837409c21abc5dbebc42c35bb852d15d7543865c361b88590a3c1b54040c59ad

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2024, 06:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boinkwx.exe
Size 2.4MB
Sample240116-gw2d8afdd9
SHA256 837409c21abc5dbebc42c35bb852d15d7543865c361b88590a3c1b54040c59ad
MD5 a2c2004e83c623b892ab19e3b817441e
SHA1 4094a5f879348cb0dbba1137d6da346fd61e0b9a
SHA512 5fba40b14ad405368957cf290a6e3d005f4a7a7ebad4a36989b1592386290fde3ce7d3b560ef6257673cfbdc2d3d52cf51aad36a9062bfaedf385070e7a3b962
SSDEEP 49152:TKJ1xi/XyLgvUEI77QUsvhu+2b+UeKdNGMIF5D8mFyJQU3keHJmeGkvf:svi/Xycm7MUsB9KeMIF5f4N3keHJi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	2jw2693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	2jw2693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	2jw2693.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	2jw2693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	2jw2693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	2jw2693.exe

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x000600000002320d-37.dat	net_reactor
behavioral2/memory/860-46-0x00000000009E0000-0x00000000009F6000-memory.dmp	net_reactor

Executes dropped EXE 4 IoCs

pid	Process
552	mg0Cr67.exe
824	msedge.exe
860	2jw2693.exe
7324	4QU302EM.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	2jw2693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	2jw2693.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	boinkwx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	mg0Cr67.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000002320c-13.dat	autoit_exe
behavioral2/files/0x000700000002320c-12.dat	autoit_exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133498590209368667"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3803511929-1339359695-2191195476-1000\{D01D3D49-0952-4DC5-A667-22E5A2895ED5}	chrome.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
4608	msedge.exe
4608	msedge.exe
2016	msedge.exe
2016	msedge.exe
5392	msedge.exe
5392	msedge.exe
1392	chrome.exe
1392	chrome.exe
860	2jw2693.exe
860	2jw2693.exe
860	2jw2693.exe
7864	msedge.exe
7864	msedge.exe
7864	msedge.exe
7864	msedge.exe
8188	chrome.exe
8188	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
1392	chrome.exe
1392	chrome.exe
2016	msedge.exe
1392	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	2jw2693.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe
Token: SeCreatePagefilePrivilege	1392	chrome.exe
Token: SeShutdownPrivilege	1392	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2764	firefox.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2764	firefox.exe
2764	firefox.exe
2764	firefox.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2764	firefox.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2764	firefox.exe
2764	firefox.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2764	firefox.exe
7324	4QU302EM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 552	4976	boinkwx.exe	88
PID 4976 wrote to memory of 552	4976	boinkwx.exe	88
PID 4976 wrote to memory of 552	4976	boinkwx.exe	88
PID 552 wrote to memory of 824	552	mg0Cr67.exe	129
PID 552 wrote to memory of 824	552	mg0Cr67.exe	129
PID 552 wrote to memory of 824	552	mg0Cr67.exe	129
PID 824 wrote to memory of 2020	824	msedge.exe	93
PID 824 wrote to memory of 2020	824	msedge.exe	93
PID 824 wrote to memory of 2016	824	msedge.exe	133
PID 824 wrote to memory of 2016	824	msedge.exe	133
PID 2020 wrote to memory of 720	2020	msedge.exe	95
PID 2020 wrote to memory of 720	2020	msedge.exe	95
PID 2016 wrote to memory of 5008	2016	msedge.exe	96
PID 2016 wrote to memory of 5008	2016	msedge.exe	96
PID 824 wrote to memory of 4772	824	msedge.exe	132
PID 824 wrote to memory of 4772	824	msedge.exe	132
PID 4772 wrote to memory of 3532	4772	msedge.exe	97
PID 4772 wrote to memory of 3532	4772	msedge.exe	97
PID 824 wrote to memory of 4240	824	msedge.exe	130
PID 824 wrote to memory of 4240	824	msedge.exe	130
PID 4240 wrote to memory of 432	4240	msedge.exe	100
PID 4240 wrote to memory of 432	4240	msedge.exe	100
PID 824 wrote to memory of 1392	824	msedge.exe	98
PID 824 wrote to memory of 1392	824	msedge.exe	98
PID 824 wrote to memory of 1480	824	msedge.exe	99
PID 824 wrote to memory of 1480	824	msedge.exe	99
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1480 wrote to memory of 2764	1480	firefox.exe	104
PID 1392 wrote to memory of 2540	1392	chrome.exe	102
PID 1392 wrote to memory of 2540	1392	chrome.exe	102
PID 552 wrote to memory of 860	552	mg0Cr67.exe	101
PID 552 wrote to memory of 860	552	mg0Cr67.exe	101
PID 552 wrote to memory of 860	552	mg0Cr67.exe	101
PID 2764 wrote to memory of 4504	2764	firefox.exe	103
PID 2764 wrote to memory of 4504	2764	firefox.exe	103
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106
PID 2016 wrote to memory of 3816	2016	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\boinkwx.exe
"C:\Users\Admin\AppData\Local\Temp\boinkwx.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mg0Cr67.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mg0Cr67.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1An07CM0.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1An07CM0.exe
    3⤵
    PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffdf7b946f8,0x7ffdf7b94708,0x7ffdf7b94718
        5⤵
        
        PID:720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,12093348290825899939,15201932888745699300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,12093348290825899939,15201932888745699300,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        5⤵
        
        PID:804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffdf78b9758,0x7ffdf78b9768,0x7ffdf78b9778
        5⤵
        
        PID:2540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:2
        5⤵
        
        PID:6516
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:1
        5⤵
        
        PID:6620
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:1
        5⤵
        
        PID:6612
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2128 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:8
        5⤵
        
        PID:6548
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:8
        5⤵
        
        PID:6528
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4644 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:1
        5⤵
        
        PID:7380
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:7444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4668 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:8
        5⤵
        
        PID:7436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:8
        5⤵
        
        PID:7676
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:8
        5⤵
        
        PID:7720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5240 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:8
        5⤵
        
        PID:5820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5440 --field-trial-handle=1724,i,13466094803035588681,12146041834019704704,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:8188
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2764
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.1.2031842409\4095356" -parentBuildID 20221007134813 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {580f8ecb-3bf5-4f5c-9b0a-722a9f2aeb30} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 2436 201579e2b58 socket
        6⤵
        
        PID:5432
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.2.1139000966\826873960" -childID 1 -isForBrowser -prefsHandle 3592 -prefMapHandle 3572 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5235d4e-9242-48a3-9979-1ede78b2b729} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 3628 20166bc3358 tab
        6⤵
        
        PID:5968
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.3.727696046\514407264" -childID 2 -isForBrowser -prefsHandle 3540 -prefMapHandle 3604 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59442b8d-a831-42a0-b973-4426e252ad96} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 3528 20166cc7558 tab
        6⤵
        
        PID:6148
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.5.738891362\1824722080" -childID 4 -isForBrowser -prefsHandle 3944 -prefMapHandle 3952 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb25c591-2793-491f-9fdf-f15ec6fa1b22} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 3936 20166cc7b58 tab
        6⤵
        
        PID:6512
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.4.1795669206\127868059" -childID 3 -isForBrowser -prefsHandle 2928 -prefMapHandle 3108 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9361c0f-3841-4f45-90f9-3f148051c483} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 3328 20166cc6f58 tab
        6⤵
        
        PID:6284
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2jw2693.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2jw2693.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4QU302EM.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4QU302EM.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:7324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffdf7b946f8,0x7ffdf7b94708,0x7ffdf7b94718
1⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffdf7b946f8,0x7ffdf7b94708,0x7ffdf7b94718
1⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffdf7b946f8,0x7ffdf7b94708,0x7ffdf7b94718
1⤵
PID:432

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.0.1749147442\1645059661" -parentBuildID 20221007134813 -prefsHandle 1804 -prefMapHandle 1796 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ff8dfd2-4f6f-4f9a-83d8-a63bee3d8bef} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 2000 20162dd6458 gpu
1⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
1⤵
PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
1⤵
PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,6522724762035777936,1217916661635805371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
1⤵
PID:5136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,16828843790750946630,2229605485622796570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
1⤵
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
1⤵
PID:6224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
1⤵
PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
1⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,6522724762035777936,1217916661635805371,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
1⤵
PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
1⤵
PID:6628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3568 /prefetch:8
    3⤵
    PID:7936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,2921512122229233522,10770181529044421915,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7864

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:7016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 cebfb881cb5beee5fc5be8e435b6a72535f77cb9f42a83e16ac457b92245689a
MD5 43aa148fb2433de7c69005b05e57f516
SHA1 816f3c23d266faf27a94362071adc9f537997ece
SHA512 574985a4aa8873de788795882c470a089a3df4893fe4ef482aea538846b9b3e0a78281a5db37f845b5473a3d5accfe963ed786d3567ab00b08d9cae6d3b3046e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f25f0d5c43079aeac387299830817bbf939b4b8f483bb6f0dbcd67b93724acf0
MD5 0c5bca2e0288e506abbc212d037606d5
SHA1 2f1cb70702b3fd9736a98ddbb92e2cd7996c3fd6
SHA512 d20cd5abe9aee0bd4feea9fc3e54abc78a347dce4c82e561b6a2f6efe1dcc197721584669dae7fbe560d19e85387db212b1e01bf64d11d35d1bbf5eb4e049df8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 59bdfd94700e234aa1b4cf05b9522dae28174ad511389a678ab059abe81f319a
MD5 22ce0241d508f5a8c13cf7a46cb38cf7
SHA1 3740e6574933e40fdbf4079192d06c85b882fd08
SHA512 09cfc6dc5306a096dba9b4c2110cbcdd8e6cc83d8bbc4cc6171c985532f9bc7947c9fc41f1480297eb46da91e6eb8bd88ba22ec91e70f6c79f859ca493f9b5dd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 772678a8cd6c266b9ff5202dae820758add0c070e47bf87681a8a603d45fed18
MD5 6a9fa6d4e66587f086b5b526fdd000ab
SHA1 b162a2a2f66bc2938ba54244d1e0c80d9a086717
SHA512 d4e1fac792cef4d6f6f5491d2dee95cf2de6d39c96c17f9337393449c5e322c45647f5abc548ae7d7d6d68ac6079266b3ac37c966fa9bf8f21a343c945ea9ded
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 80d72a7c4abb0b38d28db2675a2f181c41756aa4d2fdb3c3829d872d8954c492
MD5 75825a5594539c381b80440e0ed95082
SHA1 80ce65241dba5a51fd37a025d334d5900964d199
SHA512 1c2dc242b738e392029a3f150acdaa4b774041694237668f33fd47ec7cd3c9b60f961dd33872c143d12fa0956e393dc009169c813d014060bcc1307a81b8a8be
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 632eb14d5c45a3253c48128721ac34706d2a17d26b7f3e3c0c0372367421a6b5
MD5 44c87629d3c3bb5942088015ba583487
SHA1 5fc23d4f5dc15ce2373c8fe817d7e9ca5d60f6c8
SHA512 24debdf7cab19da4bcf70f781068892604106287d578b37a946b280db6a22657c6bfdbe71e3be6f97d1b9ee267c155ebd3425dd7003d49acd8f2c1c8889ca0f8
SSDEEP 192:kJeppsblZth8F+yy+FkkdRjotjEsXtScPS:kJbjt7yx7OtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 084ad384787d483d35d72b7299984ee978445a12cfd3ff1f69c67cbe0dc7f473
MD5 359b6511d6eae05a8e831f712275eff4
SHA1 01878ea7f2e9bb517f14eaadf0d2849d072ba61a
SHA512 b63bb21da03804731c5ceefcf7f36be8a2bd4847f48baede4682d09a8c56dddb426128a5cd3b1d3b94ec1043062d56c57deb7c14070677158a7a74445d682df2
SSDEEP 384:CZLPLeLXk1kXqKf/pUZNCgVLH2HfknrUDHGfX3Y1S9:YLPLsk1kXqKf/pUZNCgVLH2HfsrUjGPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 225KB
SHA256 edac5199274f482e84d3f9b51b5cbe73bb3c87d95c8cccf5649246e35fac3eed
MD5 4f833d0270fcc4654dc7ead60f3ade42
SHA1 104685f919695a2535922a786689052e3e1fbc30
SHA512 0e388a6e7cb8da71e3642a2a852998a8fafaf955549d2f354044dd15c1b2ad7a03c225f2ab27ef4b264a697e5cf90b3907ca8d4465e5cca4bdc320f3038b66ef
SSDEEP 6144:VZc2kXwS5y5pFf/HbJtQDGVG1fyE4+VqiQfgG:V22kgSk5LHdtQD6G1fyE4CWgG
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfaf6313fd293f6013f58fb6790fd38ca2f04931403267b7a6aef7bfa81d50bb
MD5 8a1d28b5eda8ec0917a7e1796d3aa193
SHA1 5604a535bf3e5492b9bf3ade78ca7d463a4bfdb2
SHA512 51b5bec82ff9ffb45fee5c9dd1d51559c351253489ea83a66e290459975d8ca899cde4f3bb5afbaa7a3f0b169f87a7514d8df88baaeec5bd72d190fd6d3e041b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
MD5 1386433ecc349475d39fb1e4f9e149a0
SHA1 f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA512 fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
MD5 SHA1 SHA512

Submit Download

7753b8a2-a95b-44e7-acc6-acdc6455cdf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7753b8a2-a95b-44e7-acc6-acdc6455cdf9.tmp
Size 5KB
SHA256 dd368dc2c8495b56ceba42d6001a8d10a29e493d19017b24f74d3f2de4480580
MD5 1175381153b574b205fb01059d6a117d
SHA1 26d096a7594350246c03f33e5a51fc383f96e322
SHA512 e12255fec8a51fb5a0036ee74f939d264067cedf29990316f3e1251dbdf71e15eea07eb50864423ace2c6bcc216731fb217f0e3fbdb10b38bc831ec82b57f8d4
SSDEEP 96:n6kiv1n/aO5wpvWMoiVmdeH8P8EyUWQyV+VDCiia:n6kk1t5GWMXe8Eyrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d24ebd0c962354db012f753f359fa9ddafaa408eba720bb2a7cc67cd452cc658
MD5 44931d799da6cf1ca97c542cd1427798
SHA1 f17ce5d6daa147674de328a57f634c888dd06d07
SHA512 774d42d35e016e25ae64e2a4c835e495e5dfbb643c23e2c9654b9e398bace6e6319ac0f17fb6683b6c06712284dfbfae9889817325f25cf28bf23237db057c06
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 7b768a21852e39d9e0c6dedf31914d38fbcac374544303644f621412a27f3fe8
MD5 88ebb29a2e7d2540a69dd19f861bdbb0
SHA1 c6d319e07ce1f17d1f6109791d9949f17574ae04
SHA512 ebaed1b7b4f7f82c4eb17522804458fa0496d1479731bde9d0e8f5e680ec5c890fd855c89dcb6dc085ac7e30a1da00b57f8bc747ccac883b3e5a075521134b59
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 cd8961dcb614a1d2e366cffdb8707411d637424df2bb5edf233b04f50a2f600e
MD5 4400c908a6c755a9135709bf815cc13f
SHA1 23261fa2546b8a1373de3e65513dfd3b5ebe0532
SHA512 8ad49688791e932ed4bd81a46762ba6730b2ceb5913f39bb82ba9b1096da6c87a941eb415bfaca3f0ce024be86890cf135c30136f3807cb6c154f060721e3b13
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4063e914ca7e15bf9df3932d5f48f721790b4aa2ce8eb2ee66e09eb23107a705
MD5 eece7bb18835c4b6f49f57c9e66a9e09
SHA1 3a5fd0726e8c27762595dd85aa7c1da6400f97bf
SHA512 5b6993dd763d9875fa6a55bb1b42f0b207d972dd7f57214ee5c128367a327ca2f78be5a4c98582306e402c4a285d8c8c6e8f486e97f2ad7ff89f16698719e463
SSDEEP 96:nMkNv1n/aO5wpUqLWMoiVmdegYdMkDuO1+SuZ162bQdP8zIyUWQyV+VDCAiEwb:nMkN1t5PqLWMwYdvuOnuZU2bQh8kyrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
MD5 e664066e3aa135f185ed1c194b9fa1f8
SHA1 358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA512 58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
SSDEEP 768:n/MWlx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvLlJorUlrIffY:n/MWlxu1jaaL7lrGY
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 bb43b20e2a8e88088251a1952d9021c2b14dfca6299bd8a6592ba149ae462dcc
MD5 723564847442b89fbf18b8e5f3d87bb2
SHA1 12e5ef5bf67549661c5f7ca4dee586e3d7e06749
SHA512 13b8677c6fda38632af04b9a8d68689de4f318dc6c013f59aae8bd783a23f391d4932b17c4d04e707c1856de153e9e634b4a2be95f4e287e26cab47b30a79d5c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 f17111767ba4eb3c4184d214c886eca0cfcf1c0861a7779c535460aeaa1964b1
MD5 0cf5f6e7fd0d3f1d2690fbbae8e37f93
SHA1 b8eea2a3ae5d6ca96aa142fa1d7cb7e28196c00c
SHA512 686548d0c1debbe231e39bd63ab4d50dec4bd7e1932be092d301ac7af64a7d1aa9761be95735f05e5c8f2f239c3cfeb406428d0fba398e0b4a31d06aebc67aaf
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 a702010151f9feae732d92195c582577b8b182b7344c267b18dd0b81b7ad96f8
MD5 d4bb8083a20b6632f9096fd183574f79
SHA1 a8fbaf1401efe86204949c5495bdcde027ac3d6e
SHA512 9dfcf606130bd0f8048a7a8b4393fb25b0ddb6768fe776c48014d543d249f9cee9aae3c652d67a37acc144273ee5618393c0561222787dc74fc3456ecf6d3455
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d0b472b274545d6217745931c16ee7766c30f659b56dcda12d358b4bfac5a2cb
MD5 231b6e5ac316e1722238e23ca91cc02a
SHA1 7b3fe3179e9fcdd4331ade7398b85c332ecddf4f
SHA512 64d17240b8a3b6e71510d1201efda76ecaffc254176b329952e7a4fd7d582d9ac2401f68c8cac3c7407aaf9ffa7239f799684648bd9650331c1d1f43d4707d1c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57b9ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b9ea.TMP
Size 48B
SHA256 fbd264967561db6a85fd5c6b36a5d75d95d30e73b67826c999833d1db0df24b3
MD5 d430efdca73788aa9f7a7c9f4f7850f1
SHA1 20558e685b11b6fb5cc22ff3793a8b1d99e3fb8e
SHA512 076c267f582b8b302ff3aeaae0cd8f709bbe454c92f32f3d36bb48b79d76b60693893d61a22a575e374978d69fb62a6bed893a140c6308e382230f8fb98717ef
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 9bb5e27b3cbc29c35b151a74b24107b63be3411d5622c9a445cb2303ad87c048
MD5 48e24bfe8040d09739aa045adf1e427c
SHA1 96c6a3ffcad221055a8de27d6f7e1b1c62a485e3
SHA512 c5217c9add404a562c2f349a7fc8b7c6e79b5a4427bd31a49bca739e26f2cebc6ca8fb5949da807cff5695378982cebfa7cf96f0ea28a7b26f68ae56c248ceef
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 83331978ae08bff1a01dee439a659b8e15e603ef590e71116804507dcab0ecd4
MD5 87e9bb2e827bec2997da893e91f57977
SHA1 e20b6938925d0e79c31d6aaba7040d09203bbe68
SHA512 6de9d09b43fb2fad36e043afe837524769f78f473908fba47f74ff046f8d4491a86f92144dde924b2aac76c1f5cd81ee3fde93809a71e4779b46bf387aa913dd
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b239.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b239.TMP
Size 1KB
SHA256 50a99838ad9b35be0d457e6dd1a3bde5924a6162e79b15a4f0a669cc23e20ec8
MD5 81ef635f797ae881e6050d821c6d6fb9
SHA1 33a060d707673404c8939e468c30c3ffbfecaf50
SHA512 1eeb9ad5365fff89681f65ea467827b7a0d002d9d8afc3b557be4ec1a82d8cd1d601fee61d2a4f827d07d8b2a86a51bd59a57710284e3a3597ea68ef664a2b3a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 8db0f2e3846cab45f16ff3534a495184829deca97b842a3bd16be1d676f70396
MD5 44506e995d35d627fbe3a7637834d3ad
SHA1 ef73e10a27719e4bfbffa2927e2b82a7e71187ea
SHA512 278bcba5f59a96379246ae7943df5cf9d1f541bdf0b6b6cd9d44798486938b695e12364e09f462d18251fa00f97f46ca77a8ec584700e9e3b6418c13b006585e
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 658ea304724438ce1eb8a4923f59df07e5d36d866bf5bbf50d20bedd665287ee
MD5 830a30e4f0eede1e8e13bb5d83384795
SHA1 c50942126325327aa2c7e81783289f9ecdbd6e83
SHA512 61e5aca334b6156ee3b4a58db18a22043f6463af0bbb0331165aef9b0adb6502d26ad673723dba3cf4b151f5bdb8769e89dca6e49e09d35cb55306589377546c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 de0ccc766627d8325fc9282833872538a7aef366644fd64864a6c257bb469ead
MD5 406dbcc0714806398b891dab63499ed0
SHA1 5c3863a77719685a12fe8fc4496a91009f9439fb
SHA512 539a69d273dcbb1cab1fc8307aff1be62c56290647b42631b113c81b3e803ecc0d5b91a85592ff7fc1c480811fe5d1a8c7b0cf0d63d272f929cf60f2af0ff8dc
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f4c272cd91529cd46a5f073442fad4973b577357d2ae351129d336aec56524bf
MD5 b4135e7e8954f1096bed7b5e9e346c92
SHA1 21b238b2dba61964f07a2f9d0934a4a6cd23be2c
SHA512 46f3a7e465a2077c9c44f70692e580771a629a450a1db9737dc252b22515718650d7d3d9714d7dc9315432ab63f2b104c85a1d5b02b530bde2d4318a10531665
SSDEEP 192:AoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptKEe2RU8ang8ccBXKrrI:49iIxuERzA83h09RZxY0qTUFccZcrI
MD5 SHA1 SHA512 SSDEEP

Submit Download

4QU302EM.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4QU302EM.exe
Size 439KB
SHA256 2138bc676f9a3d74a70b0f0617c3f392c8071c780e03f8f8526c05793685661b
MD5 cca8b85697331b487da1c1a3c4a1fea8
SHA1 44cbc1b13ff02412480d241f1615dcacb2def229
SHA512 1c7c28847e0799aedc6878124240213533a29e6effb3fbddfa8519a39ce99b04259221b2f6b5a9ea9c470558cef9989804afefa07ad8a2b98562dbd459d9eefa
SSDEEP 6144:nPZLIgPe0OgGJ0NRY6VA8eCmKxiVk+El/V2W0TuzU1jn08Sc1G8C2:nJtWZ6buWFpV2FKO08S+G8n
MD5 SHA1 SHA512 SSDEEP

Submit Download

4QU302EM.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4QU302EM.exe
Size 394KB
SHA256 1c2928893c9fcc42f2fff92591620950a93f736116351b9a3a427a33cc37629e
MD5 d2963dde7b5c6e753fcfac95c79e7865
SHA1 f043594e168d1e985a6b4334f1089fc9ed185b4d
SHA512 5496ed4bdc789e85872e3c841023e26e5f6554ed85d185ce2178bb033fe9eebe7f4edf1d8c4d4508932de6a0b1b9dfc27e471e8aa76dcefa72275eea35f0001e
SSDEEP 6144:nPZLIgPe0OgGJ0NRY6VA8eCmKxiVk+El/V2W0TuzU1jn08Scg:nJtWZ6buWFpV2FKO08S1
MD5 SHA1 SHA512 SSDEEP

Submit Download

mg0Cr67.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mg0Cr67.exe
Size 553KB
SHA256 1cc4a121ab3e96ca490ed65228b731a868f1429d60beb6b2fc210aa16397b85d
MD5 f1ed583c0b5b8897d09c6d155528cd42
SHA1 1501dc9d4e41fa34450416427228e23698401159
SHA512 8a8dd92050abe68a67f6b342abe045855cbdd00f41fd0ce47dd2ecfe01014135c78c8d2bf26a539b68ffffe655b1126103ae5c478345ef90a617696dc1832c87
SSDEEP 12288:QMrMcy90mv8W9vN93oRzkocfkJH9zr+UhVR:Mcy5vNX9t9M35TR
MD5 SHA1 SHA512 SSDEEP

Submit Download

1An07CM0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1An07CM0.exe
Size 424KB
SHA256 80b8e18dd1ffcbd530299c67c6c81cad7f1536b951b73e6ee64a24ee1fce2a12
MD5 a3d685f557eb23541cab3dd1b329833d
SHA1 c0b0212fa90b2050e87f68143706cb7b1015bcf6
SHA512 80234ef62fd1f89c798c8fdc5783c31fe0775f663da85c883b6bf25aebe870b07abedbc94e1bbd62d6c59f8e3ea8211b10b9ce679bfb8e4451ae4c5d7e8efa00
SSDEEP 12288:HqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhn:HqDEvCTbMWu7rQYlBQcn
MD5 SHA1 SHA512 SSDEEP

Submit Download

1An07CM0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1An07CM0.exe
Size 312KB
SHA256 d05fa93b5ae96294d5e0af5c60af543c92f59a8f509ed486081a88e4ae25e9c1
MD5 54bb1395389170df12725815b481a047
SHA1 1621e7b0f489233d06565fdc40ede1f774a17bb2
SHA512 0de1421d24a5aa4a4ec1503507e1300027a9eabae31e0ce865f26a1b2e75b996e9b841f30bd4ef9b8ed13abc77806c3dad8f15ffed06fa618a4f958111849ba9
SSDEEP 6144:HbV6ZXz5ah5zdgijxgUo+j9cr04DdbzNlUpWu/AvKiK9nnPEe4e7bA:HqDEvFo+yo4DdbbMWu/jrK
MD5 SHA1 SHA512 SSDEEP

Submit Download

2jw2693.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2jw2693.exe
Size 61KB
SHA256 c37b8e5cba302edcf65363f113b1ce34aa6f661c8eb4d69bcb3530630febaa20
MD5 63c7a6c0204ddeb5d06908ed021573c0
SHA1 25d049a6b751fc467331137b804a88bdbb5f9c1c
SHA512 d9197f94d840502cfb9d13630c4c5749a4a5dbc135aa716c539e8a590d6809199da19ca5d83bd913091844868981516578490cf8b17513e719b9b5e7dd161c14
SSDEEP 768:348/15lyDYRAnnUVM1DlWKhsOSG3YM5LecBc+VS1Jei7BkePmEyD/4v6fOKsVArn:oKFIKfM5LeOMecBkePkD/4v62DoCt0
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4
Size 270B
SHA256 29d1f5e9cadf5ef14024ddee2564ec15da2096a6ce5a470e5707be8f86abbac5
MD5 5d062e444206af1388524dd097092a00
SHA1 43e524c7a33510f59336147855ff9017cfb689bb
SHA512 e0804b6acb7318a86c2c5371ac8f59b0ae0519a672cd09f4f3fd5739b7a15967b299b4624c2f102f238bc396631a8f94b9df5a98fbc7dbb7ceea01b69ccf5293
MD5 SHA1 SHA512

Submit Download

memory/860-341-0x0000000074360000-0x0000000074B10000-memory.dmp

Download

memory/860-47-0x0000000074360000-0x0000000074B10000-memory.dmp

Download

memory/860-46-0x00000000009E0000-0x00000000009F6000-memory.dmp

Download

memory/7324-345-0x0000000000AA0000-0x0000000000FB6000-memory.dmp

Download

memory/7324-413-0x0000000000AA0000-0x0000000000FB6000-memory.dmp

Download

memory/7324-346-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download