74f20aa3be90484260777777ceb6caaebf2bcc59ff2b1e221ac71a7c03a62793

Analysis

max time kernel
390s
max time network
402s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LB3.exe
Size

146KB
MD5

d1fff29fe9d2e8bed2f6ea4472fbe477
SHA1

e3e5f4ab7935281b2aa0f56c7b1aec24423013cc
SHA256

74f20aa3be90484260777777ceb6caaebf2bcc59ff2b1e221ac71a7c03a62793
SHA512

f8d16e66b0d687868884de71a2bf0cb70fbc9725ead4c305370bc3550019c94a38ebe77e82b295b05326b039b8abfe9421d7c539ccce27b0854dea6a38e8c410
SSDEEP

3072:qqJogYkcSNm9V7DzIhvzO0/AbiFMPVPT:qq2kc4m9tDzMlAbi8

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

F5DA.tmp

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	F5DA.tmp

Deletes itself 1 IoCs

Processes:

F5DA.tmp

pid	Process
5448	F5DA.tmp

Executes dropped EXE 2 IoCs

Processes:

F5DA.tmpLB3Decryptor.exe

pid	Process
5448	F5DA.tmp
6588	LB3Decryptor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

LB3.exe

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini	LB3.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini	LB3.exe

Drops file in System32 directory 15 IoCs

Processes:

svchost.exeprintfilterpipelinesvc.exesplwow64.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\spool\PRINTERS\PP4j0bkyfuvcwbv0h4xxiem7t_b.TMP	printfilterpipelinesvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\spool\PRINTERS\PPcqsds0ne6vci6x85gqg143_1d.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PPctov6xumrsvd5s1y8_bwgfkb.TMP	printfilterpipelinesvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

LB3.exeLB3Decryptor.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\em5bwsECz.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\em5bwsECz.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\WallPaper	LB3Decryptor.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

F5DA.tmp

pid	Process
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeONENOTE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE

Modifies Control Panel 3 IoCs

evasion

Processes:

LB3.exeLB3Decryptor.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\WallpaperStyle = "10"	LB3.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop	LB3Decryptor.exe

Modifies registry class 3 IoCs

Processes:

msedge.exemspaint.exeOpenWith.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 909680.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
6116	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

ONENOTE.EXE

pid	Process
5316	ONENOTE.EXE
5316	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

LB3.exeONENOTE.EXEmsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeLB3Decryptor.exemspaint.exe

pid	Process
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
1288	LB3.exe
5316	ONENOTE.EXE
5316	ONENOTE.EXE
1196	msedge.exe
1196	msedge.exe
5096	msedge.exe
5096	msedge.exe
5768	identity_helper.exe
5768	identity_helper.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
1944	msedge.exe
1944	msedge.exe
6588	LB3Decryptor.exe
6588	LB3Decryptor.exe
468	mspaint.exe
468	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 53 IoCs

Processes:

msedge.exe

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: RenamesItself 26 IoCs

Processes:

F5DA.tmp

pid	Process
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp
5448	F5DA.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

LB3.exe

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeDebugPrivilege	1288	LB3.exe
Token: 36	1288	LB3.exe
Token: SeImpersonatePrivilege	1288	LB3.exe
Token: SeIncBasePriorityPrivilege	1288	LB3.exe
Token: SeIncreaseQuotaPrivilege	1288	LB3.exe
Token: 33	1288	LB3.exe
Token: SeManageVolumePrivilege	1288	LB3.exe
Token: SeProfSingleProcessPrivilege	1288	LB3.exe
Token: SeRestorePrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSystemProfilePrivilege	1288	LB3.exe
Token: SeTakeOwnershipPrivilege	1288	LB3.exe
Token: SeShutdownPrivilege	1288	LB3.exe
Token: SeDebugPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeBackupPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe
Token: SeSecurityPrivilege	1288	LB3.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

Processes:

ONENOTE.EXELB3Decryptor.exemspaint.exeOpenWith.exeOpenWith.exe

pid	Process
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
6588	LB3Decryptor.exe
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
5316	ONENOTE.EXE
468	mspaint.exe
6740	OpenWith.exe
1788	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

