umbral | 8b69239c6c167f4d06abefc55e7e554a2c3d3d31de0b64cb9500ec45f1c24fef

Analysis

max time kernel
378s
max time network
382s
platform
windows11-21h2_x64
resource
win11-20231128-en
resource tags

arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system
submitted
08-12-2023 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VM1.-.x64.exe
Size

837KB
MD5

6b7fe527dd88ea7c4fc10e3aa4bebd71
SHA1

5272f90277e0b3dfae74322ec109d45e7daf6ccd
SHA256

8b69239c6c167f4d06abefc55e7e554a2c3d3d31de0b64cb9500ec45f1c24fef
SHA512

ac3c0d38bd6cd2a3c1355fbb3750d255d3552300950a8811caef7b4b211e8fbae5cfd69b522a71eaae6b3a20c1be0895400d68147ae768b00ffb1c42e7ae6f19
SSDEEP

24576:xm2D/+vZGgMPTDshxquGKFzFTSpkPInW:xDD/+hXMPM9FTFInW

Score

10^/10

umbral xworm rat stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1179573880306806895/9PPafRuKqunRXMBgRp7lwh-lO7PV6gpu6bih39np__mk8ZAghkJ95dBDKUvofe3l-iRe

https://discord.com/api/webhooks/1182449804958248970/DRF0ya2e3evg84K0Bvj6KDwl3i7xtSWZ3g0gIs0o-TUVRK-JP1st19-yHi5V8uo23sfe

Extracted

Family

xworm

owner-cc.gl.at.ply.gg:32281

Attributes

install_file
USB.exe

Signatures

Detect Umbral payload 10 IoCs

resource	yara_rule
behavioral1/files/0x000300000002a8c8-211.dat	family_umbral
behavioral1/files/0x000300000002a8c8-220.dat	family_umbral
behavioral1/memory/2072-221-0x000001F21AEE0000-0x000001F21AF20000-memory.dmp	family_umbral
behavioral1/files/0x000300000002a8c8-219.dat	family_umbral
behavioral1/files/0x000300000002a8c8-297.dat	family_umbral
behavioral1/files/0x000300000002a8c8-298.dat	family_umbral
behavioral1/files/0x000300000002a8db-315.dat	family_umbral
behavioral1/files/0x000300000002a8db-321.dat	family_umbral
behavioral1/files/0x000300000002a8db-320.dat	family_umbral
behavioral1/memory/652-333-0x0000023D04400000-0x0000023D04440000-memory.dmp	family_umbral

Detect Xworm Payload 14 IoCs

resource	yara_rule
behavioral1/files/0x0004000000025a56-202.dat	family_xworm
behavioral1/files/0x0004000000025a56-216.dat	family_xworm
behavioral1/files/0x0004000000025a56-215.dat	family_xworm
behavioral1/memory/2716-224-0x00000000004B0000-0x00000000004C6000-memory.dmp	family_xworm
behavioral1/files/0x0004000000025a56-287.dat	family_xworm
behavioral1/files/0x000100000002a8dc-326.dat	family_xworm
behavioral1/files/0x000100000002a8dc-332.dat	family_xworm
behavioral1/memory/2404-336-0x00000000006A0000-0x00000000006B6000-memory.dmp	family_xworm
behavioral1/files/0x000100000002a8dc-331.dat	family_xworm
behavioral1/files/0x000600000002a7c7-618.dat	family_xworm
behavioral1/files/0x000100000002a990-823.dat	family_xworm
behavioral1/files/0x000100000002a990-824.dat	family_xworm
behavioral1/files/0x000100000002a990-826.dat	family_xworm
behavioral1/files/0x000100000002a990-841.dat	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSoundSystem.lnk	MediaFMPEG.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSoundSystem.lnk	MediaFMPEG.exe

Executes dropped EXE 9 IoCs

pid	Process
2716	XClient.exe
2072	Umbral1.exe
2404	XClient.exe
3108	Umbral1.exe
652	MediaPro.exe
2404	MediaFMPEG.exe
5648	WindowsSoundSystem.exe
5728	WindowsSoundSystem.exe
5944	WindowsSoundSystem.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
16	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3167230361-3851490586-2616496888-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3167230361-3851490586-2616496888-1000\{E62ECD78-C53E-4331-BAE1-564ED0D7AA25}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 674565.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
1472	msedge.exe
1472	msedge.exe
2952	msedge.exe
2952	msedge.exe
2816	identity_helper.exe
2816	identity_helper.exe
2436	msedge.exe
2436	msedge.exe
2072	msedge.exe
2072	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4780	msedge.exe
4780	msedge.exe
5492	msedge.exe
5492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	Umbral1.exe
Token: SeIncreaseQuotaPrivilege	3008	wmic.exe
Token: SeSecurityPrivilege	3008	wmic.exe
Token: SeTakeOwnershipPrivilege	3008	wmic.exe
Token: SeLoadDriverPrivilege	3008	wmic.exe
Token: SeSystemProfilePrivilege	3008	wmic.exe
Token: SeSystemtimePrivilege	3008	wmic.exe
Token: SeProfSingleProcessPrivilege	3008	wmic.exe
Token: SeIncBasePriorityPrivilege	3008	wmic.exe
Token: SeCreatePagefilePrivilege	3008	wmic.exe
Token: SeBackupPrivilege	3008	wmic.exe
Token: SeRestorePrivilege	3008	wmic.exe
Token: SeShutdownPrivilege	3008	wmic.exe
Token: SeDebugPrivilege	3008	wmic.exe
Token: SeSystemEnvironmentPrivilege	3008	wmic.exe
Token: SeRemoteShutdownPrivilege	3008	wmic.exe
Token: SeUndockPrivilege	3008	wmic.exe
Token: SeManageVolumePrivilege	3008	wmic.exe
Token: 33	3008	wmic.exe
Token: 34	3008	wmic.exe
Token: 35	3008	wmic.exe
Token: 36	3008	wmic.exe
Token: SeIncreaseQuotaPrivilege	3008	wmic.exe
Token: SeSecurityPrivilege	3008	wmic.exe
Token: SeTakeOwnershipPrivilege	3008	wmic.exe
Token: SeLoadDriverPrivilege	3008	wmic.exe
Token: SeSystemProfilePrivilege	3008	wmic.exe
Token: SeSystemtimePrivilege	3008	wmic.exe
Token: SeProfSingleProcessPrivilege	3008	wmic.exe
Token: SeIncBasePriorityPrivilege	3008	wmic.exe
Token: SeCreatePagefilePrivilege	3008	wmic.exe
Token: SeBackupPrivilege	3008	wmic.exe
Token: SeRestorePrivilege	3008	wmic.exe
Token: SeShutdownPrivilege	3008	wmic.exe
Token: SeDebugPrivilege	3008	wmic.exe
Token: SeSystemEnvironmentPrivilege	3008	wmic.exe
Token: SeRemoteShutdownPrivilege	3008	wmic.exe
Token: SeUndockPrivilege	3008	wmic.exe
Token: SeManageVolumePrivilege	3008	wmic.exe
Token: 33	3008	wmic.exe
Token: 34	3008	wmic.exe
Token: 35	3008	wmic.exe
Token: 36	3008	wmic.exe
Token: SeDebugPrivilege	2716	XClient.exe
Token: SeDebugPrivilege	2716	XClient.exe
Token: SeDebugPrivilege	3108	Umbral1.exe
Token: SeIncreaseQuotaPrivilege	1928	wmic.exe
Token: SeSecurityPrivilege	1928	wmic.exe
Token: SeTakeOwnershipPrivilege	1928	wmic.exe
Token: SeLoadDriverPrivilege	1928	wmic.exe
Token: SeSystemProfilePrivilege	1928	wmic.exe
Token: SeSystemtimePrivilege	1928	wmic.exe
Token: SeProfSingleProcessPrivilege	1928	wmic.exe
Token: SeIncBasePriorityPrivilege	1928	wmic.exe
Token: SeCreatePagefilePrivilege	1928	wmic.exe
Token: SeBackupPrivilege	1928	wmic.exe
Token: SeRestorePrivilege	1928	wmic.exe
Token: SeShutdownPrivilege	1928	wmic.exe
Token: SeDebugPrivilege	1928	wmic.exe
Token: SeSystemEnvironmentPrivilege	1928	wmic.exe
Token: SeRemoteShutdownPrivilege	1928	wmic.exe
Token: SeUndockPrivilege	1928	wmic.exe
Token: SeManageVolumePrivilege	1928	wmic.exe
Token: 33	1928	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	OpenWith.exe
4612	RC7_UI.exe
4612	RC7_UI.exe
4128	MiniSearchHost.exe
2412	RC7_UI.exe
2412	RC7_UI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 788	5092	msedge.exe	93
PID 5092 wrote to memory of 788	5092	msedge.exe	93
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 2720	5092	msedge.exe	95
PID 5092 wrote to memory of 1472	5092	msedge.exe	99
PID 5092 wrote to memory of 1472	5092	msedge.exe	99
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98
PID 5092 wrote to memory of 2680	5092	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\VM1.-.x64.exe
"C:\Users\Admin\AppData\Local\Temp\VM1.-.x64.exe"
1⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb57f53cb8,0x7ffb57f53cc8,0x7ffb57f53cd8
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1240 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1644 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8336 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8556 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5492
- C:\Users\Admin\Downloads\WindowsSoundSystem.exe
  "C:\Users\Admin\Downloads\WindowsSoundSystem.exe"
  2⤵
  - Executes dropped EXE
  PID:5648
- C:\Users\Admin\Downloads\WindowsSoundSystem.exe
  "C:\Users\Admin\Downloads\WindowsSoundSystem.exe"
  2⤵
  - Executes dropped EXE
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1900,10763078382074634948,3808550548736281336,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7720 /prefetch:8
  2⤵
  PID:6048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb57f53cb8,0x7ffb57f53cc8,0x7ffb57f53cd8
1⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,10098079481435017105,3980975232004407538,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
1⤵
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,10098079481435017105,3980975232004407538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2376

C:\Users\Admin\Downloads\RC7\RC7_UI.exe
"C:\Users\Admin\Downloads\RC7\RC7_UI.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4612

