lockbit | hxxp://vxvault[.]net

Resubmissions

26-09-2024 23:30

240926-3g9myawfra 6

02-09-2024 13:04

240902-qa9cda1apn 10

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02-09-2024 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://vxvault.net

Score

10^/10

lockbit defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000100000002aa56-112.dat	family_lockbit

Renames multiple (609) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

Processes:

lk.exe7904.tmp

pid	Process
1720	lk.exe
5624	7904.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

lk.exe

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2842058299-443432012-2465494467-1000\desktop.ini	lk.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2842058299-443432012-2465494467-1000\desktop.ini	lk.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 4 IoCs

Processes:

splwow64.exeprintfilterpipelinesvc.exe

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PPfyiumf0d4b9xynzuo0ufm3r1c.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PP_v07f1ciacncprxk_z2y1ce1d.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PP_8l1_pjfvj1r20tfxjr81_8ld.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

lk.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\XQk8iLzOQ.bmp"	lk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\XQk8iLzOQ.bmp"	lk.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

lk.exe7904.tmp

pid	Process
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
5624	7904.tmp

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\lk.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

lk.exe7904.tmpcmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7904.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeONENOTE.EXEmsedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

lk.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Control Panel\Desktop	lk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\Control Panel\Desktop\WallpaperStyle = "10"	lk.exe

Modifies registry class 5 IoCs

Processes:

lk.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.XQk8iLzOQ	lk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.XQk8iLzOQ\ = "XQk8iLzOQ"	lk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XQk8iLzOQ\DefaultIcon	lk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XQk8iLzOQ	lk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XQk8iLzOQ\DefaultIcon\ = "C:\\ProgramData\\XQk8iLzOQ.ico"	lk.exe

NTFS ADS 3 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 425175.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\lk.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 337763.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
5696	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

ONENOTE.EXE

pid	Process
5644	ONENOTE.EXE
5644	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exelk.exe

pid	Process
2384	msedge.exe
2384	msedge.exe
1680	msedge.exe
1680	msedge.exe
4172	msedge.exe
4172	msedge.exe
1416	identity_helper.exe
1416	identity_helper.exe
408	msedge.exe
408	msedge.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe
1720	lk.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

Processes:

msedge.exemsedge.exe

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

lk.exe

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeDebugPrivilege	1720	lk.exe
Token: 36	1720	lk.exe
Token: SeImpersonatePrivilege	1720	lk.exe
Token: SeIncBasePriorityPrivilege	1720	lk.exe
Token: SeIncreaseQuotaPrivilege	1720	lk.exe
Token: 33	1720	lk.exe
Token: SeManageVolumePrivilege	1720	lk.exe
Token: SeProfSingleProcessPrivilege	1720	lk.exe
Token: SeRestorePrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSystemProfilePrivilege	1720	lk.exe
Token: SeTakeOwnershipPrivilege	1720	lk.exe
Token: SeShutdownPrivilege	1720	lk.exe
Token: SeDebugPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeBackupPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe
Token: SeSecurityPrivilege	1720	lk.exe

Suspicious use of FindShellTrayWindow 49 IoCs

Processes:

msedge.exemsedge.exe

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

Processes:

msedge.exemsedge.exe

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

ONENOTE.EXE

pid	Process
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE
5644	ONENOTE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 1680 wrote to memory of 660	1680	msedge.exe	78
PID 1680 wrote to memory of 660	1680	msedge.exe	78
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 4996	1680	msedge.exe	79
PID 1680 wrote to memory of 2384	1680	msedge.exe	80
PID 1680 wrote to memory of 2384	1680	msedge.exe	80
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81
PID 1680 wrote to memory of 448	1680	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vxvault.net
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff98e393cb8,0x7ff98e393cc8,0x7ff98e393cd8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Users\Admin\Downloads\lk.exe
  "C:\Users\Admin\Downloads\lk.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    - Drops file in System32 directory
    PID:5512
- - C:\ProgramData\7904.tmp
    "C:\ProgramData\7904.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:5624
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7904.tmp >> NUL
      4⤵
      System Location Discovery: System Language Discovery
      PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2676325696559266320,15561758564856668987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:5576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5284

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
PID:5468
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{902ACC3D-6197-4A5C-8693-9F7E8102FFD1}.xps" 133697559343420000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5644

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\XQk8iLzOQ.README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff98e393cb8,0x7ff98e393cc8,0x7ff98e393cd8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1648 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1836,6782522686505501533,5116361688861192278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:5620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2842058299-443432012-2465494467-1000\FFFFFFFFFFF

Filesize
129B

MD5
04053b3e47aec36721c5f22389bf869c

SHA1
b3bedff070f79c96cf4935cd55e71a07d1ae3ddc

SHA256
41a8d302e89bbdf11aca3cb78677793ba4d8e16308d1dd4581a0d1b729a16f8e

SHA512
97634c3b3f855fb6e838e7a3eafdb4358825e65e8348ae79c30a65a6c1b5cd4b7b80c5a0cba480dd0ad1009828ddfc5829cbe89c5c73e5099588624efdf5e560

Download Submit
C:\ProgramData\7904.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
97b82be3d614175461bf6b739b6586e7

SHA1
23d48790752050fb6580c253362d1fb2aa6226e6

SHA256
9517924c43468fe523fd3fe14c27ac98ca2ccc5acca58d9e165fbca2a4169c7d

SHA512
de7d0f55b53aba1e88b5a896b99e84aa6524fc3bab0921581fac9a5015231653a22cf80bb73c1ab0609389009e99f857b4163f975d1ccc9813a457c5342afb32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
c58b67f60e42a9509a28cf5c5f0afc21

SHA1
be8810d1eeff9e288844cf24f5e82ccb3a3abd9e

SHA256
a09011e2aa09d7813a3719a19898737cf5573df652ef781ee430e6c488d8bf02

SHA512
85fa00dc4eb8070204974623492e831f6f4b3b66345976f6da08e2c7604d7c7257ec2119d9be933651f80c5d3cef74780ce6fe0cd33a6b5979448fe9448d461d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d38d409c439358235df022da623113c1

SHA1
a25b0d09ff07a81605a2dbc1e7d8ced71aeb6067

SHA256
0c34a5d3399e0045c26f40a354b2fc9fb1ddd4dfd4a4a6e43b35c26ef667c437

SHA512
58ec2c3f392241e7ab3267686aef8c24edd9ad6de432a69a4413a1d4001b7ed2f06282adab287069fa93ddc9566beced20682e7db4c5b8b1a0c08593a0862163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be4bc74c6ab677526533473b5d3b2b0e

SHA1
5ab32a4f05e2e01a5f9f4d5b1b07ed1f046f457a

SHA256
1184987c66d705bf4b4c21d72a5d62e38ca8482c8d737a1a6399de3aca54a485

SHA512
219d5e635b6d30b5804db26cdd146b737f66cddf6a38eb49242daa15ce8dadb8120a90e7dcbc344e421f92451b2b4734005624a9e40c62497b0ba845ab5225e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b7332cdc7e2b6edfad1d42da91e3b37

SHA1
8f89b09511e6ea97796cf1015280e5d9c906bb5c

SHA256
a05470e882e51dc2953903bb09006daea568a8c75a51b7ca6f2b814d7ba8eb33

SHA512
850c69db6e1dfcbca93e616be48fd25c07f66fb8d66f77d849cef7b0995d1fe47a2485f44b4a9e7e283bdf36a36a7ae7cf6a8bb9675989484e20b70822f76201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57b7c99daa7a62bcae0afecab3eecbe2

SHA1
907abd8d73737eba32577a9f4b5f63fa2677c744

SHA256
cba9b97bb3090baa4fbafa2c30fb853838f943cb56abc123e8d6f1722bd8d8d2

SHA512
53fa8b40f9ea6649d59780f7868973f81b92d2673e494037bc0dbfa78274cde3127b7c8c79c671fe2477af0361c60ec1e9fe8979e097156395957ec5fcf59556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef972467117bbe0e64ea77f7de45bc1f

SHA1
7277f9b3ba4d9754cd991ec6484b7930b994b2eb

SHA256
7984cd798b758945de8430266c565cd101f0db24997492c26cbb9a44c4be46a3

SHA512
8c96bb5639e6fc77de16f7cde4c17c99ac877804426b3b63b098ecb91168f59a0535023f1dd53034121a98cb351bc40629fa05a098ac1006d783ac720a03964a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a33e8bf48cce2334f8750ec5180c8818

SHA1
ce7c767cc81292ea58891e1e747549f102a954da

SHA256
917d19046dfe47c90bb42a79157fb5df841899c0cc32168cc77b8fea32a3c84f

SHA512
a4dba40322fc011a48e69778111f37958ab23c0f4d5a79c757c739ebd6dd7864405751f45c5ef746ed7d32cd8d8ac195f8f590bdec03a97fa247c05d403cd90a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a59003b96f0acc8db7a6ff1e992252b

SHA1
876e1af6c8459f72f6b596b0d416c0c2ec1ec0b6

SHA256
4840fa8423a7c6d5d02d409d5d14d498366f8c79a8b3aebe937a4f8fac65824b

SHA512
43540d2731376220f75bbf21e55413f69d0835846e79c17abb9f67cfa931431585db5739bd9d26890ef57dd5621baad89651ae669ee7d1212655f9b203d77493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83f350c6af1dfff10e2b514c6039a714

SHA1
eb59ea889bbfefdd5c6aba55b7d5cc7a103ff4e1

SHA256
3048a9b14041fca171417979d1c0ebe051cf7341dc052cdb1d113f5990542c06

SHA512
4f77d32b17e7bc9ba1e3c9c714f8b97448b1bb04cdde0c2c2d11faecb769fe76166834b5323760b25ad189dfe1bf6b60158075328504a0d49389e3cd94e34b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7925bf94bb2801d5c286707985c18123

SHA1
741aa705021468b3ccb81d01f8cc64fb76f10798

SHA256
99fac606cab31e0411e687bfdcc55b4431c0212ea0b88bcc5393cfdafa0d6838

SHA512
b403093fc7b61f563a71465d6faef58f18cb51fd07affed25f7280e264cea1b76df87c585eecac162208aeffe9651452ba0af41ffe635247023f92f865ecec46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc6a7acb207f549a3357f754f15b5492

SHA1
25d9f747883df8844e7e9c481c483ef0e654ca8c

SHA256
a86c8c9e39f6699e176ac4324cca066770d6eae23eee78d6361dd49872261af8

SHA512
e7b8800cd499bcc7dd55000f4c6b38d1598cc030917582624b4eb552949d41c493981542a16128df98f652592cb42e4812dd865227858b3f11c3db9ad9a1d0cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
86dc4771345dc641af1bb85c6235bdf5

SHA1
9ded7267419ace428d05429eef5b67d26e056d84

SHA256
6d4b12ddc82e55c481d7d3d8a372fa021aab8d48a201aaa569c6cb14b0b5b1fb

SHA512
ebae9fd63c6ce5a1db5a46b62c848a98debacf9a820f12ddaee327ffb49f70def00b11765cd584dbcaeac17837ccc96914c47b172d063941964575a8d3ad49ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f5cae0737d6c9922cb80e37f62a8d58

SHA1
ae120238e557e6078a73a690ace781c70c68ad1a

SHA256
d5f402bb16d8d40c30050e6e1405b83d835ae70c12b719384081d9ecf39f0f33

SHA512
0cbbed0dc2e15de5a9b74d6a2db95a80c472aed3f0a9fb6f6f2e00ae956c81c7291eb63cddd628637cfeff3cbdb1393734bbdbbbcbfb27af1d340c2eb88d690b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ba2ce516c9519bb48c2366c8107da962

