cab43de74702f11eee7a9913a355863b17ebba7f5eb051120bc9fce8aafd117c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Combo Minecraft/SLAYER Leecher v0.5/SLAYER Leecher v0.5 By X-SLAYER.exe
Size 1.8MB
Sample240820-dfry3athmq
SHA256 3eba607f97a148578a200cde9631e1524c05ce6e25bf6ab6cb4aef818fd08037
MD5 9541fbd3065b66523a64971c06985124
SHA1 ca38cd7eb3b90b1a6acf9eb6a85f8aae2044a0d3
SHA512 11a6405277022f80b011063259f9e2fd4d68daad145fc3166e8c7383091472178e62a06bd5f77aa1583345b1ed9cb511484e28f27c8ab53dd0e0e7c27e91427f
SSDEEP 24576:ZnsJ39LyjbJkQFMhmC+6GD9dZ+IA3qv19gf0fMmwG800J2Gjfk22b4ZqqqqSqqqq:ZnsHyjtk2MYC5GDt+IA3qvv60dZsk2s
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery macro persistence

Malware Config

Signatures

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral14/files/0x00020000000229ad-220.dat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	SLAYER Leecher v0.5 By X-SLAYER.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 3 IoCs

pid	Process
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
4576	Synaptics.exe
1476	._cache_Synaptics.exe

Loads dropped DLL 2 IoCs

pid	Process
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	SLAYER Leecher v0.5 By X-SLAYER.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
24	pastebin.com
22	pastebin.com
23	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SLAYER Leecher v0.5 By X-SLAYER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SLAYER Leecher v0.5 By X-SLAYER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1408	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1476	._cache_Synaptics.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	._cache_Synaptics.exe
Token: SeDebugPrivilege	1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1660	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1476	._cache_Synaptics.exe
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1660	2420	SLAYER Leecher v0.5 By X-SLAYER.exe	87
PID 2420 wrote to memory of 1660	2420	SLAYER Leecher v0.5 By X-SLAYER.exe	87
PID 2420 wrote to memory of 1660	2420	SLAYER Leecher v0.5 By X-SLAYER.exe	87
PID 2420 wrote to memory of 4576	2420	SLAYER Leecher v0.5 By X-SLAYER.exe	88
PID 2420 wrote to memory of 4576	2420	SLAYER Leecher v0.5 By X-SLAYER.exe	88
PID 2420 wrote to memory of 4576	2420	SLAYER Leecher v0.5 By X-SLAYER.exe	88
PID 4576 wrote to memory of 1476	4576	Synaptics.exe	89
PID 4576 wrote to memory of 1476	4576	Synaptics.exe	89
PID 4576 wrote to memory of 1476	4576	Synaptics.exe	89
PID 1476 wrote to memory of 1064	1476	._cache_Synaptics.exe	96
PID 1476 wrote to memory of 1064	1476	._cache_Synaptics.exe	96
PID 1064 wrote to memory of 3480	1064	msedge.exe	97
PID 1064 wrote to memory of 3480	1064	msedge.exe	97
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 3276	1064	msedge.exe	98
PID 1064 wrote to memory of 448	1064	msedge.exe	99
PID 1064 wrote to memory of 448	1064	msedge.exe	99
PID 1064 wrote to memory of 1376	1064	msedge.exe	100
PID 1064 wrote to memory of 1376	1064	msedge.exe	100
PID 1064 wrote to memory of 1376	1064	msedge.exe	100
PID 1064 wrote to memory of 1376	1064	msedge.exe	100
PID 1064 wrote to memory of 1376	1064	msedge.exe	100
PID 1064 wrote to memory of 1376	1064	msedge.exe	100
PID 1064 wrote to memory of 1376	1064	msedge.exe	100
PID 1064 wrote to memory of 1376	1064	msedge.exe	100
PID 1064 wrote to memory of 1376	1064	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\Combo Minecraft\SLAYER Leecher v0.5\SLAYER Leecher v0.5 By X-SLAYER.exe
"C:\Users\Admin\AppData\Local\Temp\Combo Minecraft\SLAYER Leecher v0.5\SLAYER Leecher v0.5 By X-SLAYER.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\Combo Minecraft\SLAYER Leecher v0.5\._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
  "C:\Users\Admin\AppData\Local\Temp\Combo Minecraft\SLAYER Leecher v0.5\._cache_SLAYER Leecher v0.5 By X-SLAYER.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://exe.io/pdbKe5M
    3⤵
    PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa72c146f8,0x7ffa72c14708,0x7ffa72c14718
      4⤵
      PID:2992
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Combo Minecraft\SLAYER Leecher v0.5\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\Combo Minecraft\SLAYER Leecher v0.5\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://exe.io/pdbKe5M
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa72c146f8,0x7ffa72c14708,0x7ffa72c14718
        5⤵
        
        PID:3480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
        5⤵
        
        PID:3276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
        5⤵
        
        PID:448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
        5⤵
        
        PID:1376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:1572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
        5⤵
        
        PID:1972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
        5⤵
        
        PID:216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:4248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
        5⤵
        
        PID:4420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
        5⤵
        
        PID:5440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
        5⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
        5⤵
        
        PID:5744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
        5⤵
        
        PID:5840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
        5⤵
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
        5⤵
        
        PID:5980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
        5⤵
        
        PID:5148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
        5⤵
        
        PID:5156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
        5⤵
        
        PID:5172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
        5⤵
        
        PID:6108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
        5⤵
        
        PID:4336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
        5⤵
        
        PID:1652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
        5⤵
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
        5⤵
        
        PID:5448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7444 /prefetch:1
        5⤵
        
        PID:4764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:1
        5⤵
        
        PID:5676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7744 /prefetch:1
        5⤵
        
        PID:6060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7964 /prefetch:1
        5⤵
        
        PID:5916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8068 /prefetch:1
        5⤵
        
        PID:5936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7804 /prefetch:1
        5⤵
        
        PID:6276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
        5⤵
        
        PID:6560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
        5⤵
        
        PID:6568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
        5⤵
        
        PID:6576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
        5⤵
        
        PID:6588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
        5⤵
        
        PID:6600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
        5⤵
        
        PID:6912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9244 /prefetch:8
        5⤵
        
        PID:7084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9244 /prefetch:8
        5⤵
        
        PID:6124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9080 /prefetch:1
        5⤵
        
        PID:6136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9060 /prefetch:1
        5⤵
        
        PID:5688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9016 /prefetch:1
        5⤵
        
        PID:4572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8268 /prefetch:1
        5⤵
        
        PID:2304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8088 /prefetch:1
        5⤵
        
        PID:2944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8184 /prefetch:1
        5⤵
        
        PID:6044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
        5⤵
        
        PID:1392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9624 /prefetch:1
        5⤵
        
        PID:6336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9644 /prefetch:1
        5⤵
        
        PID:6364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9868 /prefetch:1
        5⤵
        
        PID:6552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9840 /prefetch:1
        5⤵
        
        PID:7080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10144 /prefetch:1
        5⤵
        
        PID:7084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10372 /prefetch:1
        5⤵
        
        PID:7272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:1
        5⤵
        
        PID:7344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8936 /prefetch:1
        5⤵
        
        PID:7712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9752 /prefetch:1
        5⤵
        
        PID:7720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,13159859113875533663,16935377286636406032,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
        5⤵
        
