e1dc5f270c3bd892ae9c005cf82949aab087c1cecf63330068c0f19bbfd8bc15

Analysis

max time kernel
166s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05dfbda4be2aba9c4f6b53045d2a648d.exe
Size

187KB
MD5

05dfbda4be2aba9c4f6b53045d2a648d
SHA1

6cc330340fe466b638d0f887e6ccb4b47eaebf43
SHA256

e1dc5f270c3bd892ae9c005cf82949aab087c1cecf63330068c0f19bbfd8bc15
SHA512

5e61483f288b49501190fd44c56c78b894633077f6e2cf73b14014134383b0a8f48d57ab05bfaed8093e327ab920e224586bb61a894e9b6255b5f093c8b62746
SSDEEP

3072:I/na6WDmrZ5CnKlQf1kT3bQfxy36JfLRxSo2uVvCEbqyXbzkCnVVT8IkIRel:I/nuDm9tOBe8FBXPkCL4sel

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 22 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	05dfbda4be2aba9c4f6b53045d2a648d.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File created	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File created	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File created	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File created	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\baidu.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe
File opened for modification	C:\Windows\taobao.ico	05dfbda4be2aba9c4f6b53045d2a648d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
3708	msedge.exe
3708	msedge.exe
3180	identity_helper.exe
3180	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 41 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3708	2000	05dfbda4be2aba9c4f6b53045d2a648d.exe	95
PID 2000 wrote to memory of 3708	2000	05dfbda4be2aba9c4f6b53045d2a648d.exe	95
PID 3708 wrote to memory of 1612	3708	msedge.exe	96
PID 3708 wrote to memory of 1612	3708	msedge.exe	96
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 1876	3708	msedge.exe	98
PID 3708 wrote to memory of 2032	3708	msedge.exe	97
PID 3708 wrote to memory of 2032	3708	msedge.exe	97
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99
PID 3708 wrote to memory of 3712	3708	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
"C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:6408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:6840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:6168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
    3⤵
    PID:6188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:6624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2380 /prefetch:1
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
    3⤵
    PID:7076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
    3⤵
    PID:7068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
    3⤵
    PID:6696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
    3⤵
    PID:6188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:6460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13991614657719051379,13251265898368424176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
    3⤵
    PID:1884
- C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
  "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
    3⤵
    PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
      4⤵
      PID:3616
- - C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
    "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
      "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
      4⤵
      Checks computer location settings
      Drops file in Windows directory
      PID:1856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        5⤵
        
        PID:1360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        6⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        5⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:5260
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        6⤵
        
        PID:5516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        7⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        6⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:5816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        7⤵
        
        PID:6096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        8⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        7⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:5344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        8⤵
        
        PID:5412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        9⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        8⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:5580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        9⤵
        
        PID:5876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        10⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        9⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:2228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        10⤵
        
        PID:3136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        11⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        10⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:5856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        11⤵
        
        PID:6336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        12⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        11⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:6572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        12⤵
        
        PID:6708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        13⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        12⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:6980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        13⤵
        
        PID:7132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        14⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        13⤵
        Checks computer location settings
        
        PID:3812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        14⤵
        
        PID:4676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        15⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        14⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:4980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        15⤵
        
        PID:4376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        16⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        15⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:3436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        16⤵
        
        PID:5976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        17⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        16⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:6180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        17⤵
        
        PID:4716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x80,0x100,0x104,0xdc,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        18⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        17⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:6296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        18⤵
        
        PID:5596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        19⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        18⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:6060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        19⤵
        
        PID:7104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        20⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        19⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:6084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        20⤵
        
        PID:6260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        21⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        20⤵
        Checks computer location settings
        
        PID:6488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        21⤵
        
        PID:6468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        22⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        21⤵
        Checks computer location settings
        Drops file in Windows directory
        
        PID:2004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        22⤵
        
        PID:6648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        23⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        22⤵
        Checks computer location settings
        
        PID:5020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        23⤵
        
        PID:7068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        24⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\05dfbda4be2aba9c4f6b53045d2a648d.exe"
        23⤵
        
        PID:2340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lxtt.net/c/t.html
        24⤵
        
        PID:2036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
        25⤵
        
        PID:2820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3a5146f8,0x7ffc3a514708,0x7ffc3a514718
1⤵
PID:3836

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65f321e889065e85d41a9e4782f28685

SHA1
bbb5e8873f68dbca230f1870e70066b44e6ab995

SHA256
6018aaca9f0a9433c8eb76a534185664b10c6dcf82cea183f7b1fbc4f583002d

SHA512
41d03a3b8dd5ae2dd3f8f0f51ff8ef53204622ad117163871d32ab63907451012ae97e6891684e544abe92a6b79917ae7765e3ad2676ed9b144111d1211eadf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2d3bdd1a1d8b15ed7db554185ea98e2

SHA1
eb967cba4ef168f11fc3c2921b506d3594475a90

SHA256
e690a2dbaad3fb063ed633c83170cfdfd8e59f375aaa03f92b4effe129d07047

SHA512
0075207ee1eb807ccd9a9212ecd7423b6a7ebf775c3e11fe81639b6fc1782eeaf12d7f558b11f06d85d78af855aa7fe84c8ac5fd46302f9632538852bbd9553d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0cfe067e955b74e4c6a5898a010cfb0e