SHA1
406f2d3e919c766d346ecdc136415c50e47e9e74

SHA256
89c3aaf40d71f0f127f82901421abd06783c2376222dcc7d95ce54e4d8a3dd5d

SHA512
f1cec1a90c2b23884d250ea24be9a8dc29a256a0bfbe7e39e853d77e6daba1a8c8f10c72f071b5d4601758b05d8b588000395212a549d5b2ba9ee45dab393afd

Download Submit
C:\Users\Admin\Desktop\OptimizeStep.zip.XQk8iLzOQ

Filesize
141KB

MD5
018677adf7a0f17604bda0f16234757d

SHA1
673963659de3300b853ab873c32f181d25eb5a95

SHA256
a87405b3b461116215c5d4eb093658ca6d54a9b9ef6c28f1c62b10d90e8c9131

SHA512
9599b2cd6c512454fc879fbb7571acf26066c70345240e7649114a71d9925c3722374e3dff01fc0442339b65fda8217c3210cef4d693180f57fc7d872ce40bba

Download Submit
C:\Users\Admin\Desktop\ProtectRevoke.vdw.XQk8iLzOQ

Filesize
269KB

MD5
24faabeef42a5f56c2f5d79ca1f286cd

SHA1
cd3f4d3d20278ad7f54d0c2e149b286571efd8aa

SHA256
ab4966f7faa81bc3bc35f2bf869df4b929f1decb86ac7c1c2c1da7e5f2f8d809

SHA512
b24a8194a30d148262610aaf2ee1897b6234556b70f2d1323e5231a752787bba3aa85206658c9e96012e09fdb773a743fd2da8a5aa654733f6dcc80dcc380937

Download Submit
C:\Users\Admin\Desktop\PublishDismount.cmd

Filesize
153KB

MD5
85a4ce9eccd1119688b8509bf9946896

SHA1
50d87d4448d3feb0ebd84ed19bf45cbea1d48db5

SHA256
52a8687b8b72c54ee7457fda5e3bc7954efa5adcad7c8f3f1aaa442a164ba58e

SHA512
bda6129e457ad8c488ac64c5d5cd979d580fac29771a77612da3bc019aaebbcccbf4ce0286898d987752c6a845ddc137b2458c10d312d2b514b112aec55625ef

Download Submit
C:\Users\Admin\Desktop\ReadJoin.docx.XQk8iLzOQ

Filesize
18KB

MD5
17cb31e8d48b9eb5d7d970153f1f41e7

SHA1
39335b7fa28e854b3807410e4bb7062cbff8cdfa

SHA256
376f51d4d53b2f093c1857e40e1f1e63b535d1102791d1022b2338b0a1c2d394

SHA512
e3724bcfe4887d0ec22f06a7307f45f0ebe3fa4ce822c94e9a65cae6986c35277b4b9740388123333367a53c7ea84afbf4400eded19844334550a6277c81b94a

Download Submit
C:\Users\Admin\Desktop\RestoreResize.xlsx.XQk8iLzOQ

Filesize
11KB

MD5
7bbeb9857856aa57994ce2ee6e3ad7e6

SHA1
7a01a3a55f57b78680e9af34b077e2e00176bc59

SHA256
0d1a2c5c223ba21f47598dc7d17cd1fd196a0702847acab308c66df9b613ba49

SHA512
10f9f50460e6158ed5a5a70f3d2d125ef37708f0ed26c46f6a06c6abdf25f34fc2f42b794c538c060f3b3c9f34e9df715792bcdd0eba5425396edf99339e5541

Download Submit
C:\Users\Admin\Desktop\RevokeExport.iso.XQk8iLzOQ

Filesize
358KB

MD5
0e0d2b4fc7818846dc18515854ae765a

SHA1
6e583dd4295c6c17b7c56c7ef2778a01cacd8d0c

SHA256
4772c8af3efa6904d42c3a7cb32dc5411c19e8e4bdbae64e247e630d550ec153

SHA512
a10edcb5753013938927683475078f0207e4b9c2865f537891457cdd801e5d0b0bb73418c0494d91f71c513f9785f806165c547741b4030a668932235632b9d4

