58f73ca7b211babf9f79299ba4e518eebe46651022da7409f42dd9ae09287215

Analysis

max time kernel
17s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

144dec8962a519049a8e860040ff8c83.exe
Size

250KB
MD5

144dec8962a519049a8e860040ff8c83
SHA1

2fb0f8c7fe8e27f20bae99c5b35fb8641f865fcb
SHA256

58f73ca7b211babf9f79299ba4e518eebe46651022da7409f42dd9ae09287215
SHA512

43b39d95cb290bf7b4bd74d15037fca71ea39e632d802af7a3e469a70bdcf8fe9cda2a712043c6e73ab906b6224d113552dc6ff41e16f1fb4a5d82cc2f7b2532
SSDEEP

3072:MEsmiEsmiEsmiEsmiEsmiEsmiEsmiEsmiEsml+W2YL:MZ/Z/Z/Z/Z/Z/Z/Z/Z4+W2YL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	144dec8962a519049a8e860040ff8c83.exe

Executes dropped EXE 1 IoCs

pid	Process
2088	exc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\gpupdate.exe	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\InputSwitchToastHandler.exe	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\authfwcfg.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\CoreMessaging.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\ddodiag.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\easwrt.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\fdeploy.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\@WirelessDisplayToast.png	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\KBDINMAL.DLL	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\KBDSMSFI.DLL	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\KerbClientShared.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\aadauthhelper.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\ActivationClient.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\AppIdPolicyEngineApi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\KBDOLDIT.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\LicenseManagerApi.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\CredProv2faHelper.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\dinput8.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\explorer.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\KBDIT.DLL	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\KBDNE.DLL	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\KBDTAILE.DLL	exc.exe
File created	C:\WINDOWS\SysWOW64\mfmjpegdec.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\AcWinRT.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\AdmTmpl.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\IdCtrls.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\ir32_32.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\ir41_32.ax	exc.exe
File created	C:\WINDOWS\SysWOW64\ivfsrc.ax	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\Magnify.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\AppResolver.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\certutil.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\cttune.exe	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\dot3gpui.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\gmsaclient.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\KBDDA.DLL	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\aadauthhelper.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\certenc.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\dbnetlib.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\eventvwr.msc	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\iertutil.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\kbdnecnt.DLL	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\KBDUSX.DLL	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\KeyboardFilterCore.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\AppVSentinel.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\d2d1.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\ddraw.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\dwmapi.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\DWWIN.EXE	exc.exe
File created	C:\WINDOWS\SysWOW64\chs_singlechar_pinyin.dat	exc.exe
File created	C:\WINDOWS\SysWOW64\gamingtcui.dll	exc.exe
File created	C:\WINDOWS\SysWOW64\iernonce.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\KBDKNI.DLL	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\autofmt.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\cdosys.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\dot3msm.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\dpnhpast.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\hdwwiz.exe	exc.exe
File created	C:\WINDOWS\SysWOW64\iprtprio.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\ir41_qcx.dll	144dec8962a519049a8e860040ff8c83.exe
File opened for modification	C:\WINDOWS\SysWOW64\atl110.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\SysWOW64\bitsadmin.exe	144dec8962a519049a8e860040ff8c83.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysmonDrv.sys	144dec8962a519049a8e860040ff8c83.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	144dec8962a519049a8e860040ff8c83.exe
File opened for modification	C:\WINDOWS\SysmonDrv.sys	exc.exe
File created	C:\WINDOWS\HelpPane.exe	exc.exe
File created	C:\WINDOWS\hh.exe	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\mib.bin	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\splwow64.exe	exc.exe
File created	C:\WINDOWS\winhlp32.exe	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\hh.exe	exc.exe
File created	C:\WINDOWS\notepad.exe	exc.exe
File opened for modification	C:\WINDOWS\setupact.log	exc.exe
File opened for modification	C:\WINDOWS\Professional.xml	144dec8962a519049a8e860040ff8c83.exe
File opened for modification	C:\WINDOWS\system.ini	exc.exe
File created	C:\WINDOWS\sysmon.exe	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\write.exe	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\sysmon.exe	exc.exe
File created	C:\WINDOWS\write.exe	exc.exe
File created	C:\WINDOWS\bfsvc.exe	exc.exe
File opened for modification	C:\WINDOWS\setupact.log	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\splwow64.exe	144dec8962a519049a8e860040ff8c83.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	exc.exe
File created	C:\WINDOWS\explorer.exe	exc.exe
File opened for modification	C:\WINDOWS\Professional.xml	exc.exe
File opened for modification	C:\WINDOWS\setuperr.log	144dec8962a519049a8e860040ff8c83.exe
File opened for modification	C:\WINDOWS\system.ini	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\twain_32.dll	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\twain_32.dll	exc.exe
File created	C:\WINDOWS\bfsvc.exe	144dec8962a519049a8e860040ff8c83.exe
File opened for modification	C:\WINDOWS\lsasetup.log	exc.exe
File opened for modification	C:\WINDOWS\PFRO.log	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\winhlp32.exe	exc.exe
File opened for modification	C:\WINDOWS\setuperr.log	exc.exe
File opened for modification	C:\WINDOWS\win.ini	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\WMSysPr9.prx	144dec8962a519049a8e860040ff8c83.exe
File opened for modification	C:\WINDOWS\WindowsUpdate.log	exc.exe
File created	C:\WINDOWS\WMSysPr9.prx	exc.exe
File created	C:\WINDOWS\explorer.exe	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\mib.bin	exc.exe
File created	C:\WINDOWS\notepad.exe	144dec8962a519049a8e860040ff8c83.exe
File opened for modification	C:\WINDOWS\PFRO.log	exc.exe
File opened for modification	C:\WINDOWS\win.ini	exc.exe
File opened for modification	C:\WINDOWS\DtcInstall.log	144dec8962a519049a8e860040ff8c83.exe
File created	C:\WINDOWS\HelpPane.exe	144dec8962a519049a8e860040ff8c83.exe
File opened for modification	C:\WINDOWS\lsasetup.log	144dec8962a519049a8e860040ff8c83.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2088	3312	144dec8962a519049a8e860040ff8c83.exe	89
PID 3312 wrote to memory of 2088	3312	144dec8962a519049a8e860040ff8c83.exe	89
PID 3312 wrote to memory of 2088	3312	144dec8962a519049a8e860040ff8c83.exe	89

C:\Users\Admin\AppData\Local\Temp\144dec8962a519049a8e860040ff8c83.exe
"C:\Users\Admin\AppData\Local\Temp\144dec8962a519049a8e860040ff8c83.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3312
- C:\exc.exe
  "C:\exc.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
    3⤵
    PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3376 /prefetch:8
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10188347635469723076,13372816883894090550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
    3⤵
    PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffd012746f8,0x7ffd01274708,0x7ffd01274718
      4⤵
      PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.freeav.com/
  2⤵
  PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd012746f8,0x7ffd01274708,0x7ffd01274718
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,8562286567700851697,11742370005484646379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,8562286567700851697,11742370005484646379,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.antispyware.com/
  2⤵
  PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd012746f8,0x7ffd01274708,0x7ffd01274718
1⤵
PID:1420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2272

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x494
1⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd012746f8,0x7ffd01274708,0x7ffd01274718
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SysWOW64\NOISE.DAT

Filesize
28KB

MD5
ee4a892cb8e0eda8eb636becdf5e967b

SHA1
7b32e56a044ab997bc46d4484fab63f263eb29f0

SHA256
5198b783d255d029ca0feb32498c95ddec2cf3a218fe1429b1ee8682636cae72

SHA512
833c08fad80328b7efa4f31104add1ada4e594f4b880a92b0374bbe35f51534db7c5d0fb39e078f76240b880403a7c15526f1e0e68293dab76261350474108e8

Download Submit
C:\WINDOWS\SysWOW64\PrintConfig.dll

Filesize
2.8MB

MD5
b0730daa541de16f93fefc5e8adbad73

SHA1
26f2382d8ac544cde472449b2215c1ee98640c0d

SHA256
39626c42a5414c18ef52d95259271bf799567a5991585bf10180b66f570707a9

SHA512
7aa3bd3a25faeb64d6bf8fe1bc863ea4ff743d1234aafc22fbb97b0a21c00fad42424ed0220d7a874f3e0aa1192816bf93da51640f96c95b270a240fac30dd7f

Download Submit
C:\WINDOWS\SysWOW64\msvcp140_2.dll

Filesize
191KB

MD5
967bfca32d25756bd64c255e08559e79

SHA1
a8ec12461d96a7c61e8998c2503d41f5d396a5db

SHA256
83e8790e63a72452b06891af5dd2cbba40232030810ca05d1e11a6a3c85be343

SHA512
9aeade46b7c99bc9463f4f78a12c2aca20cfa181d706296da033510a4a3dfa4d0f03e772af39936fb5e17393a62d8f4b3eebbb5ea2edff5797c675d94e4e3553

Download Submit
C:\WINDOWS\SysWOW64\msvcp140_atomic_wait.dll

Filesize
78KB

MD5
2d2c408f015c5e75d265a20b4915c100

SHA1
d88b30d90ee04c2c3e6b79771c5352397a1b1ec4

SHA256
c6680d9a3008c7f8b3d8cf9be472d4706b23c7f3f67191aa28089c8a98634bf8

SHA512
0a62400ac55934fc4cfe82f7cc437e32e6eefd4099c12ca4a3d1a5c4a9b57acad2d870044eda60bc70d3bc4b2dea70c9cd25591f9eec2e7aebf8b716fd628e29

Download Submit
C:\WINDOWS\SysWOW64\msvcp140_codecvt_ids.dll

Filesize
46KB

MD5
e27364354373cc88130289520e4c29b3

SHA1
adc3ab639e74d87c5a1af493806416aa1c6d51c8

SHA256
f8134e5c578667de646622ea7024db189ac1f7273444bf1b3d1fc9c783858c60

SHA512
ad10267f9260ee73ff71772d028d24b4d8b5d183ecc38e0dbeeb334758c38df1a09b4af291dd0e59ad96eb2fe1fbc2f5b2b831b872cc3658c89ab945a91d60dd

Download Submit
C:\WINDOWS\SysWOW64\msvcr120.dll

Filesize
975KB

MD5
5898112d3490c46bff90e47c7aa8fb80

SHA1
a778c6d0884f435a2319902b600e3845106e1dea

SHA256
b35b9f42d3b3a08a1636a8d0b342229461e057e6b8251745b11845a775ac1c0e

SHA512
d87c23a46fd3aa7fb7c7588bbc25959cd8d500133377ac4d4b71f366a3ddebe1f69c1e7dc92889a49da27d446fd09f7de730e7a9c136292a42a70b5b8e4207bd

Download Submit
C:\WINDOWS\SysWOW64\opencl.dll

Filesize
78KB

MD5
f7126e58cbedadc84581415920cc0e60

SHA1
458f6211e2ed726784a025bf4e3eb9df51184abe

SHA256
ef727a2fba02a4647b866f340816e81f1715ff90680b72d3bf5f46aaee1866c9

SHA512
7e3de316213f4f8efcd7fab311951b203fab8716b5e4b388f9b2b3f8923225a0e7eeec0fae73752ec7e2ec52158303e4baaccd3b9131d2aa350b99482de4ce89

Download Submit
C:\WINDOWS\SysWOW64\vccorlib110.dll

Filesize
274KB

MD5
0087a4528afeede84fbaf28fa03e89f6

SHA1
be5d7258e6141a50211a16f307e34ee0dc987ed1

SHA256
13779b71dcec2345ca10256b0e0736c4060eb24940886409b1614bde6efc453f

SHA512
da4830dec7c8f7740ebd2f6386461770022a00889f792245f3f69df68b551a7a52ac603fc4e8750c469f85a3e87ad8aff303a63a735dbf22c048767564138499

Download Submit
C:\WINDOWS\SysWOW64\vccorlib120.dll

Filesize
297KB

MD5
dac1086b6c503e626023fa3fe9a1b3b4

SHA1
9930d211eb758da9cf54497a8e561f4348b560b8

SHA256
69c2094e31724f276fdaefdcd0cec1d5b6d9c780ede2319de86d37b72d4d00bd

SHA512
a15e73459fda8809ee992f9a586c9eae3313fc152ee4256ea88de322cd583815fe541f71f2f9985cea1b147af4e5b513a1d1e91d18ad46955fb8da82d216c7de

Download Submit
C:\exc.exe

Filesize
222KB

MD5
fba61b7c47f97b091549880c3e7d568f

SHA1
da87428ab4a8641b11208cc8f38299fabae9e8e4

SHA256
e78bd6fcd1207cf88ba7de8b2dc3f38d742648e540e9fee8fbaf3e0357984a78

SHA512
ba479efdf739c2da46fc09c7d98cf3bfb30c4d662a720f354e48258abee1051a08159bb7273cc3b02be4c8433a84bde7f5ced427812783386ab501c0170528e4

Download Submit
memory/2088-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2088-273-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2088-1180-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2088-1680-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3312-8-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3312-272-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3312-543-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3312-1179-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3312-1679-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download