hxxps://www[.]mediafire[.]com/folder/8no97trzbix8y/Laun4eer

Resubmissions

12-02-2024 18:51

240212-xhvmhsba41 7

12-02-2024 18:44

240212-xdhgdscf55 7

Analysis

max time kernel
191s
max time network
192s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
12-02-2024 18:44

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/8no97trzbix8y/Laun4eer

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

linstaIler2024!.exelinstaIler2024!.exelinstaIler2024!.exelinstaIler2024!.exe

pid process

1408 linstaIler2024!.exe
2372 linstaIler2024!.exe
3092 linstaIler2024!.exe
2072 linstaIler2024!.exe

pid	process
1408	linstaIler2024!.exe
2372	linstaIler2024!.exe
3092	linstaIler2024!.exe
2072	linstaIler2024!.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

linstaIler2024!.exelinstaIler2024!.exelinstaIler2024!.exelinstaIler2024!.exe

description	pid	process	target process
PID 1408 set thread context of 5840	1408	linstaIler2024!.exe	BitLockerToGo.exe
PID 2372 set thread context of 6060	2372	linstaIler2024!.exe	BitLockerToGo.exe
PID 3092 set thread context of 4916	3092	linstaIler2024!.exe	BitLockerToGo.exe
PID 2072 set thread context of 5584	2072	linstaIler2024!.exe	BitLockerToGo.exe

Drops file in Windows directory 4 IoCs

Processes:

UserOOBEBroker.exe

description	ioc	process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "235"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1184116928-951304463-2249875399-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1184116928-951304463-2249875399-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3204	msedge.exe
3204	msedge.exe
1624	msedge.exe
1624	msedge.exe
2624	msedge.exe
2624	msedge.exe
4728	identity_helper.exe
4728	identity_helper.exe
5480	msedge.exe
5480	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

5624 OpenWith.exe

pid	process
5624	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

Processes:

msedge.exe

pid	process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

7zFM.exe7zFM.exe7zFM.exelinstaIler2024!.exelinstaIler2024!.exelinstaIler2024!.exelinstaIler2024!.exe

description	pid	process
Token: SeRestorePrivilege	6012	7zFM.exe
Token: 35	6012	7zFM.exe
Token: SeRestorePrivilege	5148	7zFM.exe
Token: 35	5148	7zFM.exe
Token: SeRestorePrivilege	5124	7zFM.exe
Token: 35	5124	7zFM.exe
Token: SeSecurityPrivilege	5124	7zFM.exe
Token: SeDebugPrivilege	1408	linstaIler2024!.exe
Token: SeDebugPrivilege	2372	linstaIler2024!.exe
Token: SeDebugPrivilege	3092	linstaIler2024!.exe
Token: SeDebugPrivilege	2072	linstaIler2024!.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

OpenWith.exeOpenWith.exeLogonUI.exe

pid process

4516 OpenWith.exe
5624 OpenWith.exe
1828 LogonUI.exe

pid	process
4516	OpenWith.exe
5624	OpenWith.exe
1828	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1624 wrote to memory of 4576	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 4576	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 656	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 3204	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 3204	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe
PID 1624 wrote to memory of 5008	1624	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/8no97trzbix8y/Laun4eer
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9df5c3cb8,0x7ff9df5c3cc8,0x7ff9df5c3cd8
2⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
2⤵
PID:656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
2⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
2⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
2⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
2⤵
PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
2⤵
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
2⤵
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
2⤵
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
2⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
2⤵
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
2⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7556 /prefetch:1
2⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1
2⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
2⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:1
2⤵
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
2⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
2⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7964 /prefetch:1
2⤵
PID:5160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8564 /prefetch:1
2⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8736 /prefetch:1
2⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8924 /prefetch:1
2⤵
PID:5444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9036 /prefetch:1
2⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9256 /prefetch:1
2⤵
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9392 /prefetch:1
2⤵
PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9640 /prefetch:1
2⤵
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9548 /prefetch:1
2⤵
PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8796 /prefetch:1
2⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8392 /prefetch:1
2⤵
PID:6136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
2⤵
PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
2⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,7867820827488227891,10223429671481803691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1660 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5480

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231.rar"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:6012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231.rar"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5148

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231.rar"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4020

C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe
"C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:5840

C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe
"C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:6060

C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe
"C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:4916

C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe
"C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:5584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:872

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4972

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:4892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5624

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39e5055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dbe72a1f5827efc08f70d06ef815d46

SHA1
6aacd61519fce53ecb92e5e61207a6c29c01f47b

SHA256
dd673404dd6deb2d2b331316370fd05e47c01b9dc489640f05b50898d536a6e3

SHA512
2e6115ca818df5f5b7985caf3ce2324e266b376f6180f84b44e9ae725e037a8456c2cd63e22b9750e2ba27f4c7460dfa429ce9910517a728b056e5f1e730e25a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
62KB

MD5
9d24f8e471644bbef0c94d4bd57d503a

SHA1
81cd9121d379dce0baac0190f86092ab8e948bb4

SHA256
e44cf8e17283de26a37965dccd2e9da783de62167d1fe268cbdc716150cd6463

SHA512
b0740cee06b8a8847f5f4786f20810a915f5d8d3a732b9abf7ab6ff5f3a763400981559dea303212a3d7d64524999f46c6f57653c918164f75e0bb32e740f100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
31KB

MD5
227d55d385fabd6f05eb8c67b9733999

SHA1
3eb8f335c07a52588634281e5d5a66f7933d7449

SHA256
5aea8852d89fe365202a39392d67498224d7985f90edf063719002b07fdb62af

SHA512
98531fcf1ecfeb22e2c5d1956d58211e9dd3d801a142140b0fba8e5b7a732ee29558dccd29393d437e2acde28da555d84491b78856696873ea6e8efcd26c9450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a59ba79651ccb6bb4255a669b13c402b

SHA1
cbdac256e0857c8c0251e30ec5e8c2b0b8f17f1f

SHA256
64c96cd20062c5bd30a5dca61787807185d91915e7b10031fbced35736781ca0

SHA512
9e5c8610b0621167da08f9242bc26ec2b2f5d97e28079e6aff2f8718b2dd5e5d675cfbef7997413821da564f94f34e8460eb36f73142d8f5f9146e9043427feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9a32949792ab21ef3ab6c517ff65e758

SHA1
c60707e79bfe910b7ee37c2be5e74f15232c6b7a

SHA256
969c220bb9790c0925b5f33a44b220a8f975d871b2f64f2438b8cbb68368c436

SHA512
db1e4fb2c6a89f3ddc3ddb7eece607c43c820b20ea4ed17c4e3cd336c8b8df8f4a58f7fed572ff89f1162e230437468c4d5af6a3e5b3848e00e5cef9b2a73d30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
32b75061b4fb6e840bf87239edbaabbd

SHA1
01cfb245696bb5cdf4716386210025c42937fd91

SHA256
21245589348a2492638bfe7dca088588263d8c3618e2fc44f80de3a5e30afe2c

SHA512
3760b1a9d2d4ea9b993192e1da8284771fd7c47f6bf344e5b01883ea2c3d4136d3985be8ede4480a0e238d5d5af856fe6a81b9d3d51e89fb808148a2a8e110a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
727bcf3514ec5993680e713813b65c00

SHA1
a95e4dedc082ab3e489da4400461e9ff1fcfa7cf

SHA256
f2fae230528ecba91719181acdd64015cee836d8b41052ab9f69857a3ad08c62

SHA512
6a57d939a8cf5d9823a04aaf5abc8bdf14a0a6875cdd14d11f5b65c36e3c14d21f9e2e74a72f52019620d0938b3f2537fcc74f0674b4be9b90d9aece86712f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
fc43f7453ef1c212015bbf0f8fd8416c

SHA1
9ad014ebf11406bc7a154381f9c00eee6522a9a1

SHA256
5b77cea8e6aec578b9503eb7f22a38cff4fa92c94217fb93e2edf1308a092692

SHA512
963ab7a92a3f8cb7050e31501e0827f02e4e58209f8ad27db9b46db093ecede073466678015063bf26a2905d5e0f8111e9c3ee6b247d99710da3ea352119c28a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbeedfebda60cd1f75d2afd5386af6db

SHA1
286544cbed3fa00dded4753c0cd0690b8459efef

SHA256
a99d89fcf1df9a604dbcb4e249cd2367ad22f387820a24925f9de0a3575bb8b9

SHA512
de6bf22ae7b03c6b0867810d04961f245f69e74de9d14d5a973380b0f879ffef63cc6ce7726c636ad939709768ee3252cadfca78ab0bea2ca17d303bd808b470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
ff55c46069b3262a9b542854bb09555a

SHA1
c1b4bdee3248c1b1666c3d15e41c634b7e386b96

SHA256
291bd4b71ca799966c69334b26695f4db6edebadfebc7ce62caea67dec82aed1

SHA512
63d5b4daed6bf1ca9513c568abb0b0baad1e3f875207587f00de9997b92c7730ae2c30ab5b5bdcd37b607e56ec82b41be757bea3c46baace6d7b06c4f2280366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
e5477be1e6c4cc9f570c69a84dd4f681

SHA1
fdcbdc83ccfef1c270b927c6815e641f6d96a132

SHA256
f06ab204d1d24ecd2d13e473bf807a8fc65ed09114a227966b4a308bd7eaa531

SHA512
24eb3338f0a7be6df183c5d5f22831bed07ce0779dcc124e805364a128a08f571160a6809556cd1de323c9d3cc64299855978967c8693b8324cd9bb22f5ffe14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
ae02775f2a4fad25024d71518038a09c

SHA1
d98bc743ae0fbe65a885e17e07653fa7b27d5290

SHA256
8970f88fbaa43c2ac30127e2a10e1b08ba1bb33b3163c07e383567df7c525164

SHA512
2911a821755c448d4fbaa7de7dee0858f88440c9cbaa533925370ff6867126be84d9be27e82290a0697f1ceefb70832a075457fab44a8ee464d37c004ac81c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
c92e41598980738993edf495a3abd99d

SHA1
a1f21107787bf64d3798361d97f4024af5aaff71

SHA256
82b520e8cccc65ff6d2818ae1ee79e72c4886b2bc46ad0945cb6df6a12357a5a

SHA512
0da49094fc9a80e8f3b42cfd8ff3d89b2d2b3a90b7b01e31e0b459930222176718811f0ca490bc8472838ac1bb7b7d090e7262e99ffe632ea3985bdc693b9265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c65d.TMP

Filesize
1KB

MD5
9aba983ef3a1a2c3d31561fa25fb1255

SHA1
7bb2f982d52571caac25615f949020e3d85f1fa2

SHA256
828d98d0d9ad3f1bbe1e9dfe2acc6c2955f171c4bb953e5011af95c07eb8e3fe

SHA512
35ba0eef46f016116455171d0806d69fda379fdbeb8f463898111e633128a41a493282c1ed33b3e2b5bcdab30e60560596aceb2dd8c64f86e980dbebfb76ebe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f852355f-df68-4af8-8e5f-5c518aa849a3.tmp

Filesize
4KB

MD5
e6f02835f62b65ec5ae0b37273f95e31

SHA1
a29cdf472f0d8213a04ad2270488de0d801c669c

SHA256
c92618158841d52edc60eab9b115834bd9c12dca9b71f6f82be1938cfe21e38f

SHA512
f2a1f629cc2799835a03a122752fa56284c8a91af0a8ddfcc6f168eacfad98d0a621f7278c03ed57ac6c0dc6b95e9a1b4f42cc69fb7948372a74edc8414932d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
9f5ce8f67c59cbce9c83c6cf9eac4a29

SHA1
0ca7be22d0218f248b825ac348386b06e5f37279

SHA256
e6e21f7671738442031c394cd26def2ae9c6ea15256343f24e94e7d6aa94292b

SHA512
906d7909732f8a54114f8d62df8a8fb087583473d279c2d47addecb59cd73330259006a00dcda8f81fcb56c21e8197b12337c0aa929d62d768b100147b910051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d831ebe795913760ecd1e3e507838efe

SHA1
5aba8962caec7245f4bc30b59cefa01e240d2a98

SHA256
0ce25aa0bb9e384c063685fcde6f5b12c76e5e44e6a0e432b2f71eab0bb31aae

SHA512
093c2f02cdfe459b093249b86fcd6e0cf53a6c60e9c5e1b7ce31dba1b2869f2a8e3180732dfe8d41f01ced68171dc9d049be519f0110a99fcbdc03b978659c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9aca0b837cd2ddfa9834cb2ec27b031a

SHA1
ed77fb8aea281ed5c2a7cb561f6ca03235cd4563

SHA256
a68af6e6ba223369324e68c5a985a789a40ca02ecfaa0e58b9503e1ec45338fd

SHA512
2750f682d12a31fe293e0168083777a4d44d670aca47b5beb9b789cf4232ebfd42e317ff774b2209b060aafef0ffb17410e6e08d4c3e1ffb1d47b08d3d91ea3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0ccf27785c0d10368d5ebeb3fa743f71

SHA1
6e32a7ea18e5b0e142fa9c8cd398e89233147be5

SHA256
91eec1b94610931f62ac4b57593154f243a77fc1c56d99a9cfa2b6b8f5b990af

SHA512
bbaf9e6abad5a29a4c8774902fcaf87c63b0280f4cf63c63bf7a8acb8cf007f23c1c394e8353490b3883e5a74ff672bf9c9e04c6af034e3222c1c3234450acc7

Download Submit
C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231.rar

Filesize
1.8MB

MD5
f15bed07d714fa0ed0fe810a63045814

SHA1
3b752bba39d9f58b97478f426c0460e248780c3c

SHA256
120e88ecd75a1d412f8fc007c8a34bf92d2eeb563d5203feef892513742e0b1b

SHA512
43b182e5ed55625c7055f5fd4385ce7aaef85210b1a7ccd679a3eaf267ae3acc26d9ec7e5342d66d66dbcf2e00f3b247ed9485108665858f373e414a5fb579ba

Download Submit
C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231.rar

Filesize
38.2MB

MD5
a669d89a16152133c9ffed93814b3dd7

SHA1
a9c274a108877a5659f0619dc21c3d24139859ca

SHA256
b12d3b7a3ad9eef1093daea9fe0790d2853b16ac8f6d6e394aa2c0b4024f2d6a

SHA512
512e70264dc644eee5414a90a05bdac9bf8f71b9a5bf85787e3664cbeb1432a42ac8abf14f5e7510b648420dfb0a846f5ea5c9d608ddc2139590dbe381e7d311

Download Submit
C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe

Filesize
6.8MB

MD5
1f25ee5abe606c4bc112466217476163

SHA1
6dd9adb510502f1ba9963421d48b55ec93eb976e

SHA256
9eaebc12b5bb46b9535cbdf34d4cfd38e6a83a54339f1f5e937a91421c26238b

SHA512
1780d284893ac9820a03031e68f672f631c25cc29c1c02daf53667c7b2cc668453d445118360d7fb3ece1cbd51c72b0f336424bb5ea0a3434a4bff77417e9437

Download Submit
C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe

Filesize
16.1MB

MD5
f1e5e7caeb84c7319cb034da4fc57ec3

SHA1
cde149c97e35e389ef655f50010c8427ece57a88

SHA256
c68cba452918f4ef2ee9113049ef9218e38fdbcb4228d79d03e1f93b88cd7d77

SHA512
0bc60a75580484d1762d04125f1309566fce11350057c59a345073f457ab6b0de3f2deb4dab347cf797a0071547a5c0d7dcbf54eab149bc21efbd9101006e6d1

Download Submit
C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe

Filesize
20.9MB

MD5
4a4f11993800b6ce188b8826f01c8154

SHA1
cc9bafe78b958958da7197e38be79b6e2c827276

SHA256
04715d02e05e9cf3771ba9be8b25e9d7adbf6298c1d357ef109c3b9a0245cae9

SHA512
df1da132f3d8574aed6f38d5183e7106679266cee1a912f34f7e97cad2062d3f37d4719c225a07c0843a512b90299f6daaad8a2a0b8878985efe46fbe15481a1

Download Submit
C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe

Filesize
74.2MB

MD5
61df622f550753a37d7deb0d0e851356

SHA1
684e347f2d77f7a13977f38cd8acdaae0ba4f828

SHA256
221b39a92076c4b7a2f6ce45908d98a49de2fa627fb833ed2e1f7bb032363352

SHA512
470b1dac52c0e1d8f978d8140bfc8123fde1422dcc5b8f56bde74da2ca38dd723492f5e124d160ea1e243df98d5aca2f3bdf633dbff4003d5b3ef5b7b9c3b4f4

Download Submit
C:\Users\Admin\Downloads\linstalIer2024!___Pswrd--1231\linstaIler2024!.exe

Filesize
14.3MB

MD5
de9bd6e7b03d28321a18ec70850e7638

SHA1
9f36f297ca9e6935f7844fda1a79c8c7a3ae695c

SHA256
fd55f0ed7279c34b088c7e3c3dab6bf6c757d162ab5067feede865eb896ace01

SHA512
4800d264f4e30df2b0b253beffc13d02f4d0b2768fd7966b56c00cb9b86edd6b946b3533f5e5d89435d49271fa59c9f4953f8711be79d8205065b03ca491c59b

Download Submit
\??\pipe\LOCAL\crashpad_1624_CUFCMERCQXZCYMZK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1408-987-0x00007FF6BFCE0000-0x00007FF6C47CE000-memory.dmp

Filesize
74.9MB

Download
memory/1408-1000-0x00007FF6BFCE0000-0x00007FF6C47CE000-memory.dmp

Filesize
74.9MB

Download
memory/2072-1029-0x00007FF6BFCE0000-0x00007FF6C47CE000-memory.dmp

Filesize
74.9MB

Download
memory/2072-1024-0x00007FF6BFCE0000-0x00007FF6C47CE000-memory.dmp

Filesize
74.9MB

Download
memory/2372-1012-0x00007FF6BFCE0000-0x00007FF6C47CE000-memory.dmp

Filesize
74.9MB

Download
memory/2372-995-0x00007FF6BFCE0000-0x00007FF6C47CE000-memory.dmp

Filesize
74.9MB

Download
memory/3092-1019-0x00007FF6BFCE0000-0x00007FF6C47CE000-memory.dmp

Filesize
74.9MB

Download
memory/3092-1020-0x00007FF6BFCE0000-0x00007FF6C47CE000-memory.dmp

Filesize
74.9MB

Download
memory/4916-1021-0x0000000000A70000-0x0000000000AE9000-memory.dmp

Filesize
484KB

Download
memory/4916-1016-0x0000000000A70000-0x0000000000AE9000-memory.dmp

Filesize
484KB

Download
memory/4916-1018-0x0000000000A70000-0x0000000000AE9000-memory.dmp

Filesize
484KB

Download
memory/5584-1025-0x0000000000170000-0x00000000001E9000-memory.dmp

Filesize
484KB

Download
memory/5584-1027-0x0000000000170000-0x00000000001E9000-memory.dmp

Filesize
484KB

Download
memory/5584-1028-0x0000000000170000-0x00000000001E9000-memory.dmp

Filesize
484KB

Download
memory/5584-1030-0x0000000000170000-0x00000000001E9000-memory.dmp

Filesize
484KB

Download
memory/5840-1004-0x00000000010C0000-0x00000000010C1000-memory.dmp

Filesize
4KB

Download
memory/5840-1003-0x0000000000F00000-0x0000000000F79000-memory.dmp

Filesize
484KB

Download
memory/5840-1001-0x0000000000F00000-0x0000000000F79000-memory.dmp

Filesize
484KB

Download
memory/5840-998-0x0000000000F00000-0x0000000000F79000-memory.dmp

Filesize
484KB

Download
memory/6060-1013-0x0000000000B60000-0x0000000000BD9000-memory.dmp

Filesize
484KB

Download
memory/6060-1010-0x0000000000B60000-0x0000000000BD9000-memory.dmp

Filesize
484KB

Download
memory/6060-1008-0x0000000000B60000-0x0000000000BD9000-memory.dmp

Filesize
484KB

Download
memory/6060-1011-0x0000000000B60000-0x0000000000BD9000-memory.dmp

Filesize
484KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads