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

C:\Windows\system32\drivers\etc\hosts

MD5 4028457913f9d08b06137643fe3e01bc
SHA1 a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14
SHA256 289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58
SHA512 c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

memory/4800-90-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

\??\pipe\LOCAL\crashpad_2500_IJAAAOBBEVLITWFG

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fc66eee5cf4322cd483336729d4d5b43
SHA1 1c9bf43130a416e9df92266663563e86bb5c6038
SHA256 be061cf3813ef2bfeea73023f944f408da1d4e3b456ba386b79b88b89b5b170e
SHA512 51ad8dd043397998382f4682ffc59be6dddbf0d72e9918ea21aa9d168189cd272303a5f5472102a9f377f560a3ab3a95fa62a2baa65cf2c86c4e9d802621389f

memory/4260-111-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

memory/4260-112-0x0000025EA54A0000-0x0000025EA54B0000-memory.dmp

memory/4260-113-0x0000025EA54A0000-0x0000025EA54B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 548dd08570d121a65e82abb7171cae1c
SHA1 1a1b5084b3a78f3acd0d811cc79dbcac121217ab
SHA256 cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc
SHA512 37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

memory/4260-138-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

memory/1708-149-0x000001243DD70000-0x000001243DD7A000-memory.dmp

memory/1708-150-0x000001243EC00000-0x000001243EC12000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 da02a95b169ee0507779be78fc534652
SHA1 008a0f04246f51ef4fc3ed824e92a1118bc787e4
SHA256 dd74047461f8e3faf2c82cfa546ee3791f9b157b4055e5a7a04a194f5c25ce2e
SHA512 014d0011d0dddac0c25835dc0b332268cea1ab9acb4ecb753cf5b261c0600f541b0716751a11a2fe22e48c36692b96c0d22185f6ebb84ae90758ea412185e28a

memory/1708-161-0x000001243DAC0000-0x000001243DBC2000-memory.dmp

memory/4612-172-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

memory/4612-173-0x0000013629E00000-0x0000013629E10000-memory.dmp

memory/4612-174-0x0000013629E00000-0x0000013629E10000-memory.dmp

memory/4612-175-0x0000013629E00000-0x0000013629E10000-memory.dmp

memory/4612-177-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/1708-190-0x000001243DAC0000-0x000001243DBC2000-memory.dmp

memory/1708-191-0x00007FFDFDCD0000-0x00007FFDFE791000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 66f75213b5ac341d00b947f7ee3ccf30
SHA1 36acf1a510d234f3aeb0106f8e9d26cc0d31bb04
SHA256 d73841c10cb8c3019dcb2ed7a8eb2b820629f555e7f1f0cfde43bd27e5a4c1ea
SHA512 62a64bf1b74ae2d204a5c3ae7ddd939f743b0e4ec807bef6c7aa5101e4c4c03789849973941bafd0c0a550d263eeacf95d688fb1b9314c2411f5cc8170665eab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3e0f3494cd4c13d42d4e138367c14741
SHA1 4a4bc8d47cf6025c33fd94b26fec678b5ca60818
SHA256 1adb1fc8f416c6ac941d79642036dc56316b72f4cceadf1841e9c3206ec18ad0
SHA512 361539be5d2486ce933a9156d030cba6bf02b9ce38f1441d50d3106063bca7e7a5eb6db0efad6504d51cde51c55139cbb9f7d73dfc0cb2138b40b54294a4547b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 e05436aebb117e9919978ca32bbcefd9
SHA1 97b2af055317952ce42308ea69b82301320eb962
SHA256 cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f
SHA512 11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c05e98178b3ba89179452865e3d145ab
SHA1 1915fc863198fd1b97ceeb5bc93217cbe865ec8d
SHA256 36c04a58f5e7f9de40167235250b95162ba4ef8845fac69f2899308cecce163f
SHA512 edca7392608d51e311662e7ec53b98e004b4079548e970ee5446c977eed2a12016bc7cd504f8213adfa68c3aeea37a4ed3127c406994a4e4361e469808821d14

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 fe158205119cc2752be4249ac6d5efe1
SHA1 74bc3f31434c770e1b0f249b06e530d49ecf88e4
SHA256 2000d0a71647d579811e2930d5f3c49076a7f992c747a3cbfc57c4c96e364c57
SHA512 063ac46013074924dcba3e930ebd4a7d0150418931d00ff0b4f9b660f47ae7edf4f39494543ab1ec7fbb0cb34cf0cbc10825e6b0fe93addfaee449cefafab639

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586a6d.TMP

MD5 96c296b7b770ba4a64a8fe9707724a68
SHA1 7475e3baf3541035da8535f15b343ac4174a33f9
SHA256 875f2d5d293dc3cd01e8f2c358c64632f5cd1c372310f035df17085e8975a04d
SHA512 f3ac60897a7e9e3b02cc6c4ef5b3c5cc44a001741efac538d7788fd9e0d26d0651c728e52a84bc1c9402a8b39fec2b5f0555e325fbd23c03c4e89eabb9791613

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 6b06a74e7ba675b3b1990b830a3f69cc
SHA1 01e7cac0b6ee251f45c60728b494a9797fc0314d
SHA256 0e261368e4809ac4b5abf3bf2fe4a96e15b33e1d3956036f2e9219a6f138ce38
SHA512 0e807648ccae87ce80b8c0fe52668c84e03e6c397afa52e82a29dccd4a4e6a4bd4a596e39d2f9d978493ddf4c4fca832f6816650c4df642f19a513c5fae26179

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa