01be856a9d037fdab8d3ce0046daae65fecaa637af55bf6333518a6d9459d600

Analysis

max time kernel
162s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 5.0MB
Sample240109-qfhfvabbfj
SHA256 01be856a9d037fdab8d3ce0046daae65fecaa637af55bf6333518a6d9459d600
MD5 e06aa4511430b6785d9a3b64812d8d6e
SHA1 45984bb2e8e4559e31ffe5ec07d2dd4c43a5dae3
SHA512 43b7fbf145de51122df3de5cd3870e6150a55465016fc21beb977c45f30ddbf10cd5d8385ce93d3aa49da3d22700875098e19ecdf9f88cd7962502c8b3a39ffd
SSDEEP 98304:/IOYipKqQoif+HGxSSPoJVMwb8zjGKuGET3CMsNseuTJAOLvRvY:gzOMrAJVMwfPFT3XsNuTJAgY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3780	ru0hE54.exe
1180	cj7Lh45.exe
1288	uP1bb16.exe
3364	1Da65Ww5.exe
2200	2nI7132.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	uP1bb16.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ru0hE54.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	cj7Lh45.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000300000001e7f1-26.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2200	2nI7132.exe
2200	2nI7132.exe
2200	2nI7132.exe
2200	2nI7132.exe
2200	2nI7132.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5820	msedge.exe
5820	msedge.exe
5636	msedge.exe
5636	msedge.exe
5864	msedge.exe
5864	msedge.exe
5740	msedge.exe
5740	msedge.exe
5744	msedge.exe
5744	msedge.exe
5544	msedge.exe
5544	msedge.exe
5856	msedge.exe
5608	msedge.exe
5856	msedge.exe
5608	msedge.exe
5692	msedge.exe
5692	msedge.exe
5792	msedge.exe
5792	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe
3364	1Da65Ww5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	2nI7132.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 3780	2560	file.exe	94
PID 2560 wrote to memory of 3780	2560	file.exe	94
PID 2560 wrote to memory of 3780	2560	file.exe	94
PID 3780 wrote to memory of 1180	3780	ru0hE54.exe	96
PID 3780 wrote to memory of 1180	3780	ru0hE54.exe	96
PID 3780 wrote to memory of 1180	3780	ru0hE54.exe	96
PID 1180 wrote to memory of 1288	1180	cj7Lh45.exe	97
PID 1180 wrote to memory of 1288	1180	cj7Lh45.exe	97
PID 1180 wrote to memory of 1288	1180	cj7Lh45.exe	97
PID 1288 wrote to memory of 3364	1288	uP1bb16.exe	98
PID 1288 wrote to memory of 3364	1288	uP1bb16.exe	98
PID 1288 wrote to memory of 3364	1288	uP1bb16.exe	98
PID 3364 wrote to memory of 3560	3364	1Da65Ww5.exe	100
PID 3364 wrote to memory of 3560	3364	1Da65Ww5.exe	100
PID 3364 wrote to memory of 1276	3364	1Da65Ww5.exe	104
PID 3364 wrote to memory of 1276	3364	1Da65Ww5.exe	104
PID 3364 wrote to memory of 1736	3364	1Da65Ww5.exe	105
PID 3364 wrote to memory of 1736	3364	1Da65Ww5.exe	105
PID 3364 wrote to memory of 5088	3364	1Da65Ww5.exe	106
PID 3364 wrote to memory of 5088	3364	1Da65Ww5.exe	106
PID 3364 wrote to memory of 4948	3364	1Da65Ww5.exe	107
PID 3364 wrote to memory of 4948	3364	1Da65Ww5.exe	107
PID 3364 wrote to memory of 4116	3364	1Da65Ww5.exe	108
PID 3364 wrote to memory of 4116	3364	1Da65Ww5.exe	108
PID 3364 wrote to memory of 2120	3364	1Da65Ww5.exe	109
PID 3364 wrote to memory of 2120	3364	1Da65Ww5.exe	109
PID 3364 wrote to memory of 2516	3364	1Da65Ww5.exe	110
PID 3364 wrote to memory of 2516	3364	1Da65Ww5.exe	110
PID 3364 wrote to memory of 2980	3364	1Da65Ww5.exe	111
PID 3364 wrote to memory of 2980	3364	1Da65Ww5.exe	111
PID 3364 wrote to memory of 2736	3364	1Da65Ww5.exe	112
PID 3364 wrote to memory of 2736	3364	1Da65Ww5.exe	112
PID 2736 wrote to memory of 952	2736	msedge.exe	118
PID 2736 wrote to memory of 952	2736	msedge.exe	118
PID 2980 wrote to memory of 4976	2980	msedge.exe	116
PID 2980 wrote to memory of 4976	2980	msedge.exe	116
PID 3560 wrote to memory of 1244	3560	msedge.exe	123
PID 3560 wrote to memory of 1244	3560	msedge.exe	123
PID 4116 wrote to memory of 3244	4116	msedge.exe	115
PID 4116 wrote to memory of 3244	4116	msedge.exe	115
PID 1276 wrote to memory of 1160	1276	msedge.exe	122
PID 1276 wrote to memory of 1160	1276	msedge.exe	122
PID 4948 wrote to memory of 2688	4948	msedge.exe	121
PID 4948 wrote to memory of 2688	4948	msedge.exe	121
PID 5088 wrote to memory of 564	5088	msedge.exe	120
PID 5088 wrote to memory of 564	5088	msedge.exe	120
PID 2120 wrote to memory of 3100	2120	msedge.exe	119
PID 2120 wrote to memory of 3100	2120	msedge.exe	119
PID 2516 wrote to memory of 1212	2516	msedge.exe	117
PID 2516 wrote to memory of 1212	2516	msedge.exe	117
PID 1736 wrote to memory of 924	1736	msedge.exe	124
PID 1736 wrote to memory of 924	1736	msedge.exe	124
PID 1288 wrote to memory of 2200	1288	uP1bb16.exe	125
PID 1288 wrote to memory of 2200	1288	uP1bb16.exe	125
PID 1288 wrote to memory of 2200	1288	uP1bb16.exe	125
PID 3560 wrote to memory of 5800	3560	msedge.exe	128
PID 3560 wrote to memory of 5800	3560	msedge.exe	128
PID 3560 wrote to memory of 5800	3560	msedge.exe	128
PID 3560 wrote to memory of 5800	3560	msedge.exe	128
PID 3560 wrote to memory of 5800	3560	msedge.exe	128
PID 3560 wrote to memory of 5800	3560	msedge.exe	128
PID 3560 wrote to memory of 5800	3560	msedge.exe	128
PID 3560 wrote to memory of 5800	3560	msedge.exe	128
PID 3560 wrote to memory of 5800	3560	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ru0hE54.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ru0hE54.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cj7Lh45.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cj7Lh45.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uP1bb16.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uP1bb16.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Da65Ww5.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Da65Ww5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffb69fb46f8,0x7ffb69fb4708,0x7ffb69fb4718
        7⤵
        
