quasar | hxxps://gofile[.]io/d/v5N4nl

Analysis

max time kernel
84s
max time network
86s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
28-11-2024 23:47

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://gofile.io/d/v5N4nl

Score

10^/10

quasar office04 defense_evasion discovery evasion ransomware spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

himato667-58401.portmap.host:58401

Mutex

0e2bc079-3316-407c-a26f-115195d9fe5b

Attributes

encryption_key
D14CC6B8490A41A48C1E115285B6932B9A857EA0
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0009000000025c27-280.dat	family_quasar
behavioral1/memory/4648-301-0x0000000000A90000-0x0000000000DB4000-memory.dmp	family_quasar

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

Processes:

cmd.exe

pid	Process
2160	cmd.exe

Executes dropped EXE 3 IoCs

Processes:

Lose2himatoBeta.exebetter.exeClient.exe

pid	Process
3352	Lose2himatoBeta.exe
4648	better.exe
5008	Client.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
4	discord.com
31	discord.com

Drops file in System32 directory 2 IoCs

Processes:

better.exe

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	better.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	better.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Lose2himatoBeta.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MySingleFileApp\\wallpaper.bmp"	Lose2himatoBeta.exe

Drops file in Windows directory 4 IoCs

Processes:

UserOOBEBroker.exe

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Lose2himatoBeta.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeshutdown.exeFileCoAuth.execmd.execmd.execmd.exenet.exenet.exereg.exenet1.execmd.execmd.exereg.exereg.exeLose2himatoBeta.exenet.exenet.exenet1.exereg.exeFileCoAuth.execmd.exereg.execmd.execmd.execmd.exenet1.exenet1.execmd.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lose2himatoBeta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "183"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3587106988-279496464-3440778474-1000\{1FD1BB53-7B3E-48D2-88A6-6336820420E6}	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 384386.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Lose2himatoBeta.exe:Zone.Identifier	msedge.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
1768	schtasks.exe
2096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	Process
960	msedge.exe
960	msedge.exe
4384	msedge.exe
4384	msedge.exe
892	msedge.exe
892	msedge.exe
692	identity_helper.exe
692	identity_helper.exe
4948	msedge.exe
4948	msedge.exe
3372	msedge.exe
3372	msedge.exe
1004	msedge.exe
1004	msedge.exe
1888	msedge.exe
1888	msedge.exe
2892	msedge.exe
2892	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exemsedge.exe

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

better.exeClient.exeshutdown.exe

description	pid	Process
Token: SeDebugPrivilege	4648	better.exe
Token: SeDebugPrivilege	5008	Client.exe
Token: SeShutdownPrivilege	4100	shutdown.exe
Token: SeRemoteShutdownPrivilege	4100	shutdown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exemsedge.exe

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

msedge.exemsedge.exeClient.exe

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
5008	Client.exe
5008	Client.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Client.exePickerHost.exeLogonUI.exe

pid	Process
5008	Client.exe
3732	PickerHost.exe
488	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4384 wrote to memory of 656	4384	msedge.exe	77
PID 4384 wrote to memory of 656	4384	msedge.exe	77
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 1608	4384	msedge.exe	78
PID 4384 wrote to memory of 960	4384	msedge.exe	79
PID 4384 wrote to memory of 960	4384	msedge.exe	79
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80
PID 4384 wrote to memory of 788	4384	msedge.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/v5N4nl
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff20773cb8,0x7fff20773cc8,0x7fff20773cd8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,1682525034323981981,14704810172329087072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3280 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4900

C:\Users\Admin\Downloads\Lose2himatoBeta.exe
"C:\Users\Admin\Downloads\Lose2himatoBeta.exe"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:3352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user OWN3DbyHXM4TO /add
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2512
- - C:\Windows\SysWOW64\net.exe
    net user OWN3DbyHXM4TO /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user OWN3DbyHXM4TO /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net user OWN3DbyHXM4TO Test
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3900
- - C:\Windows\SysWOW64\net.exe
    net user OWN3DbyHXM4TO Test
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user OWN3DbyHXM4TO Test
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "OWN3DbyHXM4TO" /add
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4844
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators "OWN3DbyHXM4TO" /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4284
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "OWN3DbyHXM4TO" /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "%USERNAME%" /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - System Location Discovery: System Language Discovery
  PID:2160
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators "Admin" /delete
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "Admin" /delete
      4⤵
      System Location Discovery: System Language Discovery
      PID:2008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3096
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4492
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1196
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1732
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4676
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4852
- C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\better.exe
  "C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\better.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1768
- - C:\Windows\system32\SubDir\Client.exe
    "C:\Windows\system32\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5008
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start https://x.com/Lose2hxm4to
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://x.com/Lose2hxm4to
    3⤵
    PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff20773cb8,0x7fff20773cc8,0x7fff20773cd8
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,8280400435653737584,13069324849295431597,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,8280400435653737584,13069324849295431597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start https://discord.gg/8eGVMdaD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/8eGVMdaD
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff20773cb8,0x7fff20773cc8,0x7fff20773cd8
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:2
      4⤵
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5316 /prefetch:8
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4008 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,13042624799294595330,9017583783167008956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c shutdown /r
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1116
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:424

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4876

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3216

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4628

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d3855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
07fd01d492742b60a16fde0481a61103

SHA1
567de586760a629cbd60ea09e20721d49a7ee28c

SHA256
c4725bd3586ff4c9cf7ae4bd9078cdb58b5634059e79acea727a75b26ccac5a9

SHA512
a76a511549abc493acf2d8475eba6160f7670fbe539e9f901be0b5bcf165e4f9ff7c6604bbc8c8184d33522a5c88fd4b8a99b9ad976be61c4bb55a539cdc043f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
24945104fc04a4953f05407e71df7533

SHA1
f20efff1d294ec306fa5b367ffc2b96c69c9fb1b

SHA256
13f3f502278dc178379e2720017ccd5d13d7fc11d253907795bcea7c30b160ac

SHA512
f24e37d054858b3a9a80f8981c6c841e0c3cbe7aef9eddfacc24c5ddf8d2d084bc1cb1c5dc99cbb79cdcad22dde4ecb4c602f0defa7202f732eb602886fe6b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
3b988afbe9697b03772694f29693e8c1

SHA1
e6936aeff059f9750efee3dc6b1715bc0148337b

SHA256
6a4c595e423e1d4dfb7673728e4c212d616b7ecca7f145ab9fe9dfbe5aa5f9e5

SHA512
6d511882c8497b75bdc8d1331ab2049085cdc6972ab41eeb733de05f763d94c50e99faa96b8a8cd9c5d3fe8aa7c299e514b19f89310f56664a19b4e771f79311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
7be8d977e8e5286cb02029709c100e2c

SHA1
99bf84df77b33ed2bcec49fc6f792d74eb602b6c

SHA256
5b9bbe3f0b3b0f5dcd5dbf9c2f1c8a28fe32ebdfa74c4137b1a4dd691de5464f

SHA512
21c29dd1852a2cd288f40a51b62ea66fb6a62e3781db1a6ae32e3263a91b8f2ddf352c985bc59f376758950ea63403816e506972a901d735e0232f8f3aff17ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
e44934357aa19af63949d6d1c0ba1902

SHA1
27babc55d50a6d18e54d0afd1682f25e83c41fc8

SHA256
32bf8ea621f554675700eb5f061a75380a169b8d85f1a9d5beb1f6952f6e230e

SHA512
cd33a5c86511c20f2cc47e7c17f8e8e1ef1620981e640c7d1a4c58b889c8965e0426eae8583101e66c82a3fe484e1ddf35a0d5bee43c8b61931f3d0c5d9938ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
dd29358d62348a9c1ac7b42f03c931ff

SHA1
ed360cd8c476f1d6541eab5726f86cf2aa0b5edb

SHA256
eb9b6630478fbb9199687f73fcbb85df6beb38f5653fb01c0c7341ac50a1262f

SHA512
d2bd3d1d64d1cb484546e2f70e23954b1c38e08a57ebb6473ee237d5e667b36de7251b94342990c9c3ee4d54a818f2a0d834628222cac56a4bdbbff37738bc6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
027c1366f8a46b7989088fbe081951a9

SHA1
18aeb81d77c3cc123967a89f891aafe97f0838e5

SHA256
f51da6b929008de0a763194527a33ade3b65dc68cf1ce3080cfe96e472c66a9a

SHA512
f6531b74072967a16702236a1163ea17fe19f9e4155b134a91452656643a40320665a4a43ee107bffee32e3887a91d6777b2ca0b87dd77967e4fb5351dd2c1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
7ad418dbd3547966cd71ed018e298dc0

SHA1
a817766e756a5065fa769f239e735e6e6cda46b9

SHA256
43e19113226213b46e0cf9f548952c6aee92cb20874358fa74622f0b79595b61

SHA512
7ea73b83f323db0be65ced17d73f4c895736da3454fae71163c827d620cee89781459b62f36ec6a089cad50f59211f4c8c5bb0c8ad87cc075aa1f1cf80fc530e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
6889f205eb58ab9bf34cbeea02727b1b

SHA1
da4a71db8d06175072c38a806e8c778ff801e69c

SHA256
64c5d74b501bb91f38f0cfbe63fbfb40e8d2b991383587e91f39f003c05cb9c9

SHA512
8fd0a96387076265e9cec0d2cb4f108d82a1e5800718e52fdb5bb66417d7ce86ed695f2e2d6627f5ec80e31429264f0446acfa26f69c63de11af340c22e64c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
865b9387583fae126b1ec528729f6d8b

SHA1
3a0c7a85975353555e7c8bcc07e424e866c90507

SHA256
6c8456d6f0c0f62511c86c6fe8a411f34adc2371c4442015e7a3b1ecf7bab43a

SHA512
672ab34fe86f75f81915a8af94765c41f5ecc83d93630bab5201a5e0c01b2139cce2540345430932c10b70897c6a1bccfa2f684f8248a82e69ba1b785cc27015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
b7c2d2fec8e1099c0c6dd04a438f8507

SHA1
4da23958ec6970a3aa5bd6b733a43e240f056ed2

SHA256
07a80ac9fa5e09d80250a48714d3c572dd8162b56bf805ad584df1401edca7e6

SHA512
a073e5dd5065ba1d1d04da45e285173fcbd8f7011a8f8a1b087b19c150d04a942663f80cea8ad506c2114fd86987f2a53b7d8b71c01573c5b19d434a6494e2f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
649B

MD5
48d49948427776c2f6847b42c3164abc

SHA1
04821c80c6e2241caf33748a3817adcde8df94bb

SHA256
f01f9714c317621c2423a46c666ec6c3cb233b84f1b3ad9aeb8e517797a5343c

SHA512
2280926ffd7e13ad2470bce21b3e9d14a8aba072105ecf6bbb90d4e13c223c4f0120183ae2ddab4e36a28d12f74effeeb4e0fdccc85c073d29a4117d573e55de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
509B

MD5
6b4f2c1b6aeae72a5d0ca79cc2adbca7

SHA1
0eb675b88c4e79b6048a531becaf2dc26115377c

SHA256
225efef614edce8fe2d324fe4b4f2f3f3daf173957b9a62eb6f3a8abd0c15bbf

SHA512
6c7d43f140cff8698554fd3691e67f24b43b7d34fba6a7c2dce24292da80afb83c5261fa1193886d394bbe723523954753c8c01db77b5e826a1cdd89678aefc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
f1aa91056283706f8b29c0701ef63e3a

SHA1
02f7b9a9b17e9f771c2ffdaf24a1854670fdcb63

SHA256
97d010430bd37382d4350f313ff08b83301e01e22744dd42ae35fbf76a28e928

SHA512
05451e040448b69580f4ccee581e48ce0613df1696207a39eaeb016e184a5c6a84e758fef6974f1f6a5e1960da6da93af204cbbe56902b3b159a6b3c329dc518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9ede9270ec9220b316072a41ab6acfd2

SHA1
7e9d958653d4301fca184d589201cd35fb053f52

SHA256
75b01cec88914e680e28df6932842be39cea1e334aa4ec2b2f0718d4b9ab5b8d

SHA512
a0b16570abb555f1588a6460543edf8b4f5f9b72bd45b9c8ce3ecbaf790b63cfe2c437485b7182e8b6c9fa168572b17ef7d37b9964148623072c7a37a898429f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
931B

MD5
6c51349fa52a9b31fbc05c4f2893229c

SHA1
c27fe82c85df7cb98b362fc30c5de9789c5febca

SHA256
a42d60fbcbca64e274900a2223672614dc1960bd9bbf491c3fb98fb0f82fd7f1

SHA512
84a1ed638a685ee5a1e39ba55aa08d3037371e8f2fcbc3ff05a8e93a10e224b3eb9b26d4a58640e662113c8dce683253df57fc945da70e97f64cf8602fb0d2e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9110fe3de4c54bede6adb2c16e393dd

SHA1
ed3900070214f2cf25cb62d9d71f266767266fae

SHA256
b1a3724ba28d6ae1565a170a31296fc28ad65cfc996a23ff48294a74df4986ce

SHA512
bfb79f2da6306f873a7531fffed5d2c8388a75cf193112611b31d29af2ba1791875a4120054b649b5600040f38fe38fe92ab4b41e12faf4716ebe63bfddefd7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ede2fb693524bf9c7000891d47030d15

SHA1
6ff31c32c27f64fdf6c67100783cc1c602d30ff2

SHA256
5406c89fd5cc3d80244c45a341d99cd0d7baf57266f9ff27a90d06d71cc94aaf

SHA512
c5fd205d99175df3a439ce8a5da58279fba7ee58a51513a16fade6420cc72fc10fd369cb65ca271bca6c9872d268214a647ae6dda0b6fd88d2f868a5b71c6f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0ecaea6afcafa95245a953b8022fcead

SHA1
ff4874fa124db736e5930e19480b01fd626fbfb4

SHA256
fed4496b52610d96129ce2e0a51a461d8d297c9686f5d3b14ae2bd84d20c4ad4

SHA512
d32c2816bc2cfb5db1704f5154b94b8b8128968fcdfb873fa9af94a5b569aa07cd778a54b2a7345310a31cc508b75e2c35e6fb5c3d214bce0f61c3f1ae9371b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a904c306214c761ec44d0d0e32e1a6a3

SHA1
d45a442804d540afc4258186605d8ac676936875

SHA256
78eb160611523c57bdbfa612e503173131857fb6aa578cd7aec7c670b16fa7ff

SHA512
42e126d059f4b9364a327189de15b5cc82e8b03fa4b2933e027fc03cf4e7331d4439ac28b08a3f2a77567a3d957e6ed901e2a2075af221f31bab5278938a2952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b069c3651db2423188cc83b234fbfbd

SHA1
cb5433d39e0d62ba7ed0b4ab8a0e0098545b1ec3

SHA256
e937502bb56da258b3f1053676bb5171e80092ae41de8ac20a87dae91116b067

SHA512
3f05ddf78c4ec95ff2416f627ec843f89f6af3b946249b7b188318b682fea87884c1bf0f6c404fe26d6bf88c7b0401e45c8b67bf0f8594dd3542113c704bd484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b519d92f3a6c66c330ad21fa0abf8a83

SHA1
7fed18924958838b107f16c923f6e90203e0feea

SHA256
abad307ea427d6a147a42124361db8b6d23f7a7a97b77542a926de4dffdf33ee

SHA512
6c6f9e4a29568f553460fd20b2180add9aa4090b20ac32b52bf74a7bee0dda4700e209296aa1197a4417c442935ee57e665362690de4db7b9acc51c8185898fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
345B

