Malware Analysis Report

2024-11-13 18:06

Sample ID 241109-y7zs7strgj
Target 004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f
SHA256 004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f
Tags
bootkit discovery persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f

Threat Level: Likely malicious

The file 004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f was found to be: Likely malicious.

Malicious Activity Summary

bootkit discovery persistence

Downloads MZ/PE file

Writes to the Master Boot Record (MBR)

Checks installed software on the system

Checks for any installed AV software in registry

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Browser Information Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer Phishing Filter

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

NTFS ADS

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 20:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 20:26

Reported

2024-11-09 20:28

Platform

win7-20240729-en

Max time kernel

141s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe"

Signatures

Downloads MZ/PE file

Checks for any installed AV software in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Launcher C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\Launcher C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A

Checks installed software on the system

discovery

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer Phishing Filter

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PhishingFilter C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 10aa9cb3e532db01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e082c5e532db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437345861" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a24b065ea621f45879ff62cdabc9853000000000200000000001066000000010000200000009758f24ab2fd74e39c2ef8f73c0a175e1d9d8bd711f58f926e004eafe39f2c65000000000e80000000020000200000005c03baec348ae80e3784664668c8d47d7942b414ed3e20c28cc2ff5e0059ad8e2000000037a1c2d4b6226465101d2584a6ce7518bed5f13dd88aff6bd6448e5fa6d3615c40000000c4091a938fd6114f729d0eaba46b8b68ea7e57ec15dab5f715e88124bb5d83fb3fce3241b8011cba510f7757bda30a0c7cb81789ebfeb7ab1431e47337aa9413 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E94A1671-9ED8-11EF-AC25-4298DBAE743E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002a24b065ea621f45879ff62cdabc9853000000000200000000001066000000010000200000003e28372aa48f67c5affeaa9a550336cf1e46355947f20eb137d29d3ef710b3aa000000000e8000000002000020000000138dd7aaabd025ad258ad800e2d4d8cd780f7f4e2e869d2105a433eeeed6b5e9900000001763b919dd19acbdac12bb3d00c80061220a7cc8ed23f822dd257df93df9eef6ca2dd8e376432ecc0a501b2268f789614216ac9053ca1362bb60b489a7b80cdd975fb7883185aa81d8ca7918dab43fb1e6e79b2027899d0a7fea665046e9bb7c9dbf99621512d20509ea8054ec696e91232f1aa9d5eadcb0f38522d9f211e22cec65c25802af560319ecbe41591b7ad240000000af0c1b2fa7341add74ea5b9165147c7b874a1a4074a0d786fdce35384e2a73dc6447ad492531b4e4b954f0f879df251c58ffa02e76d3e875ca33283ab0830fe1 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe

"C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://down.360safe.com/setupbeta.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 s.360.cn udp
CN 171.8.167.90:80 s.360.cn tcp
CN 171.8.167.90:80 s.360.cn tcp
US 8.8.8.8:53 down.360safe.com udp
US 8.8.8.8:53 down.360safe.com udp
US 104.192.108.20:80 down.360safe.com tcp
US 104.192.108.20:80 down.360safe.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2604-0-0x0000000000480000-0x0000000000481000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab6348.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar6399.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c2762c381626e961c97626c90edd9ca2
SHA1 28e87728a758ba397020d5a80ed2d78aa0da9f7f
SHA256 ba3089656a384ac45a86733ba73edf2f4cf4f07c6cede907873f8aee01c1cd97
SHA512 c69d9d8e745bd8f73442bc818d3a41fcb19a3c4f00af84bf8abc9230c49d9d9a4c92644c1bbd350ca4360ad7ac2b2d0653a053edff2beb8cc8a7972b7e2269c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7724e3637b2301608a588b61e7381af8
SHA1 9abe11ab8dc52bdb32269b24fcc1ef8054a76013
SHA256 edbaf56116016662e46ddeb48ad515be7ebb494f807685745ecb8058f98da97f
SHA512 7a65441b13b593c7d93e7997505cb37876721579eaed84fbc8c2c3a9dd225a402c71e7c41f5f4020e75f7b3fe1d689277479966387ee9a82061e3d160951ba83