        PID:1244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
        7⤵
        
        PID:5800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
        7⤵
        
        PID:6108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
        7⤵
        
        PID:6564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
        7⤵
        
        PID:6556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
        7⤵
        
        PID:6600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4384 /prefetch:1
        7⤵
        
        PID:6628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
        7⤵
        
        PID:6148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
        7⤵
        
        PID:6464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
        7⤵
        
        PID:6708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
        7⤵
        
        PID:6160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
        7⤵
        
        PID:6216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
        7⤵
        
        PID:6180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
        7⤵
        
        PID:6696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
        7⤵
        
        PID:2328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8917330744518222537,7700903489044692923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
        7⤵
        
        PID:4200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb69fb46f8,0x7ffb69fb4708,0x7ffb69fb4718
        7⤵
        
        PID:1160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,12121437767150218663,6202929276288278685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12121437767150218663,6202929276288278685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
        7⤵
        
        PID:5700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb69fb46f8,0x7ffb69fb4708,0x7ffb69fb4718
        7⤵
        
        PID:924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17969770728100788303,10636192044731119129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17969770728100788303,10636192044731119129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        7⤵
        
        PID:5548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb69fb46f8,0x7ffb69fb4708,0x7ffb69fb4718
        7⤵
        
        PID:564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6172099709321772059,7838035825334954488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6172099709321772059,7838035825334954488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        7⤵
        
        PID:5600
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb69fb46f8,0x7ffb69fb4708,0x7ffb69fb4718
        7⤵
        
        PID:2688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,4569063834442877862,16092957530130201473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4569063834442877862,16092957530130201473,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        7⤵
        
        PID:5712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb69fb46f8,0x7ffb69fb4708,0x7ffb69fb4718
        7⤵
        
        PID:3244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14170615960416424348,13044997001232810689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14170615960416424348,13044997001232810689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        7⤵
        
        PID:5640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffb69fb46f8,0x7ffb69fb4708,0x7ffb69fb4718
        7⤵
        
        PID:3100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,8739560915601520300,5552149279725404949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,8739560915601520300,5552149279725404949,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        7⤵
        
        PID:5596
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb69fb46f8,0x7ffb69fb4708,0x7ffb69fb4718
        7⤵
        
        PID:1212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,11025695971724905947,13799637972851566050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,11025695971724905947,13799637972851566050,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
        7⤵
        
        PID:4020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb69fb46f8,0x7ffb69fb4708,0x7ffb69fb4718
        7⤵
        
        PID:4976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9400860974279147514,16950461514499147666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9400860974279147514,16950461514499147666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        7⤵
        
        PID:5940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://instagram.com/accounts/login
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x78,0x16c,0x7ffb69fb46f8,0x7ffb69fb4708,0x7ffb69fb4718
        7⤵
        
        PID:952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,15862098727471494463,6143877404694430625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15862098727471494463,6143877404694430625,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        7⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2nI7132.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2nI7132.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1622cdbb-2286-46e1-b175-aab31c6b269c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1622cdbb-2286-46e1-b175-aab31c6b269c.tmp
Size 2KB
SHA256 5dc31b6bd7a39f0a7b8907e990afae91c812d1851e24f6718f929de9b667ad48
MD5 39cc62005e162083c247178d4b50ca90
SHA1 2bef8e7c3834d5c1a2ac7af14ee05c2d69b3c5dd
SHA512 b8dd2ea3b318f978d4575ea99369144df8b0dae3df6a3b9cdb1a070f3fd5f5bcfe46db4b73cf01c48de3ce0793c8ef9433b9a671111566237c0cd55cfb92bba9
MD5 SHA1 SHA512

Submit Download

9be48fa4-4f50-4cc9-b7f8-be6892e95063.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9be48fa4-4f50-4cc9-b7f8-be6892e95063.tmp
Size 2KB
SHA256 31117d92613d9ffb9862cca68a7b781f2949f25a125757ca3e2d3f6e06825aee
MD5 8c0e2ced72bf38878dd338c8361cbb39
SHA1 ee8acca2a8906f02056ef5e354d3e87e493ecdad
SHA512 c3b3015220de5e8a31b3a70280807091a14b81b4d78708dd818fb6b19fac33e785c0017cd599bd4fe668db90a94f6ed533cfd880ca924cce8644f5b35a0dfb2c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45
MD5 b810b01c5f47e2b44bbdd46d6b9571de
SHA1 8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc
SHA512 6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
MD5 efc9c7501d0a6db520763baad1e05ce8
SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b0c9be9bc8e9124d0d1e09bc10fa434cd93adc4256d4a7fc1b1398946161cc8f
MD5 dd34ec95c46fb522109f13622c9f9f26
SHA1 b31a25139e87efec0725c527ecbc1a898333d8cd
SHA512 dfdcab79741fe2ab89817b7cb0745a40bfcf74c97cc9b22126736496d42c4d9650c57ba7c0f604fcb0c3bb27f24c79a4f7426d99462d8ac7a029969561ea3aa9
SSDEEP 192:nVzk+jX7TlpanotWM7Tumb1uvgqpUsdrV:nVzzjX7lWw/b0GI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
MD5 121510c1483c9de9fdb590c20526ec0a
SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81
SSDEEP 768:nrCWQ08F1+UoAYDCx9Tuqh0VfUC9xbog/OVSLllmrUBd:nrCWQ0u1jaXLVn
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 50d0ecebc6280e607e1e7d9c4389c9c68625b7a82c7adb7a1d81035114e3df64
MD5 29e53d71f97ec80e6b348c2dec50bd22
SHA1 eab5b4397f286a32be5c4a02561f4d8d680663a7
SHA512 fd212942251ae569a3c3ae85e50694bd994ce855675d304bae0b07bc61b267c19d6ef0e835b13ca3376f7a46b8e6ede5096d51248c14d56b5f0649ba58f9bf93
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5a5351.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a5351.TMP
Size 89B
SHA256 c2c691348060a84715cb9e0f5d4ae5e483db481c289d3467d722902493d037f5
MD5 ace7a5a1be096fbfb5c7d1c80eb85639
SHA1 fb8989a1c4053c5a21f584e95a23137655629806
SHA512 ffe80b7d6ac34ae55ca3d935e65c2d854a7cd7c3b7c1cbd61c13081f157c5ea661fc312485025a72cb90190d340fad3cb484057759b38e236c4eba994b70f473
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 21a36dd8983f73cdc627e50d4c3ecce329ebd7d830f5bd92b92307a541eaad60
MD5 8542034503d9fe41fa09ccf908b6b0a3
SHA1 2114c0c460753ff00884405adf7bd87bedcef828
SHA512 7b15537d6fe3d587fc23beb60a43fa89bdc5c25a1367535c0ab26eed8fa4ff80af3864378d34acdd7a78f2fdc0dffb205883a06fbe4c28fba339da77eb35c5ad
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5a3402.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a3402.TMP
Size 1KB
SHA256 63c3bc7b707491a79c618ce0c96c834c3878d5b97d48808f63bcdabf2e060614
MD5 d5d05eeadc7efc7e0583ac2d632acaba
SHA1 22bb6b72e10703a1f1cff20f74d6fc91b7416afc
SHA512 94c48d57baf5630bb73182a805ae6fd25f1bb24b819617c150e2142daf799cfa833b1486f9a61e788a0e4daaee1c420ca70cf1a0bd31236d55a73a10fefe96ac
MD5 SHA1 SHA512

Submit Download

fea57ad1-62ae-41ff-9f30-0b6ca733d1d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fea57ad1-62ae-41ff-9f30-0b6ca733d1d8.tmp
Size 5KB
SHA256 ebab02349009d0dd9ef32db25085c0d0af0eb37339b1984acfe4f843451de161
MD5 2096022e403f36d75e333da9874aa4c5
SHA1 fe3b62f46a7a47c56d09b78b140f14409324263c
SHA512 0630ff4732d6a8a53abffcbe99c92aa8d0b3c8ad7ecf2e789ec8d975879be42a9caf1105c1d59562f5a400c059f8288c9a7d6bb49d6d7db3f2757e18d4c0a930
SSDEEP 96:nVZkflj197TlwpvWMoiVmdeHcWuUsvlUWQyV+VDCzia:nVZk9jX7TlGWMXqUsdrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 d2a41497c7bb761558a4ccf09fcec9b907aa0e14b3cbf10dfd4bfe9c9c2c283e
MD5 550f467f6658fbe921903daed423f78b
SHA1 0121bb2651cb22dd497a16f332bac6b10ed94a46
SHA512 9e4972c2310e0c26d6b0d339837f9ba488ae79e35124825fcaa9472671c000a5875d967083dfff1c8ba631dff8341c76f5a5bff4b9c98ce286ed61cb66b7921f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 cf55983bf70cb593ea6061e5a34a13341e1821ed5fb447d4ad71c87b7a7f7169
MD5 81920a3da8c74b397308efe9f1785d52
SHA1 6cd2eead2404843d507effb84ce4511a2acfa22c
SHA512 57cfb7ae2e18a6092a437c2e86002213765fe96e286a5159dbeac8009d9643a7bd6eb5612400fd6b5ee6dcb7b4da7ee7a8f6a28842b73fb36dc0788b1a0b18ad
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 20b470bd4b8b2d1d8fb9293723c63ee7c9647663dcc19dfcb9c5bed1bf1770b4
MD5 68a73388bf9af9c6ce74664506652b33
SHA1 83cb4d007de74a04f928694686d99584d15a7a63
SHA512 f8858457847bb7180af57cc78cc427c144e425f12db2d44b5010cd3c81cdabd16d409b28937d06bffee25c8b2dfe436e97724a361a7b3833d698044b366e1d34
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 336c43f0048444ab1508a9631d7bf601d613c7652ff18c66233ee7f820ad7620
MD5 409b5755bfca733ff692a23c85060f87
SHA1 fb06eab9c1094a814263c583c545699fa73a3e8d
SHA512 954259ee5bdc6e451f1273f4c3b9b925a368304e7d76affd54d5a65f648d84939f0544ccac8751294b77d18f507971bdd625748b2f03f08a3fe80f9cf8febe08
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 b6e96b29ab5fb241fabe6fce99bbc4c168288d0a009e490ba8b215718a16957f
MD5 be73599c9826bc9c58fdfb775c757ab6
SHA1 fca1a9bec3e7ef80ade0fa0f4ca1cb8413c45a79
SHA512 a949da70052b0fa2a628a3a231b554b09fe0c5da15d9105214b80d75dde7bbb843bb4727fc4f479f1afb3ffdde9bada90f8fa1565c73eb450f178cd8a483d1e2
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8bcbbcb5aa9a3cc36756ac6a7416bb0fe3ee55319fbfb4b5f3dbd8e09de08b50
MD5 6a170d67313e97c9fe72f76c682de3b2
SHA1 6e8c60f38422e076d915b414472168006364e28b
SHA512 bd45e00173dea944f789599d0e9e0a92c85338fc5150304ef2085e34cbfb955dae4682918bdf78cf739a094043ea5576f49e4a14334ad35b1e47dd3db90b76f8
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7tzde2RUvRjHtBXKrr1:N9iIxuERzA83h09RZxY7PoNtZcr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 322cade8c88cc73e60a3e6934140835da7a56ecf3513b1905cb0ef13edd71855
MD5 5c04ff5f0107c966e8f38a9365add447
SHA1 32c4b59a8c421f605a1c8eba42b9fc8b0627d048
SHA512 42845acf8615416bc378a5916692b37854dba5de79583ac202b4f7f06421ecb99a8625e44ed6aa36c1037a83cd5f695c8c33932596edf47e4e5711a5a2cf53bb
SSDEEP 192:7oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7tzde2RUvRjHTBXKrr1:r9iIxuERzA83h09RZxY7PoNTZcr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 a3c988e82fb5fbc49b37165b2a6dafcb7dd77d56acd86b3ad0c94bb22a84529f
MD5 09812045db780c84d83759fe99b940cb
SHA1 6a456465d7af5da6f4aede175706978fede991a4
SHA512 81844e5e112d7fb83c06926d71d602ed96067219ccd9da65a627a81083ab862abbf53f13804ed46cfc344aa70191a0064d9ea0d2129ea88f649029fbe01ebdfb
MD5 SHA1 SHA512

Submit Download

da0a5e6e-08b0-45c0-8d6e-7e1fa926e0dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da0a5e6e-08b0-45c0-8d6e-7e1fa926e0dd.tmp
Size 2KB
SHA256 401e07d0fa24fd24b0ef5f28a412666a62c3510f16e68a1bc87283e6e66beb16
MD5 6be0840c9b8633090ae0d0412e6b17a2
SHA1 de4dc63e233e1a1a051b6c5bf7c244ddb59e9052
SHA512 c32f675ace1c84258d1fbc88b6232eea925aecb9956d544549956b5c61b3608d37a37010c5ffe10d96637f536401dacffa19728d749dbb59fc78e350e76bfbe3
MD5 SHA1 SHA512