        PID:3032

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 1.8MB
SHA256 3eba607f97a148578a200cde9631e1524c05ce6e25bf6ab6cb4aef818fd08037
MD5 9541fbd3065b66523a64971c06985124
SHA1 ca38cd7eb3b90b1a6acf9eb6a85f8aae2044a0d3
SHA512 11a6405277022f80b011063259f9e2fd4d68daad145fc3166e8c7383091472178e62a06bd5f77aa1583345b1ed9cb511484e28f27c8ab53dd0e0e7c27e91427f
SSDEEP 24576:ZnsJ39LyjbJkQFMhmC+6GD9dZ+IA3qv19gf0fMmwG800J2Gjfk22b4ZqqqqSqqqq:ZnsHyjtk2MYC5GDt+IA3qvv60dZsk2s
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
MD5 27304926d60324abe74d7a4b571c35ea
SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
MD5 9e3fc58a8fb86c93d19e1500b873ef6f
SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 65KB
SHA256 d06259809775d9c8c8c20af6b46ae901ad948d4c2447c13001bd84eee8e670d2
MD5 8e9f530fe4bbee2adc88d279031f94c3
SHA1 29a3627ba78ef23127bea090c3e5da5fee8a911f
SHA512 7b526ce6a1e5857b6b381ddbc1de5756d6ce2d7146e78c15dcc3b26c1f9fa8eaa3751a4d221e56f6a9b5f97dcfb622390d3b0bfd06ec30365b34394b749bc1b8
SSDEEP 768:Z/Og+wvSFYlLAhO7igQ9/NsRWD7Wj32z5wdlmPZAMn4K7gTPdV4ppnRDklWDcQ+b:hjl0aQxNj7WgydlmSEcLd6jtkWbb6Taq
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 20KB
SHA256 5c5ee973f8a7a4ae986ed5ba927bdde89183b3c804b897e840413c0ea557a939
MD5 5768930335946c689d36d117d9daa82d
SHA1 1073cee66ac042dbc6beddc2d87297ff86756b01
SHA512 be43ab5d18547683ac9ab51a60dfed24e5cd31cfa90d39ebc96ceaaa71b0f18379cdd79dfac5500f49c64f43a5d9f055ea203a29898fe1777b523d84c8ac28bf
SSDEEP 384:dxkW2UntDYr8uIZfAP89fqUpVm/oMPy5tU8+FJ1A5NOX1D9:8WrnUfUAE9fqmEQu31A5NOlD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Size 23KB
SHA256 36db07c8425e87d41c6b4c7d0387629e1b246e03e0856b1e7b6c57873b12f389
MD5 11599e9c15800ca9f908997b8aa72d40
SHA1 a5972723266946d7d12e4b497a10a41dacd69175
SHA512 351f0c42e8a0936c91ca5c21ccbd89d0353148a40b78690d23393dbbaa10c7bf8d0b84ce2d67a8d94ed99ff82e4e0ecdd07c48689fa7f9aef350dc47884c64ed
SSDEEP 384:y6BbtMiaC7RUL4LQLN6V9EuXxbWPOUPRC3f5aWbTSuGWBIfdcipkwQHIGeF6bGbx:LB2iaCNU00LN6QiSvPRcaWCVWBvIkwQA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 27KB
SHA256 1f9c006e426f89d13e2ad5550f1eb29e85fa4595b31086be29cd9adb3cbdc960
MD5 4efb9aa5385421fc5899f9e7abf7e8cb
SHA1 2572cbd83a21ce01f315c126505f20f5e52da704
SHA512 e4ac6b0b72ffaab0dac276a764e6bfd7c78cb07024adfedaf0542a88515ca57bbcaa6c679dcf0f221f2da4840f25aedc08cb0a68146e181cf776b959b5463d07
SSDEEP 768:30Ta6+4mg2PrWqKVpl995tMYgMzcqpJ5G:30uCHr5tMUcyJ5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Size 30KB
SHA256 774379647c0a6db04a0c2662be757a730c20f13b4c03fe0b12d43c0f09e7a059
MD5 6fb26b39d8dcf2f09ef8aebb8a5ffe23
SHA1 578cac24c947a6d24bc05a6aa305756dd70e9ac3
SHA512 c40f4771c10add1b20efb81ee3b61fc5ede4701587f29a1c2cdde8b6faabd1c76d769bf8b99aa19082012f95d99ba448a472463fb9056acd2e43542e14e605cd
SSDEEP 768:Is7tXGJM1cJWj8NHTFJeG/KrXAFOkGGgP1dihj3MNCs92WZWk:Is7pcJrhJeSpgP/itDe2WP
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 123a2ec68679a1861c2dea850433b5ff29b6b54985553fc94a8ce72effc2a4b3
MD5 4a1d37560993ef6d234082a8a874c21c
SHA1 daed2c3caf9058d3cda48300476200048fefbbc6
SHA512 a134f331a011a672c69b28e854159c30832d9b80149702f3118ee9f44027d2ffbc1387fd1e4f6876e03e05a0eded386f8a8447f7e0cdd76010e7b3e73f9ba58c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 4129f653d90559c6e0cc1b94381f3dd5ef7f3c989b55964486cdd5d367c893ab
MD5 12aba8b44d6a4d17bb31948b4fd59a34
SHA1 2929949d3f5bc13443ce7141cde2ef8cfa11c453
SHA512 2554f856b0301371a117dd4d15672834b8ad1138daa85eb3e897112cba18636d3e84f08103dad2a714d96174a82d865e009a6aea4610bc426cfc499876a0ae6a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 7KB
SHA256 644ceb51cbe99519abcaf5be63dad7436375acb887ff0166b069c32d5893d3f3
MD5 0c976cab598e6f575aaae06399275d15
SHA1 b860020af49a23c79ea867f1c077cbd76828d077
SHA512 ae2de6152d8a3158f9e65634fcc7361e6b0fd7d212817c87ef331ca43cf384d6c0620b667357cc3f3235dbba45ac0898c90c8e5ad0feaabf4aeb61d530cde20c
SSDEEP 192:kTO/2INYzyZo/ux6d3UmlCWp9tS06W6joLTDeLScUw+6f4OMZp6XSJlODWvUrlfy:AyrNYzyZo/ux6d3UmlCWp9tS06W6joL5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 46249d0422ccf8212c01a247e5f6d3cb831237129a0afb7c97d4aef7a9168712
MD5 2bdf4edc358455e71cf25b9dc06564ef
SHA1 196a547662716d1354d99476f637a42ae437105e
SHA512 2d998862e08ccd88324a6d1397f2d7c7298544eb7652402579a04fbfca9eb889e9742fa85267a93a5dd87f4112c4a7265de4f40b6bd37ffe7870535cb1daed33
SSDEEP 96:nak/o416NbHpwpvWMoiVmdeH4piNanUWQyV+VDCziEwb:nak/hQNzpGWMX4konro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 11ad29fdb3b832a19b990d32cb354def4055f72717a674594f6843afde369ec0
MD5 6d2692797f12f96e1fbc78be9a8cf5e0
SHA1 902a1024b12cd61516bce2854422a85828a14ed8
SHA512 080024504774e3121075b14e8afc53134184fbb633e4dd208f83d252de1d6632d8a6e8683b1df347e923623e6dafe78c8adb38a7aa5f7f205d27c325f320d449
SSDEEP 192:nak/JQNvgGWMmY8okQ6oIALKHDnnWajvtT0sWmYs46Aw+LP3vvG8fNx4kh0Urg:nakQNv9W35+HogUkh0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 d844d6888870ca096adba6c2370b4c65a3a97d93bfe1216516b90f67d0636fbe
MD5 50bd23b04564e7f66733e38828e7a42b
SHA1 b575a96aba58a8f33ad2402a586de7b38b489573
SHA512 cfc88649456b90790bb1eed09d4711c0c8e0f3a8dca82c58f8cfa17322bf3594b37592ea29fd4b0c52b9cbe1bb984dff1498484ab95899c8e0573a32518f21b8
SSDEEP 192:nak/JQNzgGWMmY8okALb0nWaT0sWm6AwLdLONx4kh0UrV:nakQNz9W3ont7tkh0k
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 cbcb6b82593cf146b434ad28794e492975ddb21d69fdc3fb8d9e9c77b7385c26
MD5 7a4ece8014fe0336c95e890a111098f6
SHA1 8e0f9917d9501c7107f9bfd70845d3fc8cfbf2ae
SHA512 a1a5c9bf7a03a005b7a6e975913d477f2d5c4c11da5899b9290952790720b2abb15ddd6e9a50de1b9473384cb9320117e308f2b34c5df8a792a81b2b1a587aa2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 0de3b1eb954b1eeba0ced60925b71779eb59a648a08a9cfb226f560ae551cdcf
MD5 b2467c23604d7ec8ac81caeef6080692
SHA1 4ade385c281b13ba0648e0be513bec192f75dfe5
SHA512 6f4857f1d0405ea2582fda4acd30f2d3ee495185e7a0e0392347b9fa0e5d8c73b36477b20dd1bc63f720789426b91c75b00294fe7c1bbaf0289ae27355543c8f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 ab7330197b9ce61e18110f0208679200ee687cfc3bd258e254a903662a246fb4
MD5 aaddad796422c5a5e27546aafaa13553
SHA1 e72bb22e4b91f5e1c3fce2e28e1788fb90efa465
SHA512 407d521a3c9f16241a29c7206ba09ccdb483743be664bade1b6a183b710d4b861108ccd818b7d5f4090fc84a581ef18a6c8b2e6c855012aaef2e99e119ad2366
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 1bfcd06cb6d4883fa1fc93ff3459eb456e4753f444eea0223c4e5c9ad8f2b7a9
MD5 417d0cd37b550e0497cfdcdf0d706795
SHA1 85fb88c43a09dde2c8eb82fb834e50f1c610a327
SHA512 a15e78827b5709bf844fafd163b7a44f902553e78dae9421bfe7800c2f0ccbf0886a48061358b4a685ee84693a844a7e1846adbcf49c2a5063c7e82489d848ec
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 c9a81f3cff13571ec0106df40e8d459c625cbc1c1921d090f5d6bc221ec14570
MD5 afed60ad532ce3d1bf38843a4a9e3b30
SHA1 7b0cf894a08760d15052d40490d90d47bbbdedcd
SHA512 3ddff26fab886774240763e44a769e3b7d68c6bd4dc9ba8679e98568a892e7b209ae03809cff0df01a7349dd54e1036f46dd1fa906d2d67294ff685992bff388
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 6af3a1ac02e1b44def09a9b8127cacabc5a584adc9611a95a0d9c574eacb132d
MD5 7404276a88ae2851f8f92a249dc31edc
SHA1 8ce9050fa9b8098e1a1b65270b3eef676edb1375
SHA512 e37cb4ca7d094354e07056c331cf21ddc4f3798f2a7cde3e95966d28124f4ef2d7799672c4a8c6741a27d3a451e3c1f0490da328e64a29984c31e925f609196a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 aa198edad11873847ca0acec9fed2754fbbdfee4aba5ac97f32b6ce9dd00a756
MD5 56cd57ac105a19adee41a5908fb5e695
SHA1 0952f1256f8b3d05d54292f71c6adaab9ccaddbf
SHA512 3034f6669829992af3b199413796f8459af76ae3dd22e627bd8781baec56c3c1de1321ae3b370f863733c566caba12e859ce5006f99fa50459e0cd62dec1ce7f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5806a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5806a2.TMP
Size 2KB
SHA256 6eabedb772d46567f8c31375bcd3bde1f503f42df4d075dd1c482f779a8961dc
MD5 84d7e6602457025be04ce9f2999cd357
SHA1 a33d57fb36f6ae37ad5490e54737fcb0ce633315
SHA512 f1ef641e21bf8b6f5990652596857e2cc9a67f4b0fab0c6224b70e7fe84e130190fd329944b5ffd97e73ebf9bd1e6669cfe4e3bcec68ee2f611fa8143429fb08
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8c825f9022599593a027770100911af5df95f3cc3ffd27de182e810c8e713ba0
MD5 395f8e57fdd155336a193f1c9e959d5b
SHA1 40e7a3654ffe3cba2f371f1095a6ee7c3da4e4ad
SHA512 f704707efe7079f54e60d61ccdfbdc26b6bb188171f57c796fa45888389cf7a66f7c3e50e5cfa024395d789bad9825f0f0d652cc681e09bc427deef042f51757
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEue2RUHJSH8oru8z8ZJgjI:A9iIxuERzA83h09RZxYEwgJZoPz8YjI
MD5 SHA1 SHA512 SSDEEP

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 275fe07dc8af98bee9aa1ea7699c5c101f6f1836b9658f5483223a0fe26ac3b4
MD5 9da814ad9818a650e6946ac879f1f7b4
SHA1 e85396a76d88976ed2fd361d0af93a6c1efd4c80
SHA512 886fdb6c4f94c0fe49f8c63cfbf6636710fa1ac2c090afb04028301162603977eb29136cf9e432a7fd7b6b7711b6fe6e0b710e57d4cea438367f0458662b54e9
MD5 SHA1 SHA512

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 65398d9badcb464d5f9acab3d673278b43f8cd9ddff138f28dd7ea7f0b7ac917
MD5 433d81573ebf459f6f84ce0c05dbc7f9
SHA1 21be293fd2211d592c708faaf7afc763f8ea75e1
SHA512 35421347d3d68a15e10dac67d9b11cda22ed061476d2ee8d350a8b9940553abce2022023f5d8b92fa8aee7fe9c0c3c07f55fb83d8998e248db3f62d1376d2d54
MD5 SHA1 SHA512

Submit Download

ssapihook.dll

Path C:\Users\Admin\AppData\Local\SkinSoft\VisualStyler\2.3.5.0\x86\ssapihook.dll
Size 57KB
SHA256 a99ea2f5759b34859b484afa3a58ce82a7f3bf792886a6c838db852d517d9c0d
MD5 d7f644c06b4cde60651d02aed6b4174d
SHA1 ae1c05821dcccb3280c7a9cbf4ce8d00d1eb680f
SHA512 db0b5dfb1b99fba61c8d9b883813747b37485fd5acc3091c5a5d5fcf0e3f2bd9b091a8bcb4f200a1fdeea00e2e62a9573b2d653bd6f8878ba321fefdfec2f384
SSDEEP 768:az0LpgOe5IIKmLlBowppQANmP/N5BsbtJT:u0l/m3oAd2BsbtJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_SLAYER Leecher v0.5 By X-SLAYER.exe

Path C:\Users\Admin\AppData\Local\Temp\Combo Minecraft\SLAYER Leecher v0.5\._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
Size 1.1MB
SHA256 54ba0c1fb0e81fa1f796531ae506fd184dea10628ab9f35ab9066df86b43c3a6
MD5 b6d2a0e9584d3f7ae696ac83fc94713e
SHA1 46c8381de688107919d2658c996ee3d0a03fffae
SHA512 53fa6d888a0dda49d4b62402f5f1086b52ae67e9d4e18a03eb5cb8ea0b107fc87dfec2f965dbde464c02f6bec48972860a1cdb78c9067e1d9d2e7adc4820c645
SSDEEP 24576:XZ+IA3qv19gf0fMmwG800J2Gjfk22b4ZqqqqSqqqqqqLqq/qqAZl:J+IA3qvv60dZsk2
MD5 SHA1 SHA512 SSDEEP

Submit Download

irBu9C8u.xlsm

Path C:\Users\Admin\AppData\Local\Temp\irBu9C8u.xlsm
Size 22KB
SHA256 17ceb036cd755fb0858e35b5037ecc14a8bd65b44723d1970b34f800def9176c
MD5 e222d30c324c2338734d6b510f866c4d
SHA1 edb369d3b6bfe859b75812361e0470dcb51d5101
SHA512 6a07c32c25eb4c1a8a4ad3b03a4fc1d1f6fd8feef8ce842890dd3397aeb910b31caae483ebe5e0d2cea9d26f008f578539a0cf8f826b8db316878f604f72e4c9
SSDEEP 384:MgkcXTAdp+o5b5xna7VaKbj9PdvrlvPpnmIXUlPkW0:MgkcX04o5b5N6VPbpxZvhnmllMW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

irBu9C8u.xlsm

Path C:\Users\Admin\AppData\Local\Temp\irBu9C8u.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1408-146-0x00007FFA57260000-0x00007FFA57270000-memory.dmp

Download

memory/1408-138-0x00007FFA59B70000-0x00007FFA59B80000-memory.dmp

Download

memory/1408-140-0x00007FFA59B70000-0x00007FFA59B80000-memory.dmp

Download

memory/1408-147-0x00007FFA57260000-0x00007FFA57270000-memory.dmp

Download

memory/1408-141-0x00007FFA59B70000-0x00007FFA59B80000-memory.dmp

Download

memory/1408-142-0x00007FFA59B70000-0x00007FFA59B80000-memory.dmp

Download

memory/1408-139-0x00007FFA59B70000-0x00007FFA59B80000-memory.dmp

Download

memory/1660-144-0x0000000005B10000-0x0000000005B66000-memory.dmp

Download

memory/1660-182-0x0000000000050000-0x0000000000051000-memory.dmp

Download

memory/1660-207-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/1660-201-0x00000000000E0000-0x00000000000E1000-memory.dmp

Download

memory/1660-205-0x0000000000100000-0x0000000000101000-memory.dmp

Download

memory/1660-199-0x00000000000D0000-0x00000000000D1000-memory.dmp

Download

memory/1660-197-0x00000000000C0000-0x00000000000C1000-memory.dmp

Download

memory/1660-195-0x00000000000B0000-0x00000000000B1000-memory.dmp

Download

memory/1660-193-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download

memory/1660-191-0x0000000000090000-0x0000000000091000-memory.dmp

Download

memory/1660-189-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/1660-265-0x00000000721EE000-0x00000000721EF000-memory.dmp

Download

memory/1660-59-0x00000000721EE000-0x00000000721EF000-memory.dmp

Download

memory/1660-268-0x0000000005870000-0x0000000005880000-memory.dmp

Download

memory/1660-69-0x0000000000C90000-0x0000000000DAA000-memory.dmp

Download

memory/1660-187-0x0000000000070000-0x0000000000071000-memory.dmp

Download

memory/1660-184-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/1660-203-0x00000000000F0000-0x00000000000F1000-memory.dmp

Download

memory/1660-180-0x0000000000040000-0x0000000000041000-memory.dmp

Download

memory/1660-178-0x0000000000030000-0x0000000000031000-memory.dmp

Download

memory/1660-175-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/1660-167-0x0000000000010000-0x0000000000011000-memory.dmp

Download

memory/1660-148-0x0000000006100000-0x00000000061F8000-memory.dmp

Download

memory/1660-145-0x0000000005AE0000-0x0000000005B04000-memory.dmp

Download

memory/1660-123-0x0000000007AD0000-0x0000000007BD6000-memory.dmp

Download

memory/1660-143-0x00000000058C0000-0x00000000058CA000-memory.dmp

Download

memory/1660-134-0x0000000005920000-0x00000000059B2000-memory.dmp

Download

memory/1660-127-0x000000000A4D0000-0x000000000AA74000-memory.dmp

Download

memory/1660-125-0x0000000009E80000-0x0000000009F1C000-memory.dmp

Download

memory/1660-124-0x0000000005870000-0x0000000005880000-memory.dmp

Download

memory/2420-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/2420-70-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4576-692-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4576-74-0x0000000000770000-0x0000000000771000-memory.dmp

Download

memory/4576-267-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4576-266-0x0000000000770000-0x0000000000771000-memory.dmp

Download