C:\Users\Admin\Downloads\RC7\RC7\RC7.exe
"C:\Users\Admin\Downloads\RC7\RC7\RC7.exe"
1⤵
PID:840
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\Umbral1.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\RC7\RC7\Monaco.html
1⤵
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb57f53cb8,0x7ffb57f53cc8,0x7ffb57f53cd8
  2⤵
  PID:2848

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\RC7\RC7\MonacoEditor.html
1⤵
PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffb57f53cb8,0x7ffb57f53cc8,0x7ffb57f53cd8
  2⤵
  PID:4764

C:\Users\Admin\Downloads\RC7\RC7\RC7.exe
"C:\Users\Admin\Downloads\RC7\RC7\RC7.exe"
1⤵
PID:2944
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\Umbral1.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3108
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\RC7\start (Run This to start the executor).bat" "
1⤵
PID:1896
- C:\Users\Admin\Downloads\RC7\RC7_UI.exe
  RC7_UI.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2412
- C:\Users\Admin\Downloads\RC7\HWID.exe
  HWID.exe
  2⤵
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\MediaPro.exe
    "C:\Users\Admin\AppData\Local\Temp\MediaPro.exe"
    3⤵
    - Executes dropped EXE
    PID:652
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:3440
- - C:\Users\Admin\AppData\Local\Temp\MediaFMPEG.exe
    "C:\Users\Admin\AppData\Local\Temp\MediaFMPEG.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    PID:2404

C:\Users\Admin\Downloads\WindowsSoundSystem.exe
"C:\Users\Admin\Downloads\WindowsSoundSystem.exe"
1⤵
- Executes dropped EXE
PID:5944

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\99cf97a2b2954286ae1693580d5311fa /t 4564 /p 2412
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RC7.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Umbral1.exe.log

Filesize
1KB

MD5
02df789e3c730b309fc4d9abce5d729b

SHA1
4f9da0f0d4cadacfd0f68fb1f7ee73a66dcf1b4e

SHA256
4afabcd1723096359d90c8f32df7a6a44cd866e89d5b37c89280bfeab61d7321

SHA512
7ac0dd7e3a3e483d07409da793dd2b0915d4369fe41fe743acd82de9aa77b9fa7ea5cd60498034f3fa0674d93d184c9128375d8f7f0796fddecff3845fca8587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsSoundSystem.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439cc96156cf343dade9345e6add733d

SHA1
12ae10c8d3698eaa2111449a8b7c972e52e82485

SHA256
760c7f67c10f0a7b2539697f083b5ecf5286596fb90b2de115e9fbad518c8071

SHA512
9f3081c7857a3e7155c1b1170b8c706445b0044eaac6dce45ef95a89ff7e96544a3b6d2d05bbf20cfc6585ba5001c3b24c242600db59c3201db5fa4d8ca1a995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439cc96156cf343dade9345e6add733d

SHA1
12ae10c8d3698eaa2111449a8b7c972e52e82485

SHA256
760c7f67c10f0a7b2539697f083b5ecf5286596fb90b2de115e9fbad518c8071

SHA512
9f3081c7857a3e7155c1b1170b8c706445b0044eaac6dce45ef95a89ff7e96544a3b6d2d05bbf20cfc6585ba5001c3b24c242600db59c3201db5fa4d8ca1a995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439cc96156cf343dade9345e6add733d

SHA1
12ae10c8d3698eaa2111449a8b7c972e52e82485

SHA256
760c7f67c10f0a7b2539697f083b5ecf5286596fb90b2de115e9fbad518c8071

SHA512
9f3081c7857a3e7155c1b1170b8c706445b0044eaac6dce45ef95a89ff7e96544a3b6d2d05bbf20cfc6585ba5001c3b24c242600db59c3201db5fa4d8ca1a995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439cc96156cf343dade9345e6add733d

SHA1
12ae10c8d3698eaa2111449a8b7c972e52e82485

SHA256
760c7f67c10f0a7b2539697f083b5ecf5286596fb90b2de115e9fbad518c8071

SHA512
9f3081c7857a3e7155c1b1170b8c706445b0044eaac6dce45ef95a89ff7e96544a3b6d2d05bbf20cfc6585ba5001c3b24c242600db59c3201db5fa4d8ca1a995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
47KB

MD5
e2d74c5e631bc53a7240bbfe4be99c8f

SHA1
eb513857bb01cc4f7249067fc7e969bef415fc90

SHA256
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5

SHA512
ce26a692dbae0d0a5a0ccda9d5e10b0bd135d104428beddee0edaf7da6961f9dbf27bae19130cfd11564f2acfdc414559bb8c918cfe459d7a7fae44abb5fe1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
200KB

MD5
b3ba9decc3bb52ed5cca8158e05928a9

SHA1
19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

SHA256
8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

SHA512
86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
86026d5f3bb414b4d30ed2f8f56b5104

SHA1
e77cfc1e436637c068c5d9575b2e0b7c3c7b6110

SHA256
77b30c0d9efc246919a752d8280c4f000379b35e61d6edcdf79ba0c5d0a1c2da

SHA512
0683ec9a2e0b990eb234dd2c731b826d84a705cc9f0dca707dab0177275025859b13a643dbfc61ccbbf97c493b896e6d087c1b6b6b2323f30ca24798fdd63d0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
699B