LB3.exeprintfilterpipelinesvc.exeF5DA.tmpmsedge.exe

description	pid	Process	procid_target
PID 1288 wrote to memory of 1424	1288	LB3.exe	89
PID 1288 wrote to memory of 1424	1288	LB3.exe	89
PID 5200 wrote to memory of 5316	5200	printfilterpipelinesvc.exe	93
PID 5200 wrote to memory of 5316	5200	printfilterpipelinesvc.exe	93
PID 1288 wrote to memory of 5448	1288	LB3.exe	94
PID 1288 wrote to memory of 5448	1288	LB3.exe	94
PID 1288 wrote to memory of 5448	1288	LB3.exe	94
PID 1288 wrote to memory of 5448	1288	LB3.exe	94
PID 5448 wrote to memory of 6104	5448	F5DA.tmp	99
PID 5448 wrote to memory of 6104	5448	F5DA.tmp	99
PID 5448 wrote to memory of 6104	5448	F5DA.tmp	99
PID 5096 wrote to memory of 4948	5096	msedge.exe	106
PID 5096 wrote to memory of 4948	5096	msedge.exe	106
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 416	5096	msedge.exe	107
PID 5096 wrote to memory of 1196	5096	msedge.exe	108
PID 5096 wrote to memory of 1196	5096	msedge.exe	108
PID 5096 wrote to memory of 2376	5096	msedge.exe	109
PID 5096 wrote to memory of 2376	5096	msedge.exe	109
PID 5096 wrote to memory of 2376	5096	msedge.exe	109
PID 5096 wrote to memory of 2376	5096	msedge.exe	109
PID 5096 wrote to memory of 2376	5096	msedge.exe	109
PID 5096 wrote to memory of 2376	5096	msedge.exe	109
PID 5096 wrote to memory of 2376	5096	msedge.exe	109
PID 5096 wrote to memory of 2376	5096	msedge.exe	109
PID 5096 wrote to memory of 2376	5096	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\LB3.exe
"C:\Users\Admin\AppData\Local\Temp\LB3.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:1424
- C:\ProgramData\F5DA.tmp
  "C:\ProgramData\F5DA.tmp"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F5DA.tmp >> NUL
    3⤵
    PID:6104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3976

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D24C245D-1416-4127-A8BD-B196D617EE41}.xps" 133650998911060000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6096

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\em5bwsECz.README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbed5446f8,0x7ffbed544708,0x7ffbed544718
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5608 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8124 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8252 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8380 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8648 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8780 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8912 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9412 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10056 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9952 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10364 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10552 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10564 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10840 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11120 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11132 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11336 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9512 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11644 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11612 /prefetch:1
  2⤵
  PID:6180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10840 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:7012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17275389945241825486,16721796194734171798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10816 /prefetch:1
  2⤵
  PID:7148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3800

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a8 0x3fc
1⤵
PID:5236

C:\Users\Admin\Downloads\LB3Decryptor.exe
"C:\Users\Admin\Downloads\LB3Decryptor.exe"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6588

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\DebugPush.jfif" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4364

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini

Filesize
129B

MD5
39082fdf4aa776e8a2e3619d300b4166

SHA1
06d937617356caa02f947b605b717cc62df61bef

SHA256
2480aeb3aa3c42c3a6793ed79ecdbf3d86b5e8b8fc917920ae6ece325e17e004

SHA512
564b904c9dff92725cdeb1eed7229cfc18907eb6e02ce6b0afcb5645be516cafd3723eeb4cd468ffe7c746e4336e74c3d7f93a05c84e9aa0b03828e5a59723ab

Download Submit
C:\ProgramData\F5DA.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Filesize
3.0MB

MD5
d1dd210d6b1312cb342b56d02bd5e651

SHA1
1e5f8def40bb0cb0f7156b9c2bab9efb49cfb699

SHA256
bbd05cf6097ac9b1f89ea29d2542c1b7b67ee46848393895f5a9e43fa1f621e5

SHA512
37a33d86aa47380aa21b17b41dfc8d04f464de7e71820900397436d0916e91b353f184cefe0ad16ae7902f0128aae786d78f14b58beee0c46d583cf1bfd557b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
60ead4145eb78b972baf6c6270ae6d72

SHA1
e71f4507bea5b518d9ee9fb2d523c5a11adea842

SHA256
b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7

SHA512
8cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
1024KB

MD5
4322f0449af173fb3994d2bef7ecb2e4

SHA1
b6ee5c6f76b8eee448f6b4b2b56fa1ec39653934

SHA256
0502e6e2f3fc54a30dea0eb07eb19a395c7ea6fc273321a49a4cc977a59b7cc9

SHA512
d8bae6131a5a8a1fcabb2d7efebc6cdbba27955fb77484a5d87dbce7a237c0cd5e19b74b4dad28312929ad732d3b80cf3d7f15f059c88438d0bc6ff9535ceeef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
250KB

MD5
7d91cac10b34cfc5b354498d7d3b572b

SHA1
ad1f861161f03a23cab6f8b479ee314b93ea23e4

SHA256
d2c3b66be289dabdc9868596c50e77973518b92e96f014d53b6638c07a0b7a38

SHA512
fd43a050e184c8069342f7d380eb1fcdb6663b42f1433c209b89947896121473cde9e8d2f0176f095351439b8ce01ab4dac92c05433ad23d911c6e6fd8a38597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d5e42077b85df235_0

Filesize
38KB

MD5
1f137e1951f09039f46b9b22f88c6a93

SHA1
74a26f583c5e10f10ad46311edd5544e0383de79

SHA256
8ae69f50600cc04c474065beccf06a9c4f04c576a7eee242b35f0620ea6e185c

SHA512
be7dfd4c152ec9daaf26c067d4d55789c7f18fdd6f5a5984bce750c016816f1a63d4357bb376c351b61dae7114b9fea5c85fb6df1949f34b98bf79c815c43f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
fe03819658c6e15556aa96a04b32629f

SHA1
a497bf46ebbe79fc5775365ce254ae3a95b19aba

SHA256
652508b7d803ef8322a82eb63c680e8c7aeedd467f859680976b01d32d80b0f2

SHA512
814604868bc884a32052410f1d6f1e4dd31c16d19cd10a11e81d14f7374ee55e64eba5640dc1104991e54808ca216a04d15134c0fd5e44c02e7b24274c6620cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1d6e24e50f2326e942b00ebd73a90ef4

SHA1
b1a4a1cbfcd5eb24df2a164e6c009933af02ca82

SHA256
cbf18e8a6c6d349422971bcb7602d28041624f849791d42d1433218d0a72967d

SHA512
aa8e7628a5549135930e53c17d69df71901154a013664731535d324139f35548cf2c60aea0c4ea0875d792b8fe4b837c919bb64e8eff8a6b289fbb3be2283611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
b4ef8d47228f3d834e312aeb5f2fda1e

SHA1
5ad069946455d3eb2bbc5339132352b427c796c7

SHA256
b31152019bbf91ee3df53c45ed8400142dbf606f45cb3751fb9e7d69eedfdd24

SHA512
275da990db5c7312dcdac2b0571a851760e558f0eae526f6dc3930e499628424231f28f0ce0003d2c04728faa0353d81c38c769bb0871cf64c26077ecc616320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
808B

MD5
7903b07450a164a4c20fd5d1b6583857

SHA1
3b2a367d6431060ffa8fb8fb7e600d73d0f1b9af

SHA256
7c6808276e848248aecfc4d7c11b21befc269399eb82bfb926333b7dcf4a197e

SHA512
9c8b75ef16f8badfd9de35d8749e167de328ddcb059e9f84b09d906540e293a95be18e0306984646f8c99647afea6c4e5adfd8fad7b095e42f35f0db42bc0177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
d6e16ccdd933735d867737a2db5ff1d7

SHA1
0449c967784192447c30ca5df8467b38ffe8f831

SHA256
008f3906ae54db56ed577192d62c22ecfae359f1a50dfd4972ee364b30768975

SHA512
b9f64d4098e06e3e9b18a65aecb441c300ef66393cdddea7eb8729cbf95321a3dec6848f46e8f65c5c0fcc7afab4ba7527153f46667c065d1792700edb6a02d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a495a992c40916a179cae3054b56ef73

SHA1
74588945e8e3b8e18fe1c9e2c36fa08777752af0

SHA256
21aa500c6b4b372443578e404c909b9bf18afae517dac3f473cbf99baaa99b68

SHA512
39377ac0361d46d12149ca09079ad25f0afa93613716003723b6aefddc729dad52c7ae976cb5d9bb882451a83866844abea808c6738ff361ab1d89e083412a09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf2b2061af97cb3685e607eb22df7383

SHA1
f6de946a5c5fbad849c50bc4bc7fba3e282ad0c0

SHA256
a8accfed7483697427d2f5ea740356706d75ac435d38224b2f09f908a7893069

SHA512
50814d4945908643a3e988a0728f57492a74694b974353a65e6025d8a6682bba2858713f1d1d045aa709fc7a4c49d7bed77ba8f906643d2100814664f8025009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68e043b4f316e30f11ee7c71f28e95a6

SHA1
3f8926db801dcb1583b0788037bc725a7b767a67

SHA256
961e565ea91075d29435b18414b11ef8458945ea9dd273cf1af68ce28706fb51

SHA512
b7e4a16be82940c68cded28d1ab7a2119dc4b6960dd160295e9f5ce4c7970b9ed770608ad47764caf8ce5c633c66380878aed49757f06b7794eeef8a45599e1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
e6d03750d0e27623e4e6d143eb9e8385

SHA1
06f681b96b880f84e912ffa671d7a8ba9df0a7db

SHA256
b665b2a7ad2fa130a9ba9a0ac09da26411b9e5df5276eccdd177218acea362e1

SHA512
848d5fd44fa89c54ea5ba717076eeca65f1d33e1b6d418815297a5e176264e770f3bc9c089cfb26925f69594f7443c79db004086f19489d7005b96d3e96d7916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
b844c8348d38a6b8b47d18397631b7d0

SHA1
ce8478b145b8d23b85a299bfe9912bd8d1be6595

SHA256
60d93331a49b3280eaf695afd962bcad11d680dace713ee957f42bfae10d3960

SHA512
a8a8c2bc60755c4660354dc60b4921cfd55b6cf59613f4904a38377dae5a93a89d52335bdb76c8f271c656d1a5089844b66b30b24c3b939a2a23a0ef5ae47260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1cb38a93ec8829e8bc4d0be7ad7470b2

SHA1
e58ffb2a4a7aacd7bfc23de7daa7ce4e41b40276

SHA256
3d648b262696f960907da915adaacc708b86052155449bb89bb2cfcf10a1386d

SHA512
59a541addf9d650a076a2d301e1a4a91393c882111f3350d3948f5e8dbd9486e51ee0b0bb2b717599a39c6cf64854ea4593b0fbdf9662c7f9e23d829d68fdbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56854eb2545446482868be2aa2c3d90b

SHA1
e03c35527d63ddeaf740f1be79606eafa3fd29fa

SHA256
3b5fdb8836a24a5302a87f73dbb9536c0bed6af998c2a8a3cc895e75b206e703

SHA512
1bf30082ba8db1ef448f515b2e27f6061f90c92836bffba1411dd3b55ab6746c5a8ce9f43599e2966c9c2aa7b2c2f4e141276f15db6308369928bbc9289bbc25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cda3a4337188a09a42639596c162f495

SHA1
1e863920cd385c9fb25f121364f83ac233fd6b69

SHA256
dc4b5a7b3c184b12d275cf5b03aa50a47b05b0688f173abb223bd79d5decd8b2

SHA512
bb5fe621892d3fc114852f7eaffe5d70eda44deafca7853975fc83863a8f7e8eb122b8c16ab1cfc4338f7f4bdb69f08464d90db132f4b8390066f554f87a2ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05ed8f3bac88770f42f2dbb16035e4e1

SHA1
d5e93666e676494702ca6261b6a51a666cc99c0a

SHA256
757356fc4559887218d47e140422b446c012e18c131662d187ce8e3fd59e2069

SHA512
2351649f320629af4c1b23b594ec5a7b4fa87d81022a065c772536776dc93f6af4fab927c1595ab0156ed320f34079f1ee9e5c90daa481cde6440f7aa39838be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c420d76485c8daee35502c61ccad4f5

SHA1
4dafbdf3de46b7ba2d49fb06e63b0f3af2af5e88

SHA256
a54528ccb291a8b07aa0e04829f20de13690385a1797929f417c6940966f0d07

SHA512
860820f6fc4b4d3f3c902d1c75ebd5d1d5ecf105bb62e6fef5e00a287eebbee2a6c716a6409821534a79eaca122e37580f0c6e5a1325596e2827a9d365a43d75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
e03c6b79b9635ff37061750d005243ea

SHA1
920044671720bfe8bc56db3783ea28bcd65dbc57

SHA256
c2dd2e144a9dc3a3336fc7c35dc63fdcb00e395d0ddf272fcfb1178ceca3d82d

SHA512
3183e0b9f4369da026ff04cd658dfc890ad4727cf5e134dc1f319dfd3a39f13acca725700b5b3d9d001cea8ba7c8ce70764d942805120b7f0c5e5199e485f91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a6ea0ee071485b21e66c9ce77e101a38

SHA1
b83a65555d5e08ccc123fa385968164f642f6395

SHA256
ec1d8396cc890c27a037e8fc876dfbbf75a6a8091bf925f4f75100059f396313

SHA512
a7233837c94b90203e6ba83b3948c00a215970b8621119bfd22cb1ab949483490e685aa89240165af65a5d55f09d8a551555e0c5d08cae100239a86a1dbbf304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
3e76e26e6704b97a854b0fe1be3ae267

SHA1
f1f4f361e017563a1a2a647ba5fe0aca53f3b609

SHA256
52de75bdd1876f6ecf3367d84b524bd49646b12797a9c2bc9e133f22cab30e40

SHA512
bc89810162e64b7da4aa6c6baefb6ef004566d48dead3bb42191fa17d802706d9c71936f94015d51fbdb17f16b1af2c0e112c124326188db718173d487b21c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
2cf6353ada665c1f8186ffee0caa0695

SHA1
920143474fe6f069cb9f7c2694b3f98aca3184b1

SHA256
43103d98960317525d5e0c6418277b57a20e7bdadf42a5cf7902e6bc7bf1b8c8

SHA512
a647f181a8c2beee2c8dba7107984be86b53bc3be6dfedd2284b408322c88759e1d6b55372d1fcd46d16f0266f52f873458c38be94a69c4528759b228797ce45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
71178df60ca3060b62dd9982d9f4b905

SHA1
648ae256c284fed47a29ec4a5d93a3168345cbce

SHA256
60e87f3642a23af0fea93c0220faaf7b7a5a39de89da5ae23a5a4a738fe0484d

SHA512
7198e304b66f0d3cec81360d0e06f33c7a1d8c4fa688ab903f475e2c45de01dca9eb9d1e666fbdd812f244c6f9370ce8cd23af21d46d3f26997d6667a712a453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
045850bec9aae45bd0a29f5942eba299

SHA1
392d5b9f8bd90cc1d36e3bd1c30a569551952a1b

SHA256
3d0c7e4444888f63fb2450535d8164d1728040d5f1d8fa6cfb1020e4955006df

SHA512
815c1c54cb7f226dc600c99123351678f5720e759941cf39f7d006eed777f8ce92613eb2baf51fbf52863d5a6788069a7b7a3579e4d9c1cf7ea90b38d1b9761f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
182d22d5ee0f2f6e089786fe1301bdfe

SHA1
665cf349b3da926f34d029c575b37baf8ba8b282

SHA256
7a63ad1e1b93cf85b692b456431f6674a1abcc8ef9294d55552ea5556af58deb

SHA512
2f0e0b0cad28af9911b426facc506c54dd5258af5de396f7f8aa88177b7eddd59331eeeb0910f741d42e884bf04408c5de74d35504120af52978fd13acb2cefe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
8f258531c8e86633b605418abc56acd9

SHA1
ef654b7e0a21435beb702a3c3531140499e10fb8

SHA256
f47b1c421eb91ba92e458196bb1f511c692081254390ef788a4738cc7459674f

SHA512
3018ce4db5e3714fec81701d491d2cf43162c3559cbbfcb61af02b705cda7d445aef11c5efc936af13b33c63ecc854def750f46938874507682d1a66294e6a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b34e7.TMP

Filesize
370B

MD5
d4c289faf14bb82202d91f64123c283d

SHA1
a01ab7b9bd0c0dd7660caaa1a1e3acc691d4c318

SHA256
d8a7243ad7dae9b573e1e756c3aace10a8cab3b61a70ed69e544b2107ebfd3c5

SHA512
6370f12861366cf60874cec423dbc8c22aa0b833e40a35b2e9d9d45a6a98de59a9d34b2b1db081e345387d1c80190c9eb587b09543282d6837c4fa7069e6ea44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a1efd0f5873c9d1c8e0ddc1821a8c5f3

SHA1
de5f0083b0dd2f2c99acfb6ac335c60e7588b237

SHA256
71efce8b40c888d7862db4f2269343f03d85e100bf2d63ee19c91099bce30045

SHA512
3943d1b0085020310e0c652faf3cdd4b205d7da6b988ef77884f931e4c3d22294109d66df340c8f21f2e367344bf782ed706a814c8da159cc4121117689cc550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
09809a12ea2bf2875ba03d621e8d585d

SHA1
ad508b858df3c4f13c99fb86302a3a1aab87e1a9

SHA256
1d4737be073508d32fa9f5ed0e7d3b73367f570f545af3811d3106ef4cbd73b2

SHA512
50ef23fd4ef69af69a903be3064afb877783f2aafeed9b25014945df1c287fd6545c5e264c57da209104b777e23d1a5871212d40c148ca2804e18cd208a339be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
da03bf511ad7df4670824f31624261ae

SHA1
f473bbd8c40475aa06236dea53ebe579539e3a14

SHA256
96220465bcd413e4317e98c86a0acd695069c64395784007124c5a0d055c053f

SHA512
10714dae7c6553b6fc7b210120b28a7fe76e163763974ac9e6aad4d968b40fd4ebddc66aac2baca440db5c76010ad372688c10528e43141af8e4f176b7a63073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
09f82b41943a10a192cbc84b91fdbb52

SHA1
e7dfd28dd76fdf8d82509c2e1ed8ab7d642bb326

SHA256
5b5f03adb2c4167da0eff631a7fad42c2ca43e09c717dd3c58bfb4577d982b0b

SHA512
95661cc7c136933a65224cf1e5a1eb5cee374008c8c7a082de3c5939bd4a0c9109d5df43b06c12f08db0e970bc7f3ad8e47663468c582a4932476ac56f1e0246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
91e7d76dbbf95e441a6a3a7f714c1ef6

SHA1
803bcdb4bfd808fd691ce5d2ed77aa27606220bc

SHA256
036d98962dd534235f4f013f4f37f27a4a1147b9e36975d0781c06b938e71426

SHA512
1982c108b09e1c00442573a1cb6fa346856eba3a8f9ae6186edd60975d9447eeb264fc4bf66c072e28fe6078cb1681a8e7acf4bacda4643aa4fb33c9c8764c42

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15-0

Filesize
36KB

MD5
0e2a09c8b94747fa78ec836b5711c0c0

SHA1
92495421ad887f27f53784c470884802797025ad

SHA256
0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

SHA512
61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msconfig_exe-0

Filesize
36KB

MD5
f29ba4c9e82e3ba6f79cb3383cb96f79

SHA1
f8082d87ac238c237627b132889c9cb223fbb262

SHA256
9e228359b717ec1507aaecfa380c6e8e24a810133f8e5bd11171e5f9cc905c84

SHA512
a33b9c6e094ba20e7085e42ced2de54bd74461575d581b859a36481ff8c65f7737d0ac52429bc9ead3ca67f197755c49f0ea0771d8606c7af8bab55d061f6f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEEEEEE

Filesize
146KB

MD5
dc6712f0a9e45791aa145b12aafa7282

SHA1
34c92ce976c926f0c16169aabf91c67e488b96f1

SHA256
61f61c57a2782624b6e9a45aea6e2cb00e417455f3a223246e9c3a9480182664

SHA512
dd984c6eb8fad3d8e8bf45d81655f3ada859c0309b9a7551e5feff3c21b07e9567fd72c14eeb4f943308e66cd32ba8200687b36bf16c9c3cb0acb8158df5dd8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Filesize
32KB

MD5
b7c14ec6110fa820ca6b65f5aec85911

SHA1
608eeb7488042453c9ca40f7e1398fc1a270f3f4

SHA256
fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb

SHA512
d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4cs2motb.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite

Filesize
48KB

MD5
71079c7b00045b70dc38c51789b3debc

SHA1
5b1772693e14f60f3d4f0460a170410a82368887

SHA256
464f31aa0f8b4b36970d421ca2829a22f6a8a9c2075ef86c2ab82ce9a3518f39

SHA512
75aa8787dedd06b5cb43588d43ec8c91b34d3581250e09c2d3c23a5d2457393e57e346d0e9e5632da636f4430e4fff6f36431b9ea7bd46b257ead8a3581a3b41

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 909680.crdownload

Filesize
54KB

MD5
6d51374e18923fd43524c47589ca2f54

SHA1
ff5105c7129f23dff1e1a71824d013fc4a3b6c6a

SHA256
90d09629f71a566fd5c52553caca77716d512a17992730b776509b19c319f874

SHA512
5f87bf43c888ebdfed128b83d9e7642f78ef6d583fc88051d0ddabce66eae39c6079193425a27707bef23aba81f69dcf1849b78112ace26c50d7bc2383337d0c

Download Submit
C:\em5bwsECz.README.txt

Filesize
28B

MD5
9056ab0f27b2bea7a26db97d14bfe025

SHA1
5336b4e12f809109d3c4b0f5f2c19258df7a378e

SHA256
d6e2312fe11d1c0a9b958d97a6a8ef51e83dbbb89d847d1a01c9b4ace05f26dc

SHA512
3efa13f50b3b1f0d495b80ff32a8ba851e280e2337193111ec42256e758d4291df056364391b24842b67e89b7dee6a7bf964d5d7837eeab51b9e3c188af846f5

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3419463127-3903270268-2580331543-1000\DDDDDDDDDDD

Filesize
129B

MD5
53baf057a123752d30227f014add8786

SHA1
b53f8301968cdf68f8499a6cf3d9800280b56264

SHA256
91e6f6b640b9f99cea6917a3dbfafa1e47c3efa1e9fa11d3c04eb3f2edc19b7f

SHA512
9109320bf218a6e7535beb4270f87aad689680f101b5f41f9f2b8ce820e500df4330c435367c578aebc2faea2ec85b6f247286ed33b29750d0afea5e9ba040dd

Download Submit
\??\pipe\LOCAL\crashpad_5096_ADFMDANHJSKEPNZP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1288-0-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/1288-1-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/1288-2-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/4364-4046-0x0000020E72230000-0x0000020E72231000-memory.dmp

Filesize
4KB

Download
memory/4364-4052-0x0000020E722D0000-0x0000020E722D1000-memory.dmp

Filesize
4KB

Download
memory/4364-4044-0x0000020E721B0000-0x0000020E721B1000-memory.dmp

Filesize
4KB

Download
memory/4364-4037-0x0000020E69570000-0x0000020E69580000-memory.dmp

Filesize
64KB

Download
memory/4364-4048-0x0000020E72230000-0x0000020E72231000-memory.dmp

Filesize
4KB

Download
memory/4364-4049-0x0000020E722C0000-0x0000020E722C1000-memory.dmp

Filesize
4KB

Download
memory/4364-4050-0x0000020E722C0000-0x0000020E722C1000-memory.dmp

Filesize
4KB

Download
memory/4364-4051-0x0000020E722D0000-0x0000020E722D1000-memory.dmp

Filesize
4KB

Download
memory/5316-2799-0x00007FFBCADF0000-0x00007FFBCAE00000-memory.dmp

Filesize
64KB

Download
memory/5316-2800-0x00007FFBCADF0000-0x00007FFBCAE00000-memory.dmp

Filesize
64KB

Download
memory/5316-2798-0x00007FFBCADF0000-0x00007FFBCAE00000-memory.dmp

Filesize
64KB

Download
memory/5316-2802-0x00007FFBCADF0000-0x00007FFBCAE00000-memory.dmp

Filesize
64KB

Download
memory/5316-2801-0x00007FFBCADF0000-0x00007FFBCAE00000-memory.dmp

Filesize
64KB

Download
memory/5316-4131-0x00007FFBCADF0000-0x00007FFBCAE00000-memory.dmp

Filesize
64KB

Download
memory/5316-4133-0x00007FFBCADF0000-0x00007FFBCAE00000-memory.dmp

Filesize
64KB

Download
memory/5316-4134-0x00007FFBCADF0000-0x00007FFBCAE00000-memory.dmp

Filesize
64KB

Download
memory/5316-4132-0x00007FFBCADF0000-0x00007FFBCAE00000-memory.dmp

Filesize
64KB

Download
memory/5316-2835-0x00007FFBC8C30000-0x00007FFBC8C40000-memory.dmp

Filesize
64KB

Download
memory/5316-2836-0x00007FFBC8C30000-0x00007FFBC8C40000-memory.dmp

Filesize
64KB

Download