Download Submit
C:\Users\Admin\Desktop\SearchStep.docx.XQk8iLzOQ

Filesize
14KB

MD5
57132c2eb2293c8f33f9e21e720ea883

SHA1
c48990d5765f80bbb836ef30682d26771180f046

SHA256
e799ef42d9bad406e31ad584ec34740cd8ceb16791c7340d9b8829c85a515be8

SHA512
f58323b527f843808542660f0b9cb058b1d171a77d500d7501d8428ebb461842f96680a0cae36e840761da91ce1f052ef2dbe03f1678738cf774381441a1a095

Download Submit
C:\Users\Admin\Desktop\SwitchPush.3gpp.XQk8iLzOQ

Filesize
179KB

MD5
8b3c9a9fba5f5f925f1d66ac9f23da91

SHA1
4bcbd76123915a2875981bbf5b92df3c27818d65

SHA256
b83f33c7fea1809246d5df03359e32c3ccd431374b0dcb1f3dc83f2927c10b2a

SHA512
af09d8f2dcb1472801f3ea0ba6e4c37147ffbbe5b1474facc080cb3d2875e60b3ba636456b777d3bf857e40cb847ba8b80bc2a74e60b231051f9b11e0a590c36

Download Submit
C:\Users\Admin\Desktop\TraceUnprotect.m3u.XQk8iLzOQ

Filesize
217KB

MD5
5d681236c8552da84cde6ad34a08e798

SHA1
90196b7543a81b740b23d1e503134f3e266eaa9e

SHA256
be78c329eeff6e7cc1ace127b79dfbdedbc5d675887853f068c7c657439e0c5e

SHA512
70995aa220043af8116bd5adca0e535c2d9b75faf139b4cccd97295f3e7638ee1aa02204396c752f7cc559cb6285a4f1c3c8d53e0ff6516d84dd7044015b906b

Download Submit
C:\Users\Admin\Desktop\UnprotectDebug.ps1xml.XQk8iLzOQ

Filesize
230KB

MD5
4c2bbbc1d987a7712c2d2006b22f1355

SHA1
91aa6820e0330295a2c0f7c32c38e68547e56f66

SHA256
5afeebc5eb7204a4c48634448d0d946d14a293e8f5a3159b65e61da0e7b20273

SHA512
e3f48cc5fa47cc1b1dc73ae8faf5921ffad918d66109291bfa0a9893c900234d0e18c94d2f06cdcaddfe9cce0ff8e680073904395f7de52133f1fc7ec2beddb8

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

Filesize
4KB

MD5
e955b684f1178c9c61772e22c36db4a6

SHA1
7e9ed8507f3b60450e164bfad3875698b9d7ce27

SHA256
752143ffc79fb94a34fae409d5110629778b198bd4fd784c6080b6d137432205

SHA512
dea9bb49371563998693e5870a3f201012ff706927b394be2be138d5c4d20bcefb68e90564480c8cb2d3c8005c072be5df3388d12c46178291c33e0557506e53

Download Submit
C:\Users\Admin\Downloads\EEEEEE

Filesize
146KB

MD5
e93dd1cbb6dda954956dd5d3661fe858

SHA1
014394f79fc9e5da61dc1e23b148470a035f8d8b

SHA256
10f33c25562b2748c8f5f44999e7dbe745ca91e4dbfb5c43c149a280c76f22eb

SHA512
98bfc35bdb67c0cbc16b38eb775a84f54292bdb1b19db72738499d70e7a553a18acf5885f0f13cda1c9e0f08f325096eb04640118eea6b52bb69556dc20fc77c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 337763.crdownload

Filesize
426KB

MD5
eafad63994d7226e68bb54d7a9396e91

SHA1
acc49ad9a05403be2079f48954a397251a5b124b

SHA256
ad2315d49459ab240df61af4f6e336f310c470ec33f8bec1cb8d4fb16b48ae9d

SHA512
6d8181c1229a47333114c9b0e1ee2f333301bc3e774b9d7ecee8d5ae87751bd605508f9fd4ce77a20673996bcb9dc2ccc70f62e837fe0089bdc0478a4d301f4b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 425175.crdownload

Filesize
146KB

MD5
7f6830b77ad13b244bc5d702d67137bf

SHA1
1fbd763388a3e9679ac66b35da8a78e041611fe4

SHA256
e097f98ea3416330ed2fd7856743d68a7ca880c6d57e8c264a384a112ac5a390

SHA512
488cb83c7267cfc70989e09489373f4372325531f7c02b1711fbdf6dfeaa377c39b84d5e971136e0e41d0a6dcde52ec4d21a749169eedb9e9ba43eb9caf077de

Download Submit
C:\Users\Admin\Downloads\lk.exe:Zone.Identifier

Filesize
59B

MD5
4edea8bfddde3812338a5a7a1c4b21ad

SHA1
029f6f6bb0201761bb538f6ca804e68b6fdff1be

SHA256
bbf769ab15431b1bce164e86944cb66f22d626f22005f29e14248b5dfad9b31c

SHA512
ba41bf0f6f0ec2561cb72f58380cd256273419e376f7b360077a1dd81bb82ded5d7bbf434b910cb336eb2568800ec882718d2eac5edc5c7c33afdbe2e6fb7006

Download Submit
C:\XQk8iLzOQ.README.txt

Filesize
343B

MD5
72b1ffaeb7de456483f491ecceadb088

SHA1
ee1953abc295245ab01f35a4a823883826bf2b41

SHA256
eb892eac9899b995047733bb17acd4945eb42b7b49f2ee8ad52b8026bc0297a7

SHA512
c0e7cad617cf1490bb25fc47936edc3ae164b190ed34f2d2a50e7e84ce6e0d6712a6ba9ab351cca1589266078326a00317516c53fecf96f20eaefe15e92ce445

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2842058299-443432012-2465494467-1000\DDDDDDDDDDD

Filesize
129B

MD5
c585389ef86e47b1a207c78803d5ad48

SHA1
623c46b0607b28a5ba06c70ef9fa16802e81b984

SHA256
0036582c27cda4fed1cf4a010dfdcbbc696aa3fcd8e77232c975f28cc95f9542

SHA512
1610f86040a8ea3fcfd37bb4806ee29b4283361ee7315e5f68e41dae6b237b12b178b89d13757f05f747345106c2ce554ba3dc8c93d8dbe5d58db34cc0b50f95

Download Submit
\??\pipe\LOCAL\crashpad_1680_ICIDAFPRPZKTWQXR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5644-2943-0x00007FF95ADD0000-0x00007FF95ADE0000-memory.dmp

Filesize
64KB

Download
memory/5644-2909-0x00007FF95D1B0000-0x00007FF95D1C0000-memory.dmp

Filesize
64KB

Download
memory/5644-2906-0x00007FF95D1B0000-0x00007FF95D1C0000-memory.dmp

Filesize
64KB

Download
memory/5644-2907-0x00007FF95D1B0000-0x00007FF95D1C0000-memory.dmp

Filesize
64KB

Download
memory/5644-2905-0x00007FF95D1B0000-0x00007FF95D1C0000-memory.dmp

Filesize
64KB

Download
memory/5644-2912-0x00007FF95D1B0000-0x00007FF95D1C0000-memory.dmp

Filesize
64KB

Download
memory/5644-2942-0x00007FF95ADD0000-0x00007FF95ADE0000-memory.dmp

Filesize
64KB

Download
memory/5644-3006-0x00007FF95D1B0000-0x00007FF95D1C0000-memory.dmp

Filesize
64KB

Download
memory/5644-3005-0x00007FF95D1B0000-0x00007FF95D1C0000-memory.dmp

Filesize
64KB

Download
memory/5644-3008-0x00007FF95D1B0000-0x00007FF95D1C0000-memory.dmp

Filesize
64KB

Download
memory/5644-3007-0x00007FF95D1B0000-0x00007FF95D1C0000-memory.dmp

Filesize
64KB

Download