Malware Analysis Report

2024-08-06 15:22

Sample ID 240520-qh282acf8y
Target https://download1510.mediafire.com/7xh1iwhnefsgFMOAMlRJHc7UxyZLh5B9iQTsUls5Hih7-h5ffMxA5z7k0V5y5iRtV0qhy9qFNVIqahJart6-j07_zTwQJI0pssc5PEr_9J2O3vI3kcP4urmi9vd1wZ_efW2EW17eXZzeh3YfQe-hGJh675hrzMM4mFLQE7pbGbhmXZI/jxfvbr368ajrrw8/AHAH.exe
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://download1510.mediafire.com/7xh1iwhnefsgFMOAMlRJHc7UxyZLh5B9iQTsUls5Hih7-h5ffMxA5z7k0V5y5iRtV0qhy9qFNVIqahJart6-j07_zTwQJI0pssc5PEr_9J2O3vI3kcP4urmi9vd1wZ_efW2EW17eXZzeh3YfQe-hGJh675hrzMM4mFLQE7pbGbhmXZI/jxfvbr368ajrrw8/AHAH.exe was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Downloads MZ/PE file

Executes dropped EXE

Checks whether UAC is enabled

Adds Run key to start application

Drops file in Program Files directory

Suspicious behavior: GetForegroundWindowSpam

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-20 13:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-20 13:16

Reported

2024-05-20 13:25

Platform

win10v2004-20240426-en

Max time kernel

505s

Max time network

502s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download1510.mediafire.com/7xh1iwhnefsgFMOAMlRJHc7UxyZLh5B9iQTsUls5Hih7-h5ffMxA5z7k0V5y5iRtV0qhy9qFNVIqahJart6-j07_zTwQJI0pssc5PEr_9J2O3vI3kcP4urmi9vd1wZ_efW2EW17eXZzeh3YfQe-hGJh675hrzMM4mFLQE7pbGbhmXZI/jxfvbr368ajrrw8/AHAH.exe

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisvc.exe" C:\Users\Admin\Downloads\AHAH.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\Downloads\AHAH.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DPI Service\dpisvc.exe C:\Users\Admin\Downloads\AHAH.exe N/A
File opened for modification C:\Program Files (x86)\DPI Service\dpisvc.exe C:\Users\Admin\Downloads\AHAH.exe N/A
File created C:\Program Files (x86)\DPI Service\dpisvc.exe\:SmartScreen:$DATA C:\Users\Admin\Downloads\AHAH.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 582933.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files (x86)\DPI Service\dpisvc.exe\:SmartScreen:$DATA C:\Users\Admin\Downloads\AHAH.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\AHAH.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\AHAH.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2576 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 1372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4880 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4880 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2576 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download1510.mediafire.com/7xh1iwhnefsgFMOAMlRJHc7UxyZLh5B9iQTsUls5Hih7-h5ffMxA5z7k0V5y5iRtV0qhy9qFNVIqahJart6-j07_zTwQJI0pssc5PEr_9J2O3vI3kcP4urmi9vd1wZ_efW2EW17eXZzeh3YfQe-hGJh675hrzMM4mFLQE7pbGbhmXZI/jxfvbr368ajrrw8/AHAH.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa270646f8,0x7ffa27064708,0x7ffa27064718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5960 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6484 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 /prefetch:8

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Users\Admin\Downloads\AHAH.exe

"C:\Users\Admin\Downloads\AHAH.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 download1510.mediafire.com udp
US 205.196.123.198:443 download1510.mediafire.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 198.123.196.205.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.121:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 121.61.62.23.in-addr.arpa udp
NL 23.62.61.121:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
N/A 127.0.0.1:4567 tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
US 8.8.8.8:53 ratting.myftp.biz udp
N/A 192.168.1.103:4567 ratting.myftp.biz tcp
N/A 127.0.0.1:4567 tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

\??\pipe\LOCAL\crashpad_2576_OKJQUIVVKDOBXHXZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c5fa8ae0f00e4fce5b982e020361064b
SHA1 054d0cc65d36b57de5f505e6c6fcb829c13c0983
SHA256 ffe0ecd370f1ab10a4f9d2ab77c61d00395f3eb6ac0d5f98066ea7b20e7d201d
SHA512 d0ace1d790abfcfe949f2d01f196b85b0cbef4d21001b82145c63ee319ff1947e0af09f0ff93cb5b8422d594330eef6e7f6ed05825036b858951267fec922b2b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fae9c344d24ccaab1356bf6826924e55
SHA1 8843a376e85a0624faeca305e83195bc0d5b6356
SHA256 2c5429784c372f874fcd8666a80f6ab4aa74609af032642bf2f5eed098c96dbe
SHA512 d12c7975f521eec40c1de124f045f42f58a3756a5852765ab6a15fd7a3797bf680f24ec66c4cf1b7a9dacc3e4818d7d9444b65ca4e980f7e464c171df5f9f2de

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5e63adf041eb2fbafab65837eb513bc4
SHA1 582caa40e36ebbafdd46ac9ca615fc19f3447c86
SHA256 687abbaa18f89c3c569df63255e3c95a7288ba3a9cbe30be71eb50128544e234
SHA512 adecb9d27a07f497451aead467ae4eaf38dec2948a8bf0af02d8713ca0e841c7ac8e6a808922b3df0924be90c20a851133d68da175ed656205d2ba9bb7ee1c1e

C:\Users\Admin\Downloads\AHAH.exe

MD5 9d15078abcfd87ee3c6c33b0b3f4f883
SHA1 9b95fd18c4efd8b2e9fa43b9f6138f60f6c845c9
SHA256 9e6491c1915787cc010228c0df2f351299babe7f90cc08a3469fb7daa59ff351
SHA512 5cf3d302dea32b30138185cac7b0484f50febdc9bc27daab76385a1b7deec1a28316398f03afbbb19f8c54c7a9ea6d4f9eedc5cd48be14807ae8bfdb3342d4dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 941d31b327a96873822150c9e1881464
SHA1 11c1696152e524733b72dc26250f58a97b86e2b7
SHA256 7f37c5b31411ed7e69365b8c541751a43250f379f156ef785371db69524584a0
SHA512 69f84976d6c81fc1850c0a5fba823ed44bbe76559e3035d46b163eced241580009d238188bf826a0b637a6ba2d62071943aeedfe597b5959e73d234416b31328

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\AHAH.exe.log

MD5 5b4789d01bb4d7483b71e1a35bce6a8b
SHA1 de083f2131c9a763c0d1810c97a38732146cffbf
SHA256 e248cef9500ed6e0c9f99d72a2a6a36955a5f0cfc0725748ef25a733cc8282f6
SHA512 357e18ef30430e4b9cc4f2569b9735b1cd12f934c83162e4de78ac29ba9703b63ddb624ccc22afd5a5868f6e9d91a3c64581846abac22e9625f5b2e3d80b3ede

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0cfde4298df97dcb876d2472a931fcbb
SHA1 3e48ff0d4ae56beb26ec25dfb88921f501ccdab1
SHA256 aa218efe97cf5898287d53703de70c20e836f0022fb4aaf1741f5844e9de0009
SHA512 097a4b49c88bad676d6fd3223125e64aa3d2d43ebbcff22ef07fc6c321686cf88f56bd41c1cd4a4887797007f6b1d476d41b35799970054ea9a2f8a05d96bfbb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b18ad8860d17b419c8f6acff98f29fa5
SHA1 625231669109e9c5dd0cb962adc0f29bdcab223d
SHA256 a0b5473aafc70986d8875f91236497fdc35df7a5fcebd7174abdec3756831ecd
SHA512 416558b62a92da636a9281d3c775847906b73bf2fd88186e918d9b06b1bdb3b873a29fdcdeaf4d2b775783756c1dbb05a0a6711b12f437c33a40022657af548a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 bbd1a85d0a5635517d0edcaffac1741f
SHA1 5522dd8ee1d6f97241d348c8a03175defe085fad
SHA256 22d4c245a4ddb203dad0fd97e5a64f837da72abc9384cf8fa4e5235b054af999
SHA512 738af923a7639ccd360389e80c6c90763902080f8c2487a641e87c4587e172053308cd1958136230d2d128934736da98dbcb8fd56d302a3b05dc8bb07f00cd3f

memory/1044-204-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

memory/1044-206-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

memory/1044-205-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

memory/1044-210-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

memory/1044-216-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

memory/1044-215-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

memory/1044-214-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

memory/1044-213-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

memory/1044-212-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

memory/1044-211-0x000001C2388F0000-0x000001C2388F1000-memory.dmp