Submit Download

ru0hE54.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ru0hE54.exe
Size 4.3MB
SHA256 4f7ea472abe40f0fb2a385bd5d49ee6ddbe50344b35e02d9cf9f94e217699b50
MD5 646bd840eb5454d302760a9384ab96d9
SHA1 26cbf240d05dff9f731bcd9a933d59c862cde11f
SHA512 5320db76026768c1a568990a2538b72a020fb0699d4379fd4ac3c63b90e97acc9b46611e2a1ff42ca6f0b242b17789f218df51578ea12a5ede79c34cbb938230
SSDEEP 98304:Sp9OiiHKIwj/sj/sBx8pEAV1hNc5E3oQXEwo3rs/zhK7Aa:UpEKyCAV1hjD0wo7s7hK7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

cj7Lh45.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cj7Lh45.exe
Size 2.9MB
SHA256 965491c409bee7accaf2ea7fb5217e2e1bbe1a8b228bbcfbed939321cf04b008
MD5 6e1f396813f2ad1da909001207e39f6a
SHA1 74b175f255efa0cc40cf3eac23d55baaf5948d30
SHA512 13e33559c0d31200b999aff35201448e1d08b663005d5692e2bd387b1bd11fb2c113ce417c8d5ff444af7a1f2c9bbd869af30aee2ddda78c9c3f8ff2f98a9054
SSDEEP 49152:XNT5z89u5BvKffgn8YvhoTgP6K3VJ66pD8hQ0vdvH3O/HuXczuDecQZEYya:91o9uvKQfhoTI6K3VJ0h1VvXO/HgcCDO
MD5 SHA1 SHA512 SSDEEP

Submit Download

uP1bb16.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uP1bb16.exe
Size 1.1MB
SHA256 bb85bfd92d1ae5066f270743a94d3f5eff50427e68c5347d7b7f9e0e78c33ce6
MD5 e5625e326be00df4a511ac58903456ab
SHA1 37a9c643700dc5e62259242aad6f111f9a46e8e0
SHA512 97db6a75b12131e2ebf9d1a837d07f0edb72411947ef7922cf9b2063a630f4f0aee227ccd723c649a39abfdabbf6c9d575b7eaefbbf802f84e8bf47b96cb31ab
SSDEEP 24576:tyPFe3cuHxiNvKGXodNhHBWBhS2DAFFCszdwfB08o7dD:IPFzuH+vKGYNhHBWBGCso3U
MD5 SHA1 SHA512 SSDEEP

Submit Download

1Da65Ww5.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Da65Ww5.exe
Size 895KB
SHA256 3c031f6abe71fb2118d69f6e5f9552979a42f5be0850b7d3d37d3f7f93bff7a4
MD5 06cc275eadb20f213044a5aa1ab172f8
SHA1 43d0c01dc33b56ddc7e116751a7416da7af59810
SHA512 d94e5e7db6ec874c1048502b219f317d0f1287b8b0d60b23d7316b5b26f18a66a56b975a5d1075819ad66cfbdf24337d7e4937f83a643e7c692417225c98122b
SSDEEP 24576:gqDEvCTbMWu7rQYlBQcBiT6rprG8aF9t:gTvC/MTQYxsWR7aF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

2nI7132.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2nI7132.exe
Size 603KB
SHA256 a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5
MD5 09ad33bc3340bb460945f52fc64d8104
SHA1 8961fb7b80dd09fb1f7936e1a488340076d241b3
SHA512 2c39399642bd76f6912a57b7ab743752bb678eb8a85e8f53499403818984c3c750e4dedeb13ea179076211a351a74f5f3656003b928cdcbf2917f4fe0a1079b7
SSDEEP 12288:go7YNQjDzdYD/jGW/nSCpSzdANFXNpby4d8u1e5MTVs:xwQnRHW/nSC0zdAp8D
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2200-31-0x0000000000800000-0x0000000000BA0000-memory.dmp

Download

memory/2200-387-0x0000000000800000-0x0000000000BA0000-memory.dmp

Download

memory/2200-552-0x0000000000800000-0x0000000000BA0000-memory.dmp

Download

memory/2200-553-0x0000000000800000-0x0000000000BA0000-memory.dmp

Download