MD5
5d42e84798c10b4e9720020bbc3844cb

SHA1
81cc95c7d9868c76cd3a176631d6480e3692fcf8

SHA256
275ce440ae239de247067436d72a17ffc3e02ffd62a63ebe135fd7cf8cc80b78

SHA512
b8cc1525b7e542c5382da5f9926fea4d8afe84479c2cf2139bec9133e27aa70b99fc4f0239908ee85ac3bce5d0f12af4fa22d35bece28891b9b3e1753b534693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
5c145223757bae19b0e567ce52456fee

SHA1
875c79d6280531a8f7f25d83eff8ae84b668e93a

SHA256
f7509132db68979a68bb0e04d6f3c3211dc9369977518905e1984bdbb3a8d64a

SHA512
f49eb44414fec0a2c7faf8e54328385f609c98cf3e518723a8f8bcacc50f5af1af3fd14cff4265ec69346d4c62580ab419a85d4bcf8933c5f43a1552f8b88d65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
22c81fc147c3f94c48d6ae3aec70fbdb

SHA1
0b01d1785d70d52c841c02c4f838346f26e82a8c

SHA256
2de74b05877e1d3f0ca2c28c7b83edd5141d610676e6afa9af652cd97ce6bec2

SHA512
fdb91b2c473f739b22d3abdae898866ff2e68d026e535dffaba7388492471df71ca950c52eae8e0cf1fc7b56c829895f2dbab065aedfbacad3d52182284377c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da1c73b5cddcf2509979d223cd091072

SHA1
da8157cf6e9d4b6d8efe2fdccc7f589273545604

SHA256
5275985d7d1f240b86ef5ec6e8d2cc200a39eb3b3ffeb9233e1fb6cfec513bef

SHA512
d324d5b9bd659a72b08cec8b07df406a62b80609cbf50ca49be8175a5baeca29f99f243e5204f3606e52c93a5f0b396d3ef5bf2a189dc0cdf119caffc3918794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
69f06d7e1022a5bb0bcb514226d0ca79

SHA1
07e8a61c4cf0321e4118d0306b107506944a0b36

SHA256
a82456de42fbacd9878f25c7f034835708170b7121e4aae117c9603fe881bc87

SHA512
a2099c70502c7b407204cc8730410fcc6c78548e9e7caa7780c68f42ea68a6a7b95369af1c3f84e2892a79058e2911a9e3b1441b7b47e9ca66a627c03022436e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
d363d4ddd0e00050d22dbb54593b6048

SHA1
b10e5a7ca4b9f8358f8277b592601dd23d504d0c

SHA256
ea083ce9ad48def44e9228f4c8637a43c77293f3c7a7027ebfcfb2b2eec56844

SHA512
8eb5e9e26e42cbfe51478eb3e1dd832e5d1844a1f57cf13ccce2e4b4c58fd68b7c36543e92b8da5ed627049d5ed403422d50c4c72426d0625c36de68180de49d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
b4173e4c3614c39cd26116e9b55ed6d4

SHA1
2762cb4738b6d258de3f4923876f0f424c149fba

SHA256
4239289b31275cd2762c19515c246adbdc3b9e73a80c305963d1358b798a2c98

SHA512
86c51aaadc3deea28a2496983d0360847c1610e0694a33cca11e8677db5d923eb15d3b9da757159a2367c5e679d00ff627872f71bbee870be9337e1dda868cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
303fa5bce1b822033bcaa660bb5342c4

SHA1
9ffca8f76afe721f3e22d16d4bd60b858c7c529b

SHA256
4ad7d103927d7a111628a833798f32c6a0bdef51b987f90a099e071f15189a18

SHA512
63aa47cbc742e62b7ad33eaf92aff694cfd910e3aec4ccdd8be27b7c843bfc98f9c6763dca5ff014f38ec73d7e38801e568c560173af25966fcbb38008ef5282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b77488e68a2f5db07d92256565d2d76

SHA1
d060e8ecb3052832b20cb1c0844e3d56b6ff45d3

SHA256
416e063b43180f4684d307985d0d0992e5ca30942a8a1c0bcabcaff5b2079acb

SHA512
240365efd56df73fca01a79b779bf67ef90d129a616fa300b614c98e12e2409f23928810dcddbb335c3a5579a15e67c71692f8f81884c14e808a3ea491511a2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
79395b1f4f46e89853c8d6bbbd6c2f04

SHA1
0a472822c6880c0ceb6a6fa4c10475f36bf6d461

SHA256
582476e23fda961585f75f73f8ed5d354955ed11b6887ba7b98bc5500037b9f5

SHA512
d4eab6989ee85a8084a2b5f65baf6730aa4a08c3ab351434214613e996804605f0abd0cd65d25f0fc07a0cc2a1d949686481392c6dbb4654ed2f7e1dc8831ee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2a8b63ea696e41481fbbd1a2eaed9259