SHA1
5701ad82b73435834ce462f9383d073f6543c492

SHA256
a269f1dfc6f4087c4a5c1fb33565d8e57a7a3a78f6c7f58836c5487ae53a8360

SHA512
ae602610bea047e2f314852676479dd8dda669c219b97756d77035c60df0129211fd13bf77cfbb91a8120cdc0df825a393d8ab1fd8fad206e4df164a2e8ab122

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
031dc35499039b43a55540b0991ef6c2

SHA1
febb93739a42231d88b07915d6206defb7ea1403

SHA256
8448f7808202fe45d6b6f8705c63ecc9322b9edd24156508d6447ce8f5aef3a3

SHA512
d28dc23600164b1b36b92fb61b22ee76132672c76e763ce26bba400fa0eabd6583dd3812f5809306bcc01c90a59dd0aec7a169fa60275df47324847676a57a3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eff60285b88e4b5695a0b186bc0497c9

SHA1
68b5b4b18daa1efb0cc7ed853675cf29cdaf7366

SHA256
aa27a3d82414750343601d9d36e3c903240273c3a64c42406cf07cf086b40f44

SHA512
cac6ebdb63ac10a6bbf0eafa4cb8b837b53ff2adc7eab8dcc3cf0188ade921bb693a8c1f748b73dc123c5e4793377fb201a935cf44d3fed94ed1d76a76d261ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\dz.exe

Filesize
542B

MD5
2c650faa042765b7087461041554f4c2

SHA1
253a5503092295e66c2cdc56ec79dce4ff687686

SHA256
bddf1032bf1b8be326adfb6ec42c89f4d4ccfc903a8b4c125df977e16a560ea0

SHA512
d1705ddd9539c45a41fd434ae113c13ed743df927f82ac048db38a8efd7230e3591810d84dedc7a939bf59d5d87c22f04ee0efda8842ad3496f22789893ecad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\etinfr7783.exe

Filesize
3KB

MD5
331262fd042f897be93c904752873fd4

SHA1
c82a16cac665806688206f11de511834ad78e61d

SHA256
0a1dcc314d2d0a3f8091e3c74b08ff451066fc40bf18497db0f68c0be35dadc5

SHA512
fbdb95af15eb9725368c0871b3bc053aca74abdd40b75d7bd44f72a26227093f5e2b5e5f9c68c81b8f1f57eb28298b2ac96298ac976fdf9f129bd59fde82bbf2

Download Submit
C:\Users\Admin\AppData\Roaming\lsass.exe

Filesize
110B

MD5
0c0d0e7d1ff282741e93063e8217a5de

SHA1
a9c22f8512353135adc61741c5023efc12031902

SHA256
a16d3daaea2a1840394c5a008b7c02a32ea8bdbba5d494882f1d4fb5db1aba9c

SHA512
373ff5d053def330dfd86b9620fd738e315ce87991d652145fd5dd69374bf3e65a7831c362905a4c66f35d62477b7f325b8a5ea593d76a86e09db7700c1e506e

Download Submit
C:\Users\Admin\Desktop\°Ù¶ÈËÑË÷.lnk

Filesize
1000B

MD5
4ae27121ac60446287031919d9de4af5

SHA1
34a8458033a0d62082a7192bd8136a84fa6eb522

SHA256
6585f83d412f2cb8b00c4b071242e47a5565fd61ef0ecde08f34b3299a261ad6

SHA512
6749996c6cc6ffdacb19a8cf7ff8ebf9c1c8aa8fad6a0a8dfb0895753c3814e6bdc09e8011ff489125d4fefb81d857d869966794b44346bc3ffa74bfa172345b

Download Submit
C:\Users\Admin\Desktop\ÌÔ±¦Íø.lnk

Filesize
1002B

MD5
12c946492142b0bb1ca66c5d6c493751

SHA1
1f28890a6d70f461a1b4cc60a2ca3c8f89b3e416

SHA256
c4bfe3c2c301fabcb44b62932826a480fafa5ba460491da96d9e1bd108be18c6

SHA512
11b4f6a42335eee721c8ee8878f03927668672c427fcc5c8ab8a3495c4f47d8c9f91135e75f5c0a9bca03c60c21536bacf0e1c3d1a6e3dd5e815e65c0bf51bfe

Download Submit
C:\Windows\baidu.ico

Filesize
16KB

MD5
717b138033a41361b32b60fc5062ab2a

SHA1
af9841b6f0923f890f41feec52c94a0cd68f01d8

SHA256
c70088079fe9441a726c66ce0e73ae38315ec80051d3dd542c41b82fa0a1993a

SHA512
1985bf59c3ee8289bbe55fbe572371d1f401949e6a0179b35ca89e292173780956161feb257303fe9ff5fd2898ca7fd6105eb1796841ade0e1124eeb89aa70ac

Download Submit
memory/1856-431-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2000-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2000-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2228-669-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3592-430-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3812-779-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4388-368-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5260-500-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5344-590-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5580-591-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5816-503-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5856-719-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/6572-720-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/6980-778-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download