raccoon | 3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
Size

929KB
MD5

0b4df70b068c231a06bb8fcc5a256e34
SHA1

29ecfc8234162b43674d90e137546a4ecd4f65d7
SHA256

3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93
SHA512

603a19c3c084bd71dbeda26d34d3d179d1c7f1eb23f4f411a83cbb4d365482885794763fa0d9711dbb6a383a32e60e8ec50aeacce7b87c859b70bf8998ff958b
SSDEEP

24576:pAT8QE+krVNpJc7Y/sDZ0239GhjS9knREHXsW02EhY:pAI+wNpJc7Y60EGhjSmE3sW02EhY

Score

10^/10

raccoon redline vidar 4 5076357887 76426c3f362f5a47a469f0e9d8bc3eef @tag12312341 afb5c633c4650f69312baef49db9dfa4 nam3 ruxarr_gg discovery infostealer stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

vidar

http://146.19.247.187:80

http://45.159.248.53:80

https://t.me/babygun222

http://168.119.59.211:80

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

RuXaRR_GG

insttaller.com:40915

Attributes

auth_value
4a733ff307847db3ee220c11d113a305

Extracted

Family

redline

Botnet

@tag12312341

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Extracted

Family

redline

Botnet

31.41.244.134:11643

Attributes

auth_value
a516b2d034ecd34338f12b50347fbd92

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

http://45.95.11.158/

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

http://193.56.146.177

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Raccoon family
raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 10 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
behavioral2/memory/6192-183-0x0000000000BE0000-0x0000000000C00000-memory.dmp	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
behavioral2/memory/6788-271-0x00000000009D0000-0x00000000009F0000-memory.dmp	family_redline
behavioral2/memory/6552-231-0x00000000003C0000-0x00000000003E0000-memory.dmp	family_redline
behavioral2/memory/6684-276-0x0000000000100000-0x0000000000120000-memory.dmp	family_redline
behavioral2/memory/6420-214-0x00000000007E0000-0x0000000000824000-memory.dmp	family_redline

Redline family
redline
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

29ecfc8234162b43674d90e137546a4ecd4f65d7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe

Executes dropped EXE 11 IoCs

Processes:

F0geI.exekukurzka9000.exenamdoitntn.exenuplat.exereal.exesafert44.exetag.exejshainx.exeffnameedit.exerawxdev.exeEU1.exe

pid	process
6124	F0geI.exe
5424	kukurzka9000.exe
6192	namdoitntn.exe
6276	nuplat.exe
6340	real.exe
6420	safert44.exe
6552	tag.exe
6684	jshainx.exe
6788	ffnameedit.exe
6824	rawxdev.exe
6944	EU1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

6 iplogger.org
8 iplogger.org

flow	ioc
6	iplogger.org
8	iplogger.org

Drops file in Program Files directory 11 IoCs

Processes:

29ecfc8234162b43674d90e137546a4ecd4f65d7.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\nuplat.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\tag.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\rawxdev.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\EU1.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

6460 6124 WerFault.exe F0geI.exe

pid	pid_target	process	target process
6460	6124	WerFault.exe	F0geI.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

29ecfc8234162b43674d90e137546a4ecd4f65d7.exeF0geI.exenuplat.exereal.exeEU1.exejshainx.exekukurzka9000.exenamdoitntn.exesafert44.exetag.exeffnameedit.exerawxdev.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0geI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nuplat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	real.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EU1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jshainx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kukurzka9000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	namdoitntn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	safert44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffnameedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rawxdev.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5112	msedge.exe
5112	msedge.exe
2660	msedge.exe
2660	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3908	msedge.exe
3908	msedge.exe
5384	msedge.exe
5384	msedge.exe
5660	msedge.exe
5660	msedge.exe
6732	identity_helper.exe
6732	identity_helper.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

29ecfc8234162b43674d90e137546a4ecd4f65d7.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 1092 wrote to memory of 3152	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 1092 wrote to memory of 3152	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 3152 wrote to memory of 4196	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4196	3152	msedge.exe	msedge.exe
PID 1092 wrote to memory of 824	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 1092 wrote to memory of 824	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 824 wrote to memory of 2504	824	msedge.exe	msedge.exe
PID 824 wrote to memory of 2504	824	msedge.exe	msedge.exe
PID 1092 wrote to memory of 2172	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 1092 wrote to memory of 2172	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 2172 wrote to memory of 220	2172	msedge.exe	msedge.exe
PID 2172 wrote to memory of 220	2172	msedge.exe	msedge.exe
PID 1092 wrote to memory of 3528	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 1092 wrote to memory of 3528	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 3528 wrote to memory of 2232	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2232	3528	msedge.exe	msedge.exe
PID 1092 wrote to memory of 3872	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 1092 wrote to memory of 3872	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 3872 wrote to memory of 2268	3872	msedge.exe	msedge.exe
PID 3872 wrote to memory of 2268	3872	msedge.exe	msedge.exe
PID 1092 wrote to memory of 2216	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 1092 wrote to memory of 2216	1092	29ecfc8234162b43674d90e137546a4ecd4f65d7.exe	msedge.exe
PID 2216 wrote to memory of 2924	2216	msedge.exe	msedge.exe
PID 2216 wrote to memory of 2924	2216	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 4292	3152	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\29ecfc8234162b43674d90e137546a4ecd4f65d7.exe
"C:\Users\Admin\AppData\Local\Temp\29ecfc8234162b43674d90e137546a4ecd4f65d7.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AbtZ4
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:6252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
    3⤵
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7180 /prefetch:8
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7180 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,18196836252706602595,6456651627056306481,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9288445970124044161,13464886598644891499,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,9288445970124044161,13464886598644891499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,759312144821282861,11773360664901332303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11131353105756689473,10856757942902454085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1naEL4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4013138193463525660,348595571231074699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nhGL4
  2⤵
  PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A3AZ4
  2⤵
  PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AUSZ4
  2⤵
  PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf31e46f8,0x7ffbf31e4708,0x7ffbf31e4718
    3⤵
    PID:5932
- C:\Program Files (x86)\Company\NewProduct\F0geI.exe
  "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 552
    3⤵
    - Program crash
    PID:6460
- C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
  "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5424
- C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
  "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6192
- C:\Program Files (x86)\Company\NewProduct\nuplat.exe
  "C:\Program Files (x86)\Company\NewProduct\nuplat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6276
- C:\Program Files (x86)\Company\NewProduct\real.exe
  "C:\Program Files (x86)\Company\NewProduct\real.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6340
- C:\Program Files (x86)\Company\NewProduct\safert44.exe
  "C:\Program Files (x86)\Company\NewProduct\safert44.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6420
- C:\Program Files (x86)\Company\NewProduct\tag.exe
  "C:\Program Files (x86)\Company\NewProduct\tag.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6552
- C:\Program Files (x86)\Company\NewProduct\jshainx.exe
  "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6684
- C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
  "C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6788
- C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
  "C:\Program Files (x86)\Company\NewProduct\rawxdev.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6824
- C:\Program Files (x86)\Company\NewProduct\EU1.exe
  "C:\Program Files (x86)\Company\NewProduct\EU1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6124 -ip 6124
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\EU1.exe

Filesize
286KB

MD5
eaa8eacd3c59ed71b7f68ef7a96602a3

SHA1
9b35e7b6cd147a4a729d3f6b1791e774a754c589

SHA256
2f7a5ab1ce00d00b1196b2cd815457176467928a47a8c652b8af41e6bab8772b

SHA512
c19934e143dcf1242f2f1584baaad4cebbd2e06d048c2ef9d347683ef0d77e2791c364608957e8ea4c1b9613450c3c2e4112bb56280ee12a4b1b1a63c714d83e

Download Submit
C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe

Filesize
107KB

MD5
4bf892a854af9af2802f526837819f6e

SHA1
09f2e9938466e74a67368ecd613efdc57f80c30b

SHA256
713eeb4e9271fe4b15160d900ad78498838bb33f7f97ad544a705ab2a46d97cf

SHA512
7ef9d8cb4daf6be60c5a41439dab4e7384676b34de2341ac52cb33815645fbb51a4b78725ea97479d287a8d7a0a61b4b337b1ad49cce2a23c9192fd9b7678d44

