bcb405d27e43e61aeecb3d0af144815e65f3656c3a1638c35d3a9a4491868366

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WEXTRACT.EXE.exe
Size 2.3MB
Sample240119-143f2afag7
SHA256 bcb405d27e43e61aeecb3d0af144815e65f3656c3a1638c35d3a9a4491868366
MD5 bc5ad5fd5e425f35b0d7af9c1cf238c1
SHA1 3cda5efa0647f9cb534105db6f26c83ce5b86e04
SHA512 96fbbea1bd380570b1b6fd6eed7b24de95b64c6e18e68d42bcfda7a85e3a5b91ee58816e40508127e1ddcc05fe33f2495b854f7199fce780e0fa3955d54c1219
SSDEEP 49152:l2KTsF6G+f9LoRbVBpjL4vV6BN2SIiBtFU4qgS:wKTsgzf9wbVBpjL4vASSJqX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	1QA30Bl0.exe

Executes dropped EXE 2 IoCs

pid	Process
3864	1QA30Bl0.exe
4436	4Hp717Fs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	WEXTRACT.EXE.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000002323d-5.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133501760052806853"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2398549320-3657759451-817663969-1000\{D7ADF802-6514-4ED0-9DA4-88D44C27A195}	chrome.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
2856	msedge.exe
2856	msedge.exe
2900	msedge.exe
2900	msedge.exe
5224	msedge.exe
5224	msedge.exe
5556	msedge.exe
5556	msedge.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
5392	chrome.exe
5392	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
3864	1QA30Bl0.exe
3864	1QA30Bl0.exe
3864	1QA30Bl0.exe
3864	1QA30Bl0.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2572	firefox.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
3864	1QA30Bl0.exe
3864	1QA30Bl0.exe
3864	1QA30Bl0.exe
3864	1QA30Bl0.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2572	firefox.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2572	firefox.exe
2572	firefox.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4436	4Hp717Fs.exe
2572	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3864	5092	WEXTRACT.EXE.exe	87
PID 5092 wrote to memory of 3864	5092	WEXTRACT.EXE.exe	87
PID 5092 wrote to memory of 3864	5092	WEXTRACT.EXE.exe	87
PID 3864 wrote to memory of 2620	3864	1QA30Bl0.exe	88
PID 3864 wrote to memory of 2620	3864	1QA30Bl0.exe	88
PID 3864 wrote to memory of 2900	3864	1QA30Bl0.exe	90
PID 3864 wrote to memory of 2900	3864	1QA30Bl0.exe	90
PID 2620 wrote to memory of 4348	2620	msedge.exe	91
PID 2620 wrote to memory of 4348	2620	msedge.exe	91
PID 2900 wrote to memory of 3016	2900	msedge.exe	92
PID 2900 wrote to memory of 3016	2900	msedge.exe	92
PID 3864 wrote to memory of 1616	3864	1QA30Bl0.exe	93
PID 3864 wrote to memory of 1616	3864	1QA30Bl0.exe	93
PID 1616 wrote to memory of 3156	1616	msedge.exe	95
PID 1616 wrote to memory of 3156	1616	msedge.exe	95
PID 3864 wrote to memory of 2920	3864	1QA30Bl0.exe	96
PID 3864 wrote to memory of 2920	3864	1QA30Bl0.exe	96
PID 2920 wrote to memory of 4988	2920	msedge.exe	100
PID 2920 wrote to memory of 4988	2920	msedge.exe	100
PID 3864 wrote to memory of 1108	3864	1QA30Bl0.exe	97
PID 3864 wrote to memory of 1108	3864	1QA30Bl0.exe	97
PID 1108 wrote to memory of 2616	1108	chrome.exe	98
PID 1108 wrote to memory of 2616	1108	chrome.exe	98
PID 3864 wrote to memory of 3808	3864	1QA30Bl0.exe	99
PID 3864 wrote to memory of 3808	3864	1QA30Bl0.exe	99
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 3808 wrote to memory of 2572	3808	firefox.exe	101
PID 5092 wrote to memory of 4436	5092	WEXTRACT.EXE.exe	102
PID 5092 wrote to memory of 4436	5092	WEXTRACT.EXE.exe	102
PID 5092 wrote to memory of 4436	5092	WEXTRACT.EXE.exe	102
PID 2572 wrote to memory of 4592	2572	firefox.exe	103
PID 2572 wrote to memory of 4592	2572	firefox.exe	103
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105
PID 2900 wrote to memory of 2192	2900	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\WEXTRACT.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\WEXTRACT.EXE.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1QA30Bl0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1QA30Bl0.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc383a46f8,0x7ffc383a4708,0x7ffc383a4718
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13746142604753498277,10971246020630883930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13746142604753498277,10971246020630883930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
      4⤵
      PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc383a46f8,0x7ffc383a4708,0x7ffc383a4718
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6292 /prefetch:8
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15032628651022263384,12433264233271671189,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc383a46f8,0x7ffc383a4708,0x7ffc383a4718
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,11099430165574035309,11384444511567787340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,11099430165574035309,11384444511567787340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x184,0x7ffc383a46f8,0x7ffc383a4708,0x7ffc383a4718
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10661534687399261554,10186134228995749424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc37c89758,0x7ffc37c89768,0x7ffc37c89778
      4⤵
      PID:2616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:8
      4⤵
      PID:6728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:1
      4⤵
      PID:6876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3168 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:1
      4⤵
      PID:6888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:8
      4⤵
      PID:6736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:2
      4⤵
      PID:6720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4628 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:1
      4⤵
      PID:6716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:8
      4⤵
      Modifies registry class
      PID:7096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4828 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:8
      4⤵
      PID:6472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5248 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:8
      4⤵
      PID:2712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:8
      4⤵
      PID:5240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:8
      4⤵
      PID:2288
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:8
      4⤵
      PID:1316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:8
      4⤵
      PID:1540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5604 --field-trial-handle=596,i,17453072888556175883,1937516959267411699,131072 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.0.935740721\1452859088" -parentBuildID 20221007134813 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8869eaf6-6a42-4e83-9c0a-d23f059ec1c3} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 2044 20da3cd7158 gpu
        5⤵
        