SHA1
903a5a338ce4bd064252df8e1254b4a1d53e47c6

SHA256
884f7c9b6ff65d7e0c8e14e771642ffb5bb91a7dbaff0c4af36e0220aa9fedce

SHA512
f1b65508e158fac9d30bd9a3eb7eec78e551a045dafbe46497d42dcd34eb1d75e028e03e4b40442b8050c3700426b49bc09dde81db799570d7b8f7dfa6a1bc88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9cb73448028db90f18e00ff905fb6bb3

SHA1
a8802bb4242236be8991665be5e2827bd8d6bb9d

SHA256
849d8d9837ba1e852773cc6f2f276aab07a47e576d6dbd2f00736f64284fd067

SHA512
f5fdc61bb1e438dbdc60d2da5f81f2a290f04de449c17a32f9d2166932887b430d71c184999413eff4210a6f0c94c62df326ecce6a53c5bc6b944ffa70f8cd9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b5502.TMP

Filesize
204B

MD5
5c3325d180fa96432f6149f0de2766c8

SHA1
35e3166b1647b90ca6c3e083e5765e5c65d101fa

SHA256
a2a2b6804098ac92cba737cd1698b83afb49dd6a6a9cd341683ca65db9b15dba

SHA512
8e752c73f3bfbe500b93db3443452dfd1f7a56a4b4e41edc929fb0bfcf0994828d3f9ccd058ad2ac75f200d2139bdd3a444cccd5e61b97c66fb4d5dcb60d771c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
017cf1ada7da95a8949764b015e3db74

SHA1
2665314fb3420ce1412b8e7cf4f8e6a904e9a8a1

SHA256
fd79c2372159976a0a1ba263cf23c1e6a18057a2d28eef16ac257011fbe884fc

SHA512
561718808a76476cee5cf50dc1794b1f2c28415830de47e13d413dfdd01af8cb76f27ee817dcfc3b8d6f432194e3249384182a591abc8ea279dc419e4da6d42c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b3248bd234d1e7530782d06b39f0ac6

SHA1
b0c8f9b70e3d2872892fdd0bffe599e5404d928f

SHA256
059cfbefe767577143b0cf93aa55b73e5454e30b9646f28681db33b640f745ff

SHA512
cc5f4abbe92302922b87dcddd0ae158fe66b97275f0e8ba85f3f7145cedc1e552e272447566aa9c5df4d117080cac24f66a9ee87d3ec0f303a1143587a858f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7739255ee0c56b5eef961665a7476b5

SHA1
b3448aa423b20e743150671424e5686fa8bf9edd

SHA256
6515ff3ab82a90241bf5d128ddf22b2e1ba2107bfb9cee7c6be02e10bc9848b4

SHA512
90cacaec27c8bb8824657d0afb753e7e831d05b206ce8c6c045a9901ded3b657345ffbbce8524836c9352192594456d1d258c3b4cb844ee3988c555c8a3830d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9e9732019607ab7115eec839a40ce192

SHA1
947a423f434e1a9329a66fdad4879b24932c256e

SHA256
50daa0304a09798cf1b54b32e5ebbe5af29b24605142e2f7d1733dc09b7cea34

SHA512
7c0f028f7be1c4fa0f6816407707c39bd57cb533602d779c3f68f2378d080ac25d3a65fb84bbfc3527b5bf8b51cef3948feafdd9d09bd92ae6e3992913e8575f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a84419e987550e568f720194f5cd9d81

SHA1
1ee4c902cc1fa794100dec80565d90f0a464da19

SHA256
0707cb793490c500967c2d4a1e52a8111c8c74735936d1c30b5274ff0eb6ea65

SHA512
138457f3f9fe5b7ce91a508cf4e508093fba9a58998e638fd7aaa982a81399a9afe50c6c34dd747b860755139a63293915d33dcbb5900364b80104f692f68efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
13d668924f8194c680676d6a30f0aa82

SHA1
854cba00ec01d3ec1e7ba1b855887affc5adee53

SHA256
710d30a1ecd265ffedc53aac4321c8a930f7e0dbd6c23a65644a22e010d365b1

SHA512
a40022e94aac578e0b03904cc3101fe6ca78d74f608e4bb7f3447a26146afef9a9f45d6ede41f9f69c07c374ae8d0f14dc631452d58eedeacfb016246a2e3fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MediaFMPEG.exe

Filesize
64KB

MD5
99ddf6a151421800d4dfad68d91d927b

SHA1
b4755386907a1b5dd1f5880bc052d82c341bbbeb

SHA256
2e82fc1be4a91982899744ff91a3552e40007119e7422bbb0a2ceb6913a3eb35

SHA512
89e61b9d8351b062877ef3900aa4cf2c8cec8eb6eac0d5f68ea727bfd2142f23d5c9d30a83fdc375d225f3f8811c84ad301ee25a8210510793725630454f9e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\MediaFMPEG.exe

Filesize
64KB

MD5
99ddf6a151421800d4dfad68d91d927b

SHA1
b4755386907a1b5dd1f5880bc052d82c341bbbeb

SHA256
2e82fc1be4a91982899744ff91a3552e40007119e7422bbb0a2ceb6913a3eb35

SHA512
89e61b9d8351b062877ef3900aa4cf2c8cec8eb6eac0d5f68ea727bfd2142f23d5c9d30a83fdc375d225f3f8811c84ad301ee25a8210510793725630454f9e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\MediaFMPEG.exe