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe

Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

Filesize
491KB

MD5
681d98300c552b8c470466d9e8328c8a

SHA1
d15f4a432a2abce96ba9ba74443e566c1ffb933f

SHA256
8bbc892aedc1424ca5c66677b465c826f867515a3fea28821d015edcee71c912

SHA512
b909975d0212d5a5a0cb2e2809ee02224aac729cb761be97a8e3be4ee0a1d7470946da8cf725953c1b2d71fb5fc9dc3c26fd74bce5db5cc0e91a106f8bded887

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\nuplat.exe

Filesize
287KB

MD5
17c42a0dad379448ee1e6b21c85e5ac9

SHA1
2fec7fbb4a47092f9c17cd5ebb509a6403cb6d69

SHA256
e080161f57d4eaaad9173b63219ba5a9c2c595324a6b3ffe96783db40839807b

SHA512
5ddfe9af625c54e417452fe582041cdd373b52d4ededbcba71a88050fd834bc8af822257f7ad606e89db3fde15be98f58c1d8ff139dac71d81a23f669617a189

Download Submit
C:\Program Files (x86)\Company\NewProduct\rawxdev.exe

Filesize
287KB

MD5
3434d57b4ceb54b8c85974e652175294

SHA1
6d0c7e6b7f61b73564b06ac2020a2674d227bac4

SHA256
cdd49958dd7504d9d1753899815a1542056372222687442e5b5c7fbd2993039e

SHA512
f06fa676d10ff4f5f5c20d00e06ad94895e059724fea47cdf727bd278d9a3ba9daec26f5a0695cb74d87967d6d8020e14305e82725d5bc8c421c095e6704d9aa

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe

Filesize
286KB

MD5
8a370815d8a47020150efa559ffdf736

SHA1
ba9d8df8f484b8da51161a0e29fd29e5001cff5d

SHA256
975457ed5ae0174f06cc093d4f9edcf75d88118cbbac5a1e76ad7bc7c679cd58

SHA512
d2eb60e220f64e76ebed2b051cc14f3a2da29707d8b2eb52fb41760800f11eafeb8bb3f1f8edcfca693a791aa60e56e263063f2b72abe4ad8784061feee6f7bf

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe

Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe

Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
4bc8a3540a546cfe044e0ed1a0a22a95

SHA1
5387f78f1816dee5393bfca1fffe49cede5f59c1

SHA256
f90fcadf34fbec9cabd9bcfdea0a63a1938aef5ea4c1f7b313e77f5d3f5bbdca

SHA512
e75437d833a3073132beed8280d30e4bb99b32e94d8671528aec53f39231c30476afb9067791e4eb9f1258611c167bfe98b09986d1877ca3ed96ea37b8bceecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aeac524614430126336990f5be820806

SHA1
0efd0996034b4951505183e9ce2c3177851cfd99

SHA256
2b97968b028ad37a1923b13a8493a94b25c12a14b1405031728393e6c7a2af1d

SHA512
f80d9f272ebf2c6a8e4b29cdb0438445c09a292613fade54f0b3b193fbe6c24d02af9d8048cfe2398f6bbe21be09a91a6bed9a93f31fcf0d2734a2341466ccc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff0f07566747b8d864b224d74022ded4

SHA1
92cc4cc1166023f25d918e51bff905fd637a3c53

SHA256
66ed7b43c2e414c6aae05106151cbbe01d6e1959c23c93ba9e5f0cd904292dbc

SHA512
bef84ff08d2386f518c1719b84476848f4db4e7de94f70d6bdf710393a3ba073caab8b55e52749c9e2a37dcdab4e52c8564a034b808be4bb5a95d6f0d3b26ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
97a7d68a82f00f1c0aa7df6a82b99ff4

