Malware Analysis Report

2024-09-11 12:58

Sample ID 240612-bzxmjsxhkl
Target 71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569
SHA256 71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569

Threat Level: Known bad

The file 71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Modifies firewall policy service

Sality

UAC bypass

Windows security bypass

Windows security modification

UPX packed file

Enumerates connected drives

Checks whether UAC is enabled

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

System policy modification

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Enumerates system info in registry

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Modify Registry
T1112
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-12 01:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 01:35

Reported

2024-06-12 01:38

Platform

win7-20240508-en

Max time kernel

122s

Max time network

122s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17EE6381-285C-11EF-BAE0-E64BF8A7A69F} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000056136390ea8cb28bac35d00b5857d2d2f4cb6aae1f1e33d80ac96627a6a57232000000000e80000000020000200000007499c820db18653be6bab1a7338aea422033c616f60d8eaf80e0eaaffd0e4f542000000053c4bf456cf013843345faab905319045b9bd998977ba90af07e4310bc04e646400000000c82db8bbe5a4785eb78f6ba3688ec850458cac8e2ddb2f93a9ddf7e0c64be098173294e0a10521793d8b235306b720b81a3b1a899e26efba3829d10b50073b6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424318038" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000036aa8c25b5280d541ac92fcf45a333b28ab7c594c038f164079008da074f5f7000000000e800000000200002000000093a3022f3edf58f0e910618f1ac9c1dab5d25afb54e41084e725a06b88bbc47290000000f3e101acfa7d0cad11114caa0c5ada5aed7e364f8b01369ca457d714f648fe6420e822c33f8d5c6c652f7d2990b66aafe6ab566015fb5fa093a018d4aff5c7818b02a5cb4aac8b3864ed9fbb3788e67844a474f80849c7262de6ce11735f0058d980b2e0662f9e3f86c9dbeef73691f71e8f21a10598ad91d5e25c8cd10f63c7cf3af11dee54f3f2f2496ce18cda1d46400000008e8bc9c3a5083f4eae176b77b920a5361dd11b643d5537ec0541a2fd0aa384afac21064df662b6938a701a3d8b327eea6a752c4138320921eb1f911f2b57117b C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d9f0fa68bcda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2284 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\taskhost.exe
PID 2284 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\Dwm.exe
PID 2284 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\DllHost.exe
PID 2284 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\taskhost.exe
PID 2284 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\Dwm.exe
PID 2284 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\DllHost.exe
PID 2284 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2284 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2284 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2284 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2704 wrote to memory of 1736 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2704 wrote to memory of 1736 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2704 wrote to memory of 1736 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2704 wrote to memory of 1736 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe

"C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://suggest.se.360.cn/sedoctor?ctype=se&cversion=

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl.360safe.com udp
US 8.8.8.8:53 suggest.se.360.cn udp
US 8.8.8.8:53 suggest.se.360.cn udp
US 8.8.8.8:53 suggest.se.360.cn udp

Files

memory/2284-0-0x0000000000400000-0x000000000050D000-memory.dmp

memory/2284-7-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-1-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-4-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-6-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-8-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-3-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-5-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-27-0x00000000035F0000-0x00000000035F2000-memory.dmp

memory/2284-26-0x00000000035F0000-0x00000000035F2000-memory.dmp

memory/2284-10-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-25-0x0000000003600000-0x0000000003601000-memory.dmp

memory/2284-23-0x0000000003600000-0x0000000003601000-memory.dmp

memory/2284-22-0x00000000035F0000-0x00000000035F2000-memory.dmp

memory/1064-14-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/2284-13-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

memory/2284-9-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-11-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-12-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-28-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-30-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-29-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-32-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-33-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-34-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-36-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-38-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-40-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-43-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-51-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-52-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-55-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-57-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-59-0x00000000035F0000-0x00000000035F2000-memory.dmp

memory/2284-61-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/2284-76-0x0000000000400000-0x000000000050D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 01:35

Reported

2024-06-12 01:38

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

150s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4952 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\fontdrvhost.exe
PID 4952 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\fontdrvhost.exe
PID 4952 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\dwm.exe
PID 4952 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\sihost.exe
PID 4952 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\svchost.exe
PID 4952 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\taskhostw.exe
PID 4952 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\Explorer.EXE
PID 4952 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\svchost.exe
PID 4952 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\DllHost.exe
PID 4952 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4952 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\System32\RuntimeBroker.exe
PID 4952 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4952 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\System32\RuntimeBroker.exe
PID 4952 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4952 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\System32\RuntimeBroker.exe
PID 4952 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4952 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\fontdrvhost.exe
PID 4952 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\fontdrvhost.exe
PID 4952 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\dwm.exe
PID 4952 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\sihost.exe
PID 4952 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\svchost.exe
PID 4952 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\taskhostw.exe
PID 4952 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\Explorer.EXE
PID 4952 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\svchost.exe
PID 4952 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\system32\DllHost.exe
PID 4952 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4952 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\System32\RuntimeBroker.exe
PID 4952 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4952 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\System32\RuntimeBroker.exe
PID 4952 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4952 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\System32\RuntimeBroker.exe
PID 4952 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\System32\RuntimeBroker.exe
PID 4952 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Windows\System32\RuntimeBroker.exe
PID 4952 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4952 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 4268 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 4268 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4108 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe

"C:\Users\Admin\AppData\Local\Temp\71fcf815c587a6b46b67c86351fb36b7ee60d85ff2430372ae3608424bf9d569.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://suggest.se.360.cn/sedoctor?ctype=se&cversion=

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b7bf46f8,0x7ff9b7bf4708,0x7ff9b7bf4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4552 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,783823314406090551,13644229292850447353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl.360safe.com udp
US 8.8.8.8:53 suggest.se.360.cn udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.4.4:53 google.com udp
US 8.8.8.8:53 suggest.se.360.cn udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 suggest.se.360.cn udp
US 8.8.8.8:53 suggest.se.360.cn udp

Files

memory/4952-0-0x0000000000400000-0x000000000050D000-memory.dmp

memory/4952-1-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-3-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-5-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-9-0x0000000003A80000-0x0000000003A81000-memory.dmp

memory/4952-16-0x0000000004340000-0x0000000004341000-memory.dmp

memory/4952-10-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-7-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-14-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-13-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-15-0x0000000003A30000-0x0000000003A32000-memory.dmp

memory/4952-12-0x0000000003A30000-0x0000000003A32000-memory.dmp

memory/4952-11-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-8-0x0000000003A30000-0x0000000003A32000-memory.dmp

memory/4952-6-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-18-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-17-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-19-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-20-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-21-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-23-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-24-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-25-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-27-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-28-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-29-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-31-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-34-0x0000000002610000-0x000000000369E000-memory.dmp

memory/4952-54-0x0000000000400000-0x000000000050D000-memory.dmp

memory/4952-45-0x0000000003A30000-0x0000000003A32000-memory.dmp

memory/4952-40-0x0000000002610000-0x000000000369E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_4108_ZOVSHJDDDYBPWHNQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a6c4e3f-7156-4bd2-99c3-3d6b4274b993.tmp

MD5 b902108e5a0456697c9189855d8fd1fe
SHA1 f3e3bd4008814591d12e477c7d5d1d313cf9fd45
SHA256 6cd930756fea86ef9effb8facbcbb0d1794629775522fb6b4eb58a86647bf463
SHA512 d0b33ac133af2710cfe1259c1453b415c32a5751ca55738839a33bc58925d265cd7ab03125753bf040e85fe3f5aaca66fa42d684675ddf4acbbfdb2ec68cda43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0e685c1b13b46ecd44a966ce184fdabf
SHA1 f9f1658cc8e46f7826f39d144227bc9de3317895
SHA256 d89ae4151a926ee6637aeeadb8b8d24e0191a6dcbe11fe74f69c9d4204f45a2e
SHA512 3382b9598a80f9f43d47baa7e90c985b9aea4be387715b6b1a2fa3c3c2bad2d0785546c28b4110327f0f71c408c910ab49ad3c90aa65c322854e58739abfc4aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 eeb14dbb9d234ee955b487ef6a1b13f4
SHA1 89c9170d58578c9424bfdd1e098048de0c86326d
SHA256 05d58e935d181dbcb2e2af0860a5e8b8c21df67dd260e20a8714b3447e28adbe
SHA512 5ed005f116beabc0afe215ece04d701b205c70a2a079f04f46d947bb22bdd7b4d22bbf65eae0f6ae79fc9d98d6014ffdf3b66467dc77f31ad879d22aabd04874