        PID:4592
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.1.1035156365\1249744025" -parentBuildID 20221007134813 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7368675b-66ad-4dab-b5a5-d9f0396f2a8c} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 2472 20da37e5f58 socket
        5⤵
        
        PID:5232
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.2.985998205\432185004" -childID 1 -isForBrowser -prefsHandle 3432 -prefMapHandle 3428 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4582ff7e-b1d8-479d-956a-6521f6fab4ed} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 3552 20da7022a58 tab
        5⤵
        
        PID:1608
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.5.244966642\1412818127" -childID 4 -isForBrowser -prefsHandle 4396 -prefMapHandle 4400 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6f4de06-2781-4fd9-ac18-2c364a6f91e7} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 4384 20da5bedc58 tab
        5⤵
        
        PID:6832
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.4.717142561\1015501321" -childID 3 -isForBrowser -prefsHandle 4192 -prefMapHandle 4196 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c62e6197-5c1c-4644-af3e-97e28a1d9a51} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 4180 20da777c158 tab
        5⤵
        
        PID:6824
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.3.1788685971\954461714" -childID 2 -isForBrowser -prefsHandle 4040 -prefMapHandle 4036 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f6a5b9c-025e-4f3a-a841-6c4225366a82} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 4052 20da777bb58 tab
        5⤵
        
        PID:6816
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Hp717Fs.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Hp717Fs.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6300

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:7148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53fa2937-2eca-401e-901f-a98fcfb2832e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\53fa2937-2eca-401e-901f-a98fcfb2832e.tmp
Size 15KB
SHA256 8c6475a97426c66cb0bbcb55f069a5c849c403e16f28bd340463eed821520e02
MD5 62d397bd857380ccebf52d18acec4de9
SHA1 99aa9d399580396b7a2b9d081bba71be5e214414
SHA512 d6fc0db6e47821dc30293bf8faf481d81fdf1250b2501e1aa7771f7fdc42353adebfc10c4269bd555dd429476efd6934d24961d47ed18fec7ca0e698feb01d3d
SSDEEP 384:FBLPLe0XJ1kXqKf/pUZNCgVLH2HfkIrUjHGSVKFKaTN3imEaW:/LPLBJ1kXqKf/pUZNCgVLH2HfrrUDGy3
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 c7e1ac6c408cb47b7499fb8556c89184da5fdf1ba39e8d8a56bc589f844ea9e9
MD5 7a0af82658f82baf9e7e8d5f0a207e6d
SHA1 13dd9c1c7533f880b59fb40dc3b69d13b0755836
SHA512 b120e6777499883d7d123b7d2c6ea92492b80db0c4d03a9e38185fa50be8b57480759941a089524162aa3ce0dff2c03ffa07599291f0951b33b4182e8113c8d5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fec46df368db161eec21a82efb32dbe98a3efc4c4b2125024a5f03a4a70c83b8
MD5 9d14cf412067903f1d4fc683d0fbb25c
SHA1 4e09fa777ae84342f57048b6ce0e7a9294ce0db7
SHA512 3c9ab7541f8d17c004d2e77df6e200d2c70be602ae840bfec8114f3c69e8921bddd132e9ebbe4b63f631f4ac160e45e2ccb2b9967e218a9a9b1e8c2c49428b5d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 2745be4d54d21c13e0e6203aa6dac5072f3c7aab7b80327bccf3dc9190433d50
MD5 731d8df5162b3dcfe1a5f69a30ae45d5
SHA1 5f6bec1e95ec869e70e06b38eb115c57d8913f0b
SHA512 6d5ca34e924cc9c3cb4cd43e86fe9e20c7d310ed404e6eed6e470d5cc3a5fe002b4ef20d62871d4aae0ff4cef750a875c7ade9b33641ab6e60dec23cd62d76ba
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 99e2a03c809724cef3746bd089cd8f16d8e1be4afcaf0810d2aa39f0eeb38296
MD5 a8513714ef166e3223fe7281c5e69566
SHA1 486084611aee94951421667d2cc609b752b316bc
SHA512 1f88e30c9d51f5d2c2cc8644e49e308631df2ea0456f2f2ae11a82d3abd36795c1ec7c9a6b03deeb873104496757f18470701fa526c8c6465936e8ac6fbbe003
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 5a08d268770a1d2a3d10e0e51967065bc35213760bfe15829fbe60fec8a61c16
MD5 bebe6d70e82e740ee52b5184f807765f
SHA1 31909d846c3a46151312f61f33308809934377f5
SHA512 231aebd8bf732b397a366ef847f07a7661d71cd70a012e58d23ef0e386b8d0fdd16e02f8a4c6ac31514517aa9d5f17c94a5c1ce1b98fc329275a4779ff5776e4
SSDEEP 96:KcCBX2/QK5jrKI95aVw+t8iZo+y7Di+6Msmde/k018OQfn97jVhYtjEsXt0/cg2S:KlB2rX5bk8x+yy+FSk0WotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 dde91e95d2aa1c8e90ecd56b119d21dbcfdd1b26dc8adac895d54391c63e7f40
MD5 d88adce795dcbb279d774ac25516a33f
SHA1 ee14b09095d827a524132ca4e74d9b5fb4eb8349
SHA512 4710016350c1cff11523bdb50125f1b6acb09291af2a44a9838fcd7dc3d5be2dfb718004aad1428be755ae2363db3b093e9b663613434699afacbff4f1f2b3ab
SSDEEP 3072:tHZNShdK9pKr/Fb95Lj2qbWuNtVmymqMR8y8jFsHClstjl+RZ3ExBmTyNAccce6T:bNuZYqRNDmrRox0B+70xBmboJnf9/ToW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 250KB
SHA256 8f1d7d3948ec9d0c09feab99b44f4ed654864678b97749496892ee6f6f6f67d7
MD5 fcf1248149227fb8a55817b67feb77ae
SHA1 be99040ca57ee016d4b72fae718869a2ff2fda89
SHA512 13713996c2576c22f81aff546718564fd2ad4c9a332be8f94860e6a408a5ecafad2cff80d6dbfd719892fb320e8939cade20f16b103416a103bdd9e09de86cf5
SSDEEP 6144:bR8NuZYqRNDmrRox0B+70xBmboJnf9/ToW:iuuqmRoxExBOinf9bH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 19889bb31bf51e2008978ee45bbf5bb2baa67e73448ca84a9e56793245820410
MD5 a63a5a504d73816277bd97af1e762fd8
SHA1 653fc2a21badabcea4597cac216eeaac50f1b869