SHA1
b04ad4e7d584697afbd9e03905a26aeb8336167e

SHA256
c881d1a761235e0028473592ebfcfdf8e9f47d3b203fe79a8fd6d6ad372b20c4

SHA512
b65002343e80c9c006f7ecb4110bfcafc1e27e16ea6bd913a3b2258356e208b1981acfd31bbd8f26f3d6a70f32ec70cf3e616feeb66092881d604f085e8aa641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
95c9de5a410cfd25aca945779d480a6a

SHA1
2e23d06cc1b1b680f1465fde635589fb2d2495c8

SHA256
b62d223895d6e1e0c31cb18bec9c0614aed5495aa2827112115c383f311e430e

SHA512
9effd0522c6538fc17919e483a961d8dd56994ce698f83cc4fd3cb711bb30e700012136059d26b231ea619b5b9f994aecadee7663f02911f658361be0483ab27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a797b0de427d979faad0d15e6d284c3f

SHA1
ee030c1f4f5315725812ce828440cbeaf6e4bbfb

SHA256
d8323f82aa391b7aa8c401f333a6b330118476dae52886b93e1ea33d0345ee34

SHA512
a854fd9b4b6df2217cf06a1c2af5a7ecf99687513602b06ee24003bf262e242dc4d2fbfec242aef38865041b40e419ea5cae627b89a7280fe786ff2c3b67e425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a8f6188b33651f71a9584441a39f4bb8

SHA1
13697136d90d214dfff3fdd11d2d67b66c118753

SHA256
7c20b5e68950de0a5754e90103f44f7c7ea1e8c69d8da7af66e142490177c791

SHA512
e32c666e7741ebe07f1777bcbc82ecda5281c57c46511352b1413822071e33e636b5175b333fe8f2d47d1f46b486089fcc97ed5afe102b99d5726fad6e138ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c07cda70b2b1b3549254ce3e559b7163

SHA1
7eadcd46f5e983a24a04eb697d7f954cc0569270

SHA256
0511f4c12058a2a0d1a5aa6a689304b56b2f008f68070ccf0f3020896ad16e21

SHA512
0e12ea83fef38e62e33a87e4b8e0a2cdca459d5bacb0f4e68111c869a5bcc628b6cf88dbc84ee21a3df835a15f3f08061a51e9f7b0d2137f7b52f98ee7bee5b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d595a5da7a0f2f9f3735c48149d8ab38

SHA1
ce33fe9abf7888e4c1a6b37adc9b0076a298c27b

SHA256
1ed24dc128959b8203267c173f640e68126f577d0976bf674cfed588f7742561

SHA512
6bbc9b126f5c7acb77131987ce80b19fc6535fecdaa9ca5119be4e5efb862c9f919f20e5458a54cc358b44479e4cc5704129dd61f5ac4efe071c89a95011890b

Download Submit
\??\pipe\LOCAL\crashpad_3152_UYMYZRCAZRSSKRMN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1092-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5424-347-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/6124-298-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/6192-233-0x0000000005F70000-0x0000000005F82000-memory.dmp

Filesize
72KB

Download
memory/6192-232-0x0000000005FE0000-0x00000000065F8000-memory.dmp

Filesize
6.1MB

Download
memory/6192-234-0x0000000007970000-0x0000000007A7A000-memory.dmp

Filesize
1.0MB

Download
memory/6192-274-0x00000000078C0000-0x000000000790C000-memory.dmp

Filesize
304KB

Download
memory/6192-183-0x0000000000BE0000-0x0000000000C00000-memory.dmp

Filesize
128KB

Download
memory/6192-261-0x0000000007860000-0x000000000789C000-memory.dmp

Filesize
240KB

Download
memory/6420-214-0x00000000007E0000-0x0000000000824000-memory.dmp

Filesize
272KB

Download
memory/6420-235-0x0000000000FA0000-0x0000000000FA6000-memory.dmp

Filesize
24KB

Download
memory/6552-231-0x00000000003C0000-0x00000000003E0000-memory.dmp

Filesize
128KB

Download
memory/6684-276-0x0000000000100000-0x0000000000120000-memory.dmp

Filesize
128KB

Download
memory/6788-271-0x00000000009D0000-0x00000000009F0000-memory.dmp

Filesize
128KB

Download