MD5
e964b867f619ad04b6e5265cf7e3712a

SHA1
b1ca320ac3e749130fd4b3f8f82b8bb2e680a146

SHA256
f75484bd71592607a8204f5fb0dcb76ff9377610dd32f5b9b88f58752a5fe1f7

SHA512
2efeb20939147cb83a40ce5fcef1612ba365248b5bcba07db97e725592bd8c282e78f199026ff158404c965fdb243a11740ab834e2897d6c53a036a482fcff60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
f405c9da996b81165cbb038ebe5cc52e

SHA1
23e51c0e10c789d45e0c55dc4baf3c1db12ad59e

SHA256
924c35dd6e0e6a2d0b54f140f4ede2c56208af78576baede9e48d969885b9ecf

SHA512
265c6eb0ae0b866cdef271ffb175f75725536a58f72db22cd1f61bf521c457d7c4c4c37c3332bdb907f6ac3de5e29952fc376afde49a358e472fd9c8fcd1f4e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13377311267453366

Filesize
3KB

MD5
2536a3d87fc18e5e1472d410f5c1c41f

SHA1
d581adc6328ca2aed8fc19cf23f5d81b3c0191a7

SHA256
c91ad9699adf82bc3696de3b6ca4f46000743eaff43e717f4a6eb7354fb87132

SHA512
8448752519815d21654ca3cb4cf8838cf93526c7f9f4732c0c92e70545fbbad119e182e84f4f86e863bd91cec69dacc25b0f39f0a75f7dfb77bbaaf454cfeb51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
36f915db745c3f9e5493892da4480855

SHA1
83f411004054c34e64fe3a39af85dae7eac7b5d6

SHA256
28799ff0a3fc9aec0cc0c359ddf617225ecaa227e8177723f68fe555e70a5c6c

SHA512
6ec2f49972fce20b31b085096b4c16fa340fe16f2de56176d3cb819a475a04cd1af87da41364d289f2412238b4e7f61af86f461e9c14e121d0206e9b99f745f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
119ce96bc57109673420554297193b2e

SHA1
96b5a4d42a7852dfde5f38b39c228e085513c385

SHA256
4893dd5b0cdff48f6c01ceb1e46c5a0252f50c4d0ad543e40d14540b6305fa56

SHA512
191b0aa92d07a8a68a507a7eb5d16a9eb1cffc8a575d53d7ebbbb1e7c7b6981c1db059945531436abec4614b2a12a9c3c548665951043bd423dc3a77e967eefa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
19be593622397aaea29353b48befd654

SHA1
6b4b2a416a972d7e66a1c19b7d5ad829b8e2a39b

SHA256
e20428ad7ddd261a6373d706db974bc9c079daa88f096814dc8fc2068bf34e69

SHA512
2a64bfc84437bafa29cc6c42f1c9feaa9456abb17a440fffaae8d58ae6cdbb9e6f4e8ec416b717c652d7245c981e3b849fc83b96abc4032f3c6ab7e0b1c17d75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8d67c2f5b8b648cebdf70d6d508d5ece

SHA1
54343f25fac227743a3b745e157cf24fbcc1af78

SHA256
745a31b29aa8603596aa872142a26c0acebadc0989a8d0429261507c403f3880

SHA512
aad21d5feb4464c11b577a305d7decb545157e2eb2a953d052bfb0313619a4bcd3ced241264d639a58b1253ee286ec1ee4d9e393bb4025bda015bf40c4f5d2c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
086e8488d23a09a31c63a373215eaef3

SHA1
aa0143a8ad3a3f0eec38c021e55c9f2b641b5a7b

SHA256
e146637db360aaafa0fa0efe559f95dfc95819947b77fdd513adb04cb28e21d4

SHA512
5f0431e490fdcaa91a186d11d2f15663f8b7c79dfc2ab58bd857e557f51f49abc3465a65697502f1e85929e319da73489196c5d4062d196e51decca8c2f38e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
ae1dc7fb7f03f74bccaf136c45ff9c8b

SHA1
fd6526af507d3e3ed86c4b0091567a4dba1d7d5c

SHA256
a931e501c2086dd97f381922c28e50a47914a89b24cb83b103903663edec0b26

SHA512
a7e53598145351de66c6b55235fa6a8601809a18386c315207168b6be5cc53d31c4bb1ea1d6636d4c0fa5cb4ccd81fedc1e3ec6e224d2244026e69d1b35f0729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
17KB