Filesize
64KB

MD5
99ddf6a151421800d4dfad68d91d927b

SHA1
b4755386907a1b5dd1f5880bc052d82c341bbbeb

SHA256
2e82fc1be4a91982899744ff91a3552e40007119e7422bbb0a2ceb6913a3eb35

SHA512
89e61b9d8351b062877ef3900aa4cf2c8cec8eb6eac0d5f68ea727bfd2142f23d5c9d30a83fdc375d225f3f8811c84ad301ee25a8210510793725630454f9e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\MediaPro.exe

Filesize
229KB

MD5
fc9e510f55135245c1941e024acbafa0

SHA1
ed386ee1a7ee1172e64c25599dabc0e80ce76633

SHA256
f52ca778f7b6c0d6bff56549c1e8d06dcf02a79382c7e39ab2bad261ae1f03d6

SHA512
c4883fb0e0b7b6a1342cb1dadbcab6aefd8e508f3478e541656f092a7e633cdb38cb07e6f0f0e82e6941ba6205bc3007462de6e83a03701911b76f9adbfc8056

Download Submit
C:\Users\Admin\AppData\Local\Temp\MediaPro.exe

Filesize
229KB

MD5
fc9e510f55135245c1941e024acbafa0

SHA1
ed386ee1a7ee1172e64c25599dabc0e80ce76633

SHA256
f52ca778f7b6c0d6bff56549c1e8d06dcf02a79382c7e39ab2bad261ae1f03d6

SHA512
c4883fb0e0b7b6a1342cb1dadbcab6aefd8e508f3478e541656f092a7e633cdb38cb07e6f0f0e82e6941ba6205bc3007462de6e83a03701911b76f9adbfc8056

Download Submit
C:\Users\Admin\AppData\Local\Temp\MediaPro.exe

Filesize
229KB

MD5
fc9e510f55135245c1941e024acbafa0

SHA1
ed386ee1a7ee1172e64c25599dabc0e80ce76633

SHA256
f52ca778f7b6c0d6bff56549c1e8d06dcf02a79382c7e39ab2bad261ae1f03d6

SHA512
c4883fb0e0b7b6a1342cb1dadbcab6aefd8e508f3478e541656f092a7e633cdb38cb07e6f0f0e82e6941ba6205bc3007462de6e83a03701911b76f9adbfc8056

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral1.exe

Filesize
231KB

MD5
5c04d1b604c881ae86da044c2d16b8b2

SHA1
c9f98d064e8284a51d43d72c15211fdd6edee1c8

SHA256
5b0ae3b59dcfbdf94878f652d328c12b61b0783082046815bc6d01fecd8fd769

SHA512
d156d5cab74668e2899aaced344d6d4e8e89eaaa6936c8378f89126747543f063066dd6c91e39203cbad0dfc9027aef5853775cef47751b669de6336d97223d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral1.exe

Filesize
231KB

MD5
5c04d1b604c881ae86da044c2d16b8b2

SHA1
c9f98d064e8284a51d43d72c15211fdd6edee1c8

SHA256
5b0ae3b59dcfbdf94878f652d328c12b61b0783082046815bc6d01fecd8fd769

SHA512
d156d5cab74668e2899aaced344d6d4e8e89eaaa6936c8378f89126747543f063066dd6c91e39203cbad0dfc9027aef5853775cef47751b669de6336d97223d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral1.exe

Filesize
231KB

MD5
5c04d1b604c881ae86da044c2d16b8b2

SHA1
c9f98d064e8284a51d43d72c15211fdd6edee1c8

SHA256
5b0ae3b59dcfbdf94878f652d328c12b61b0783082046815bc6d01fecd8fd769

SHA512
d156d5cab74668e2899aaced344d6d4e8e89eaaa6936c8378f89126747543f063066dd6c91e39203cbad0dfc9027aef5853775cef47751b669de6336d97223d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral1.exe

Filesize
231KB

MD5
5c04d1b604c881ae86da044c2d16b8b2

SHA1
c9f98d064e8284a51d43d72c15211fdd6edee1c8

SHA256
5b0ae3b59dcfbdf94878f652d328c12b61b0783082046815bc6d01fecd8fd769

SHA512
d156d5cab74668e2899aaced344d6d4e8e89eaaa6936c8378f89126747543f063066dd6c91e39203cbad0dfc9027aef5853775cef47751b669de6336d97223d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral1.exe

Filesize
231KB

MD5
5c04d1b604c881ae86da044c2d16b8b2

SHA1
c9f98d064e8284a51d43d72c15211fdd6edee1c8

SHA256
5b0ae3b59dcfbdf94878f652d328c12b61b0783082046815bc6d01fecd8fd769

SHA512
d156d5cab74668e2899aaced344d6d4e8e89eaaa6936c8378f89126747543f063066dd6c91e39203cbad0dfc9027aef5853775cef47751b669de6336d97223d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClient.exe

Filesize
60KB

MD5
fd41a98611978677f1adc60f86383ea0

SHA1
200cfd48d7f7d28cff9c177cdd804e6fd578c015

SHA256
ffc549f9e84b6ecaa96e1cb49c18a8bdd89d536e0556962c88995967009cdc3d

SHA512
87a0d544d9b1dd2b53d40cd54d2c6955927dc287d2cf557eb50f408c3e6002efdac3ecbe908b49bf153bb9276d23e3e459bbaa502167cc52a63ae08a40251270

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClient.exe

Filesize
60KB

MD5
fd41a98611978677f1adc60f86383ea0

SHA1
200cfd48d7f7d28cff9c177cdd804e6fd578c015

SHA256
ffc549f9e84b6ecaa96e1cb49c18a8bdd89d536e0556962c88995967009cdc3d

SHA512
87a0d544d9b1dd2b53d40cd54d2c6955927dc287d2cf557eb50f408c3e6002efdac3ecbe908b49bf153bb9276d23e3e459bbaa502167cc52a63ae08a40251270

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClient.exe

Filesize
60KB

MD5
fd41a98611978677f1adc60f86383ea0

SHA1
200cfd48d7f7d28cff9c177cdd804e6fd578c015

SHA256
ffc549f9e84b6ecaa96e1cb49c18a8bdd89d536e0556962c88995967009cdc3d

SHA512
87a0d544d9b1dd2b53d40cd54d2c6955927dc287d2cf557eb50f408c3e6002efdac3ecbe908b49bf153bb9276d23e3e459bbaa502167cc52a63ae08a40251270

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClient.exe

Filesize
60KB

MD5
fd41a98611978677f1adc60f86383ea0

SHA1
200cfd48d7f7d28cff9c177cdd804e6fd578c015

SHA256
ffc549f9e84b6ecaa96e1cb49c18a8bdd89d536e0556962c88995967009cdc3d

SHA512
87a0d544d9b1dd2b53d40cd54d2c6955927dc287d2cf557eb50f408c3e6002efdac3ecbe908b49bf153bb9276d23e3e459bbaa502167cc52a63ae08a40251270

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
c2cb21351f5f73fa13aa4fa25d84d55b

SHA1
5f6586dda735ebe707cb5fa2447595f52f82c72e

SHA256
0319905e46f0e657aaee9732c39963747aa3d561cdae178c48e7dd55d085cc2e

SHA512
c35308a3e09d437db8ef6495841e0b765d6d08fd56a454c9d8f7510761370b39f0e7c8d8d0fa9e0523a1051b6fb12dcf930a1b280fc45e9d5c6e8cf7599be71e

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSoundSystem.exe

Filesize
64KB

MD5
99ddf6a151421800d4dfad68d91d927b

SHA1
b4755386907a1b5dd1f5880bc052d82c341bbbeb

SHA256
2e82fc1be4a91982899744ff91a3552e40007119e7422bbb0a2ceb6913a3eb35

SHA512
89e61b9d8351b062877ef3900aa4cf2c8cec8eb6eac0d5f68ea727bfd2142f23d5c9d30a83fdc375d225f3f8811c84ad301ee25a8210510793725630454f9e87

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 400746.crdownload

Filesize
10.4MB

MD5
87dd7e7656967acf2576926193508f67

SHA1
9a8f76bf1e7c66f77b515044889db15cb2aa2f2b

SHA256
a0b1cfde1a11f03119d6650b8d6dd9f5faa1a51469b1be70ff26f4f02b56b414

SHA512
0da941d7a5b201a4dd04eddc7d56b963c5b6f4fd6935c3b5ad2305bcf11cb73641e310a913bd716e0a4015117b4c69dec55fee23206705fd9e2086e2c929fc90

Download Submit
C:\Users\Admin\Downloads\WindowsSoundSystem.exe

Filesize
64KB

MD5
99ddf6a151421800d4dfad68d91d927b

SHA1
b4755386907a1b5dd1f5880bc052d82c341bbbeb

SHA256
2e82fc1be4a91982899744ff91a3552e40007119e7422bbb0a2ceb6913a3eb35

SHA512
89e61b9d8351b062877ef3900aa4cf2c8cec8eb6eac0d5f68ea727bfd2142f23d5c9d30a83fdc375d225f3f8811c84ad301ee25a8210510793725630454f9e87

Download Submit
C:\Users\Admin\Downloads\WindowsSoundSystem.exe

Filesize
64KB

MD5
99ddf6a151421800d4dfad68d91d927b

SHA1
b4755386907a1b5dd1f5880bc052d82c341bbbeb

SHA256
2e82fc1be4a91982899744ff91a3552e40007119e7422bbb0a2ceb6913a3eb35

SHA512
89e61b9d8351b062877ef3900aa4cf2c8cec8eb6eac0d5f68ea727bfd2142f23d5c9d30a83fdc375d225f3f8811c84ad301ee25a8210510793725630454f9e87

Download Submit
C:\Users\Admin\Downloads\WindowsSoundSystem.exe

Filesize
64KB

MD5
99ddf6a151421800d4dfad68d91d927b

SHA1
b4755386907a1b5dd1f5880bc052d82c341bbbeb

SHA256
2e82fc1be4a91982899744ff91a3552e40007119e7422bbb0a2ceb6913a3eb35

SHA512
89e61b9d8351b062877ef3900aa4cf2c8cec8eb6eac0d5f68ea727bfd2142f23d5c9d30a83fdc375d225f3f8811c84ad301ee25a8210510793725630454f9e87

Download Submit
C:\Users\Admin\Downloads\WindowsSoundSystem.exe

Filesize
64KB

MD5
99ddf6a151421800d4dfad68d91d927b

SHA1
b4755386907a1b5dd1f5880bc052d82c341bbbeb

SHA256
2e82fc1be4a91982899744ff91a3552e40007119e7422bbb0a2ceb6913a3eb35

SHA512
89e61b9d8351b062877ef3900aa4cf2c8cec8eb6eac0d5f68ea727bfd2142f23d5c9d30a83fdc375d225f3f8811c84ad301ee25a8210510793725630454f9e87

Download Submit
memory/652-341-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/652-338-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/652-333-0x0000023D04400000-0x0000023D04440000-memory.dmp

Filesize
256KB

Download
memory/840-222-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/840-198-0x000000001BA80000-0x000000001BA90000-memory.dmp

Filesize
64KB

Download
memory/840-196-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/840-195-0x0000000000D80000-0x0000000000DAE000-memory.dmp

Filesize
184KB

Download
memory/2072-229-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/2072-227-0x000001F21CDA0000-0x000001F21CDB0000-memory.dmp

Filesize
64KB

Download
memory/2072-225-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/2072-221-0x000001F21AEE0000-0x000001F21AF20000-memory.dmp

Filesize
256KB

Download
memory/2404-360-0x000000001B390000-0x000000001B3A0000-memory.dmp

Filesize
64KB

Download
memory/2404-336-0x00000000006A0000-0x00000000006B6000-memory.dmp

Filesize
88KB

Download
memory/2404-359-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/2404-351-0x000000001B390000-0x000000001B3A0000-memory.dmp

Filesize
64KB

Download
memory/2404-339-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/2404-300-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/2404-305-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/2412-307-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/2412-358-0x0000000001D40000-0x0000000001D50000-memory.dmp

Filesize
64KB

Download
memory/2412-357-0x0000000001D40000-0x0000000001D50000-memory.dmp

Filesize
64KB

Download
memory/2412-356-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/2412-309-0x0000000001D40000-0x0000000001D50000-memory.dmp

Filesize
64KB

Download
memory/2716-238-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/2716-230-0x000000001B270000-0x000000001B280000-memory.dmp

Filesize
64KB

Download
memory/2716-239-0x000000001B270000-0x000000001B280000-memory.dmp

Filesize
64KB

Download
memory/2716-226-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/2716-224-0x00000000004B0000-0x00000000004C6000-memory.dmp

Filesize
88KB

Download
memory/2944-286-0x0000000002900000-0x0000000002910000-memory.dmp

Filesize
64KB

Download
memory/2944-285-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/2944-335-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/3108-303-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/3108-302-0x00000214D3170000-0x00000214D3180000-memory.dmp

Filesize
64KB

Download
memory/3108-301-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/4612-223-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/4612-144-0x00000000006B0000-0x0000000000784000-memory.dmp

Filesize
848KB

Download
memory/4612-147-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/4612-148-0x0000000005230000-0x000000000523A000-memory.dmp

Filesize
40KB

Download
memory/4612-149-0x0000000005240000-0x000000000524A000-memory.dmp

Filesize
40KB

Download
memory/4612-194-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/4612-193-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/4612-183-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/4612-164-0x000000000ADF0000-0x000000000B596000-memory.dmp

Filesize
7.6MB

Download
memory/4612-163-0x0000000009BB0000-0x0000000009C00000-memory.dmp

Filesize
320KB

Download
memory/4612-162-0x0000000009800000-0x0000000009B57000-memory.dmp

Filesize
3.3MB

Download
memory/4612-161-0x0000000009760000-0x0000000009782000-memory.dmp

Filesize
136KB

Download
memory/4612-160-0x0000000009670000-0x000000000971A000-memory.dmp

Filesize
680KB

Download
memory/4612-145-0x0000000005820000-0x0000000005DC6000-memory.dmp

Filesize
5.6MB

Download
memory/4612-159-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/4612-143-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/4612-150-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/4612-158-0x00000000087F0000-0x0000000008832000-memory.dmp

Filesize
264KB

Download
memory/4612-157-0x0000000008860000-0x000000000891E000-memory.dmp

Filesize
760KB

Download
memory/4612-146-0x0000000005270000-0x0000000005302000-memory.dmp

Filesize
584KB

Download
memory/4620-337-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/4620-308-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/4620-310-0x000000001BDC0000-0x000000001BDD0000-memory.dmp

Filesize
64KB

Download
memory/4620-306-0x0000000000C00000-0x0000000000C2A000-memory.dmp

Filesize
168KB

Download
memory/5648-829-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/5648-825-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/5728-827-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/5728-840-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/5944-854-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download
memory/5944-842-0x00007FFB54370000-0x00007FFB54E32000-memory.dmp

Filesize
10.8MB

Download