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 74ec2dc4d9844ede2731c345ca46f308
SHA1 dfa6d873272e4465131cefdd39b1b2a8348a9655
SHA256 69bbdc79bbc22eaaaf2cfae7bbe4e60a40db4a0cb4befcf6d43bf74406373e7d
SHA512 aa7749f8da000e8bbbeb6cc95311fa96f91bde542017016d47cce991f6f27ff5fd0603384f271fead393e8e45c7a65156a37da0db8431d22b9f1ffa0a46583ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 124fd579054b36fc59e32d5880142d65
SHA1 3cc852602219a92f35447145c06a8dc028a601d9
SHA256 13429ac0519ebb174c0ca8c1a6baaea7a47159cedfa096f4bc002f35c6c7aae6
SHA512 528bd9de1712b9f88a0d35e45f800ab192b53b23a5b4339f774146a82f038a5c4bb8801e9aa3b5a40047f3232985bd145c1cff47307add02df177f670da815ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 600d2224d97c7eb3dfc0abf224954044
SHA1 190a718e1f6f659c5e41e5f3729902b4061b2078
SHA256 382af7f8a45b77edf254e9d4d88845ba781ea1000a65704a7287c27205c21fca
SHA512 43ad5aa37b278d06119479034948958c8293a68cb7620cf6e40a6a2ebf0eef628e29fc9b838489c51e43d53d5e5fe49fb575edc41a8acbe4a15d4825e3d4216a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 61e7531eee88e812368d00f129b8579e
SHA1 38d419c0454c5ddfd8c3737549f9567ef1cb8c39
SHA256 e8869111bfeb7d7e0734e7d897811df0c9e8d60ac194c67c2f3003d614ffecf9
SHA512 2ff886bbfbfca4c7d703bc1eb5219caf1d842ff71fbee4a4c10bc75b118a0547d834d9c412273e8836d4fe27acd81232933f8c771fc1c82c1f00db9a32756a24

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 48a109bc9d3e7b98ab2b6b4157af966f
SHA1 7ae0a5b3fa4fa9ef6d12edc080061578418d73e6
SHA256 e25d87a1a680454b4890d29ab9e4930ae19992a458349f4300449449901dca52
SHA512 6590d8202571138d5d35aa56e3b7efe54a6d1cdbe6733a645b2f273738f5aa8eab0b4356cbf9c80b07964811816636fb4d509a492f266472a33929cc01cf0da0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3b7715e1e7b623a83090d88896c3499
SHA1 1a8dae28cbcbe6906299002b2112231f2538eb60
SHA256 d95612f133dc729ec52ecbfe427b8243082f9a4076f9a81913828648e60a66ff
SHA512 a4a98c5ace3cc2363402504cd0e2eb62f58caf7ed22db505d557cf1a16323d68d82e29aea0b73d60269073201228d1c1c23590ac6c8f6de8a2aec9942907829a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0867158b6a100159265f55e8e47a2d99
SHA1 a2a6f198fb7e0002edba302906a64f0c527f2552
SHA256 79a7fe8f7010f856f08af07efc8b7556449f07b9089600083db8ebef14401871
SHA512 42ce13003f3e66b49372b40d42b788fc96e1d7165b2024baa32afb754250652e72bff76968729f1a36303b05a61287811c7b30772ef6afe2ec1a6bcc387acd69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 36f4be462df8275892f313d9758a8262
SHA1 9323fd3c18424b29c4ff00f8b5a23313efdc1c83
SHA256 1aa638369352d1e10351847f1dbb37a033396d7aa0b8d039c88c5b9732c1d89a
SHA512 ad1466a52697cab8c599a720b2417d3d2338c495f5c146cc4308f11da23407a8f459061c6627ed4158eb6e376b94b339282babbf7d2a57adf91534aa4939b603

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ecd904540e98dfc52fda49fa4d78516b
SHA1 0d120f96513b81e693f25a44ea702ec0c90097b1
SHA256 61e0ca7390a4f0a6e706ac5cd5f255719c6ce1827bb962d16cc262315033f476
SHA512 dfa8f6ac232154bafe068e206b87ba10810ad62303d824cfa93f19995b07386c1cdc5e1e80ca58a019d242d1eef75e46fc5b759594dc996f4548c1c79c02d4f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ee5709e31c32179b9c6c7e3786b4eb20
SHA1 3a7bb037ba73d0cb8ce4ac12d1af7a18f09f1508
SHA256 0f406a30b5cf6c48032c90344282a7d4949591fa6a0467c57b071e1bde0cb073
SHA512 1ea00f4ddc4d41a3117a7584d23e642284a5f7960e9ec28ce2d53e5f448cf593375b6006638af4ccd2e2880c51d1cc46120bdcb138fed4d6fef1054210d92ae1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 101bf628330522b2c024b399e5088e28
SHA1 771447a997fc046ef9ee3dabc6b75759e127987f
SHA256 e443b9e4195844f88fb5551aa6f065027d7b780729b05cc6b04469f1b46b54cc
SHA512 d58d5b336cc7a7e82b27af3383058224ebc1cc34d9d88514ce8158c46516f5ee352585d978d6cf864e5ef6158894787fa7315b790c20fa3ea3d8c6cf66b59016

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9c2cf110631a485304bd673b285d6f56
SHA1 f56ef6acff5b5b6550bf7b966b7bcf7749901fc9
SHA256 6739c03e71b56d1a3b1aeb7e8e8fd45193daf141b85bc98fc3dee19c4ff16065
SHA512 9de55614b7753be0633845860730eb76fc0a9d82858e9b845b030a0a6c58d3eb3c81d69122f434c18d74a96ee479fe2e948e52d96fd0fb09cd050b843b173abe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e6959ba3c594c07c65fd0df9c078fb1e
SHA1 fbd345dc2c33fb2b5d13b3f2d36b40e71492801b
SHA256 dda66c65d83d810af5e5c78d42f1005c6df8444496d517c63a7775106a1a6590
SHA512 2069780c3d815c5e1fd891e05800d10a9b71f1cd3ad931136f5e300638766f87e81665847b004f87b9df23e090b9bd789dd5cbc54c9b881da3b611a14fd7e2b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 395a0992b3b87a5fe80b3af3a699dbb1
SHA1 f8cf54035374bbac50523b7391a10ad9e6232464
SHA256 d8af78d88c0f3493d6fe8960219567330c0b9433eef5a36c142d855aeb40c7af
SHA512 a8cb59ec980dd31ccf567df90f0fd59fbc754f512684c42934e372ccb53226d3e9f4205329e4990c06c65173cf78d17c383d99a72d19921de5f67fa3a466280b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7f4c2caf0d2fdc769dc643ebafc76941
SHA1 540f6e168fa050273301942838ff020a2151e9e8
SHA256 48b24ea98d28b21429f8c372b1a00a87b538973e0bd67e908726be82ac5df9c9
SHA512 1c47c1b763fa75c7b5fba2c676ba9616233fd6b18cfa5d62d4768d74650555513563161dbd98c0ecd16cf00bf3a2f6dd88a4066fb5ca131437c18dd962be29b0

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 20:26

Reported

2024-11-09 20:28

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe"

Signatures

Downloads MZ/PE file

Checks for any installed AV software in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Launcher C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80 C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A

Checks installed software on the system

discovery

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 17658.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4484 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4484 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4700 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4700 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4280 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2868 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe

"C:\Users\Admin\AppData\Local\Temp\004884feeda649ced31f5285a5faae245d1a72bf1fdfe7f1d8636e9e2339b70f.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe12846f8,0x7ffbe1284708,0x7ffbe1284718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4224 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6036 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9815876397449901653,8633987161440770171,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6528 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 s.360.cn udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
CN 180.163.251.230:80 s.360.cn tcp
CN 180.163.251.230:80 s.360.cn tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 down.360safe.com udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 104.192.108.21:80 down.360safe.com tcp
US 104.192.108.21:80 down.360safe.com tcp
US 104.192.108.21:80 down.360safe.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 21.108.192.104.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 133.2.101.151.in-addr.arpa udp

Files

memory/4484-0-0x0000000003C60000-0x0000000003C61000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

\??\pipe\LOCAL\crashpad_2868_NHFSSGYLGMYGPEVZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9c063e08d8d4c6e3d87b3af74ed9db30
SHA1 aa13b93ac2434b1f18832f51b22d76f7d01003a2
SHA256 e3a98078074b53d53b6c7d9423cf0bb12e5776c20337542a96e6c4915f8824dc
SHA512 fece6602b1ecc04f69d411ad07a799520be8924d29f16fe8aef21d03b6ff739007def0a72df33a3058c15826cb2ff8233371513b1597a9b840652fb086543ae5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 395b26ff3eefdfe1539240e85c05b275
SHA1 252e77488a325c48d8b20f499827532940b8529c
SHA256 58d4c13592410c8ad6881fa6bde0401e48b2e664849fcd83a0cb428a409f9c6f
SHA512 785dbc619a07489d48b6a348b414168d5352cca2214ebe31c9ba19b366f80ef8da138864a1d8b131b03438cad39c4552536ce040d03f7bd4af7d873e1acc4772

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e49ec436581e56d43c1e4080f89b7a48
SHA1 73238aede5506373abaa48bee79e41909fadab5c
SHA256 b800f380728ccaf5b7014a949e8d9d4797046895f05e9865b36aefbeddb62de1
SHA512 92133cb0b72ed0cafba57150b4e853ab16839a3b7240fc447cf2d3e6e2f8f89af082993949ab39e3f8ee9904f3507e2ed09b3485c546b1735019b0562aefdc24