SHA512 427685a142eafeb60a4c228423823808741187347b9ea1d590948c242c26bcca28e69c4ae7ac993d580f31e0cea2f92abdb214e2a10f2156b00c4030862e8fe8
SSDEEP 6144:znNuZYqRNDmrRox0B+70xBmboJnf9/ToW:5uuqmRoxExBOinf9bH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7abb90f676eff5c3cc66dfd62aaf711cb02fe25b11ec64816d4b051016a07dad
MD5 6e0611d33200a340d48f83376cbff2c9
SHA1 049a76cc716221a19879113b3555e2fa948efdf6
SHA512 e9eb36e8e586eca5755092aaf12197623240096080eab3cda57b853c296be7af03cc03659215e047235ce41f65a5441f989f9b59e52f1ff43c77132aedcadfef
SSDEEP 3072:xWjl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCb:sB+70xBmboJnf9/Top
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b
MD5 7a5862a0ca86c0a4e8e0b30261858e1f
SHA1 ee490d28e155806d255e0f17be72509be750bf97
SHA512 0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e36c7d688cd7d187eacc4fc1ccdd2968de91cee60f15ecb0e0d874da07be7665
MD5 51ccd7d9a9392ebca4c1ae898d683d2f
SHA1 f4943c31cc7f0ca3078e57e0ebea424fbd9691c4
SHA512 e3773c19314c66f09c0f556ade29cd63d84cc778be64060a570eed8f6c7918b7d09d2694d9e2d379bdaecb4e20cb140749a8111ef267c67a620d64cb598e0619
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 20KB
SHA256 bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
MD5 923a543cc619ea568f91b723d9fb1ef0
SHA1 6f4ade25559645c741d7327c6e16521e43d7e1f9
SHA512 a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555
SSDEEP 384:kNMw20ZcZdIR049weTGXkBXju/W4irYjhPC09oOtbMDa9HVZycTvwxNTGup:UaxmXXSdiQPCjMvyugNiup
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 21KB
SHA256 6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
MD5 7d75a9eb3b38b5dd04b8a7ce4f1b87cc
SHA1 68f598c84936c9720c5ffd6685294f5c94000dff
SHA512 cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f
SSDEEP 384:PxbG/ZciREUTWlMwbptJm5f9/1HuLZ4r38bxSpfGL/+SHA+ilQlO3fq8O/4s:5bfiBWlRPm5fjrruYJGTiqlO3fo/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 33KB
SHA256 04d173d9ff132891d4c75ae62de7b095d7f098a68fe3e66ab50adc08a01709a1
MD5 34785fdfe8bc769c567dfb372c0ac49a
SHA1 7088f2ed86625a704b15b689fd4ee613ff626313
SHA512 1e3ff9e722571b49efa44af456e39847b70a6869cd0efd1534b7e9dce851a56b2afd0c1b31064e600cf852913e53b75c1be1b80de9d603eeb54670c41fa595b5
SSDEEP 768:sbIXFHn2OdKai3R4scIr9q7M3JrYPehsSOYzk4ft0lib:eSFjwfB7cIAeJKehsS3w4h
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 8954bee56b4dafca3fa3b854280413935bed4524f008386112e340010dd7b25f
MD5 4b2ed055a7c0c185bf4386f190f088dd
SHA1 d2a860a87e21a8b1ffdec12a7e5454f6edcf3071
SHA512 f0bfdcb80d9acb9f8cd4514b6ac553d4f5a0b29687fe892c810ea1f819be9e310e62aed24f6a1bbc75986f3bc9ecb3d051584b85f0df6545228e3308e071065a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f9e4712f50b5cdd18e1a7303a9e6da2d3b2d8fbe49cc667ecdc13b2e50df404b
MD5 b874c7d8b5149b25aacc1aaf4dfa976e
SHA1 f3767840cbfbdf1f34a8d049dda3077a144b9ad6
SHA512 3043d613b0d14f9ea2f1c957a0d4af739b0a3c63f57db68110f44ad048c4cf5439954e1180cb5a1f12f728c2f6a6f8cfdecb4e2b78638ce7419e9ecc718882ea
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 681d03f7007fedd80c4085a161c6cfe9e91bebca68662614a64778ab5e5fba42
MD5 9f145184063071a89b6ffc9f2fa6ce84
SHA1 d4ee71770a1e7cd131b4e0dc4643cbb556c2cb8a
SHA512 4e5ae780eacb4123caa503b7abe95eb1c58b569d7bbd90ed2cbbc62ad553edb6acbff879623d01ec978c40c54e547d752755fe599a8d73cb90796df01795bfd6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 9bf92c8d6930f8c3304207284f28ffe424f894ae6a170cc4b09648422a266ed4
MD5 939504eda7b0905b427f17b68d03509e
SHA1 ede9c7a044353748efc480c622b235ee41c1f63a
SHA512 7ca44d2f4c6a6360cbaf244e72c912bb0dec04e4106510e30aa7750a041ea42599d009ba717a70c5ede90ff3f487b7adeab2200137f1f0064d946dab8d3f6682
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 8add37c55a692c67b9092e9083e3ae0e223f97675b96ae6d7eefe27b2fa5e5dd
MD5 ef14cea455909a76b68a77264a9b3491
SHA1 eefb66d639eb6bdadb5a1b04194c6227da768c99
SHA512 25f7318bb76029db46bb3089e6b3dd05bcc137f9f9f66d42e72eb62a040f06ae9ed0295c310e88a647936ddd083c5281bf4907b5f0f983bd164ad25806551bbe
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 da303dfe7100dc2f1a7799a402c0e1f487bcd54d053a9bead02bb63401471a93
MD5 1dd531d52a2e6cbc046b5640affc9136
SHA1 db22e5fdb7251239db5d6c3e25b86defa5243ad6
SHA512 0337d770e34be63019f2338cdd34e1cb112b25d6f3274f0ae67e1a880f2f8e66328d10fecbe84bc6edf6bd2dbdff6d36065b5cec8569c1ce8486daa7199dbb7e
SSDEEP 96:n+hkSOL1L6wpvWMoiVmdeHkoIyO1cUWQyV+VDCzia:n+hklLJ6GWMXVIyO1crj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4f81f2c34ad70d98e2976b22e07725eb1db9103498ad87fc99b28af290f5cf42
MD5 43eceff22bfc77b69f5ee6842924a6a0
SHA1 889784ecc307193b83dca2823a31c0b3a901865a
SHA512 a2c609da219ead31bb30bd0fd35d31c95d566965c08292c45ec0a2adcb6db204baa8a7f578aa4cb922e749d102e8760594a0b7bed5421fa95bd63c021bab729a
SSDEEP 192:n+LkULJqSTWMiYfLuPwvu6W726QZIyO1crV:n+L5LJ3WY+w5WIZIyO1M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e328bbb32885873cc75d0cf58a903565c20ced90f83d56da8fc46f10d74fd2ee
MD5 615d028c1abbfce266f5cda385cdec17
SHA1 101a7c65058efc647d3559b97051af1ac69f63d8
SHA512 6eda332c9c1ddfe6db1bb7ab72672fbe7b9496f28a3693c51b73e56d1abe6e5ced2303bdffcf1b69f3d5361125ac7696b61ce9888b0e6825c872b9c28e8dbb62
SSDEEP 192:n+LkpLJqSTWMiYfLuPwvu6W726Q1IyO1crV:n+LQLJ3WY+w5WI1IyO1M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb
MD5 52826cef6409f67b78148b75e442b5ea
SHA1 a675db110aae767f5910511751cc3992cddcc393
SHA512 f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c
SSDEEP 768:nXwWPv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2LlxQrUEYtLAO:nXwWPvu1jafLzPtcO
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 e0257a35613d39d609b2c558c1fc1ad7f9b89759e634e041adb979a1c78b2d55
MD5 2946198f32106c2c8633e96337e01ffe
SHA1 b083f3cc42297f2ae77ad0afef9a4b065e28b785
SHA512 0d3a5f924ed1f79a16b52102eddeb558f03e28f43ef6ba86c5f9e7a476b18eadc4e310259d6540f3bf3e04efffcd9fae44b5a29396ba5159006f631a006d4052
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 1b996061a5fa9a7bc87a827c3bc879e3216fb574c2b3e52c35f5c9e4eb7cdd01
MD5 ce1821849c9e09773a78eca179f9ad61
SHA1 f145be85c7c865aef4b4283a755ce0e154854c62
SHA512 b3e4265b482dd38e4283128c59c51f9a5ede03d3b9fa53ca8b771ff79e0b4cea814723213106e4457db441312d72ad244c193bd449c0ee717793de86d012418b
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 82B
SHA256 01cd6ccd4ef6d70d6c8afc2f505a9ec64c30a71b6470c55de083f599b7a74841
MD5 c225bcf2e68d446375bfa71bce705df2
SHA1 ab82e55e072ba91c16d29902680a0af67cdde712
SHA512 da8aa669fcb4f1f42f1dd09da9f807932798ec55bae897d4f8b8788f55b3d26c84e4ca1a39db1812bc577f51e64f03af1fb8c3db410d0f64e91c40e2eb17eac3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 84fd4f33c6e51c0591b123efbf9e10a5f7d641114fb2f9cea1958d97a4b682c5
MD5 87d9c5608a5df08b520a953b418c19e6
SHA1 de8cedd283ed433a01f7ee74b71c751bef0b17dd
SHA512 5f41603bc25878aa2b9a14a4c11c274c714be0f46a7540877a2e08c396ea2967c95d40d9008afaa7eb57884d92a372208ca765144b6845b9dcc45e1922cd0af4
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5829ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5829ca.TMP
Size 48B
SHA256 76470fc27cbc28691025f1330a4b78889f1c16cd52160784d0d3fc14e385d51c
MD5 7f5e08299fc712f3ae9d4c8fa7cb9d83
SHA1 2b9052dbb1def30e6beebc2caeab6457a5900626
SHA512 4e7f49f7367aeae15b20f257d2aea39990d589f40f140bef74ce520be9024f31ad832b110e11756ec5775efd8cac0ca7b4dc8f4e8a48cdcd12bb05997c01e45a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 c27e14b4cdf7d71e4f5c445a76c98914d1a9540d7f519380d75b2a5421dec632
MD5 279ec241230a4d1921aaec3a75bce7d9
SHA1 ed50b71a627ffe4c590c964f38231e719c6731dd
SHA512 a226ba48fac37102d512090ea184c537654e49816266f79e6e6a95a4e091f84feebf9e0f26f5b85c3e7cec8f22f7662cb2edcea0769f80866a2b0e5817873672
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f0d09b9077aed492ce66b7a21990ac7397a513a50aad1b08be7101d4ce2b2be4
MD5 8100eb54ceeea5dae94803d4bd8a62b3
SHA1 68aa03f524ec0a9bbfbb1e99bfff26852e323804
SHA512 1491c4ff35047397eeaae65609b027b2f6b7d7d94c2e1ded96ad77ab563b34462fb95040a3120c7ca99f8c5598e6fb1064703d408579de8fd5166eab1cad6bf1
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 edffdfd131588066bec61ff0fdf58265145d9f7dee1856c9d3cc12f08594f325
MD5 92f730e7357a2ff7979066877243f35d
SHA1 7a19ff404eb4a521c89552db42bc396cc209b8ad
SHA512 d32c7e6ae32a0ddea33bd78268f4a446ca3911b4355c70795cae38da681ad65fb5e095394d8498a6a259d334b78354c84ada047fd85cc362ab6b363fb5fb3f84
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f8304c7eca9668f2710e4a28ba4809a9e4002b920e4113c8a03008feb46e63c0
MD5 3a5d9b5317764ce0d60a7b014923aab5
SHA1 d32e8fcdeb5cd66ec3f8dfdf2bf791f081407012
SHA512 38d427b262c061874c6922c263d33ffdc32aa275fbbbe9173a327b292a15a877be80a0b0582a675a54b1ac5e13d251d0f1183e50be3f3859339200d5d4800403
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57dbd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dbd9.TMP
Size 1KB
SHA256 18acc80e594e3b1bf1e285c4cee9412ff2cfc19747d570cb101ef226f6ebb056
MD5 d5e4c47d6c1d752c8adb95dc9014f175
SHA1 e9fd9dd30e2aa52c85e10dc99455caf839b363ae
SHA512 ff79c83541a9123e855768510804650669226941db30e7abf89e19d81a17eba691f19b4f049abf6c4040208ad77673e68620e1b1de45ce521738034092c4af69
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 05a9e1b7bbdcc10f9ddc2c6616baef5d2f1a458405c029709acf176547820753
MD5 2fea00cab14a816298c32941061075bd
SHA1 6b6c4e4c8943c62dffc6a255ed240c58d6eeffdb
SHA512 f4ad6dfb84e9486100f60e9ccfee21fffe774022ef12021bf0c88e5a45565dc81662bc64cc6541b83ae65c7d63ced8fd809d551196c4fbfa9410da7b6263b415
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 de190d618a601292cf5791a4c37db5769085f59eed26095992ff758d7d809700
MD5 be326ee15d1fd30472308a1efa7c617b
SHA1 c03cabfc2bb4253eeaca7e751108327cba243103
SHA512 7c663f6f5e4d3b677ee681bbd663dd082ba3089ddc1f754bacd35f8aadc42a26142e804255a153c3bece501753854ade27805d97adc2d9da6d7c57fb650d45be
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ed171f364eb085b1449ac60713dedbf86716ebbc77940588a8631f2102652180
MD5 045f46f720539e9c79751799e75c1c1c
SHA1 4ba5d2a120aa33a547a2570429e7eed2b5ad06a2
SHA512 b3c982f7175ee1dae71f366dc0a03789d5eb8b8070a21f24930c6072be327b1dfaddfa2644bc6b3a7c24e3b5fb64e58672ac99e5ac10ca631f0450048f656019
SSDEEP 192:yoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupNCpe2RUQkjl/p9hp85ffQM:G9iIxuERzA83h09RZxYY9jkjz9hof2Ds
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 0ae77d7fff7617ed2bcb65479e23e9ecb662ef1ea311f1b4c09baa995d7279b9
MD5 1fe37a4ca51a419ab1c37503407db73e
SHA1 9f3af1a40bf49b15661f1062d0a000bf0fbcbd5b
SHA512 37c41c657e8146bdf82063f569efeadb2bb69914bb3653bc93e6dd257fee0724a4bf7c27383ab984e826a7326ebc9e8c85c21e53d5c1486f69851175d8a2d187
MD5 SHA1 SHA512

Submit Download

1QA30Bl0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1QA30Bl0.exe
Size 895KB
SHA256 d8f6514f448a3bfdbf2f9221149b4d68b56616a57b3c6679a7c16ff4958c1dbf
MD5 1f2a006a153e4cda81566c6a31628f16
SHA1 67a0615adf137b1d75f2cf986c347b52d8f8ea51
SHA512 eb63bb51611d586c3b1ad3cd2b3a8c1d0d0c90e18e5e77c0524b04395888c2d769b0b737c2a6d758ddb809c4c21ef8b07a42305ebd2adbdcbd8b2cd4ebac5872
SSDEEP 12288:NqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgafTK:NqDEvCTbMWu7rQYlBQcBiT6rprG8a7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

4Hp717Fs.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Hp717Fs.exe
Size 1.3MB
SHA256 86f93474c1a563ec6470048ff10ec3f5e9715b0f1c2a6eaf766d38299df38ebc
MD5 221d65d17b2c253d064d846c7d1775e4
SHA1 3d22809339f8d0d95ba1275b7322c2c1848c7f6c
SHA512 9dbdcb4ff3da31f01e6e08b32ed69f03479011bd953ff0e955110e7838d394237be8507d0c01ec0275086543d6a909e9ee0bfa4049666272f9647af249771bbd
SSDEEP 24576:aLn04t1fyLE0FP2eo321cTEP04taN11OnTxgRMHv53JrX2c9fS7M:aLTfyLPeefcTEVM11OKGBX2cJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\stdidscq.default-release\sessionstore-backups\recovery.jsonlz4
Size 272B
SHA256 8aea54cd37d16390ff9e856d7ddaf3555a4f87d33b0fba1c2b59703ee3ab7d9e
MD5 a4ff9b6c308369e9c4019fd61f24c13c
SHA1 f54eb835efdf49843b6f49c8ffcd1d9c456d06cf
SHA512 cea5016fcb898b53a954ea44568c154a375fb06b2bb30a734ca791eb4c5ca58018b63b3c5207982aee11dd9066491eedb8408f831537ed37a053ddae60a4fd11
MD5 SHA1 SHA512

Submit Download

memory/4436-295-0x0000000000900000-0x0000000000E16000-memory.dmp

Download

memory/4436-40-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/4436-33-0x0000000000900000-0x0000000000E16000-memory.dmp

Download