MD5
3ef049633fe77e24c49691fc8efff8ad

SHA1
5f1eb5fac196d90c93bedda7ae24e7bcbb11d3c5

SHA256
ee9d1e71397f352ab684194e0cc54344bb18f516e5d60f2f8ed065883704be9a

SHA512
883f5d372e99fd35313bfd61b250f2162d0835483f710a00ff10d16dec68dd6b6103ba8994cee9f709f898a03d8034837321ada7b943c1b3fd6e1250516046bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
a74fd21ec5a8919631dbaecd453ef93f

SHA1
56b7336fe2c6f8f651c36ab558f8e3cc8c17ee20

SHA256
1cc9b802023ce4a46e2e4373e85dda4cfe38e21b1e8e7ee394a9a3a34907a5e0

SHA512
d0a643e04fb0128b44a2537926da341a4e19864dd26b099b7538929fe612ab41ff5bc6e057b7ca9a7b19a470d82e138948c6e01814e3056d9bac5ff51271115a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
c34ea2cc3f76c5288bee91096153a263

SHA1
693b0da37e97633a2b1fd83953c400d6e8740892

SHA256
41f24d17b5924f33209c4727dd8a1a45f9c0f0a880107b5a5ab1e1f5230b6380

SHA512
c188e1a9c2a26e461428252dc0dd133ff81b8ca73123e2b584cf2315a8ab902fa595d5850de274a1c5d4a70feabb466e0843d4807a5ea08f8e96c5c2f9bba427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
47b57e74f5f1a6a5a57e798427b73930

SHA1
5f54c958dae328fa227e49a432ce8c4e4288ee0d

SHA256
680f17396022a30f347f59c4fee840463c4fc1f2f77bb853ca56a078fae3c1bb

SHA512
74b73ccb0863ca264340c5d5341341edc56775ffa9872deeca70b909ad2eef93c5b8d4141657bf7909d7c1027e0994af87fc93b6dcffdbd8e9ee421f2fb2956d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a83e4553e60748a5e4a8ff4d8a386a16

SHA1
0caf96d45ed8babcaa71150b2fe8a4684aa3ff75

SHA256
221133e37ec3785d2a8d62f5131ded7e7196cbc9bb83ed3ffe8853b53f995799

SHA512
fca67e6a34b886963ae063598e34c7cca3f3c856b3805ca9a5fddb2ebe725e310a87c81d1c1b171d70749501ab9388347c7f751cd78dae9ccad72a94fd6fc67d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a1729e009b191e3abe58c57328010d9d

SHA1
bdaf117e76986822b6d71971ebe11ef00b9f6c42

SHA256
c35292088bd63ed4a54328fd6ec34a384814e3102517272cb50442d9623933fa

SHA512
11c33171a7ba6a50ebbb3710fd25b8f6de88f3a78cf0ec73457ed876747a4d335bbb0aefe36beb171f952e20c86e2091713ccbc12bc1628976bb625490a7a065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
57af0be354396c825f5482a1305f5e84

SHA1
8becc6e7c8d416d5fd9fa1b9dc11680bffc12800

SHA256
a721e8a005167a00da0fa913c698a07ac36b870bb56fb96ce8213df8d051ca81

SHA512
1e6d5dfe37a399cfa9be267d8af675ffe54b9d9e8cee1ff29cb08b80acdcb10d4d3934748359f02b99d1837158cb8372f767bccebe83ec19ef6945f9e870b3fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\better.exe

Filesize
3.1MB

MD5
47ec64e3d129b23c44f417cbc2a07aa7

SHA1
e65fbcf69e6e808ebe7bc9b13e483c5fc80d5fa2

SHA256
ccb17adb4b57a95a61acb010c01da98dc150be67a85df2ab40ba9d1f078f8373

SHA512
52247a235b708e98efcf977fd109344e16df9c5a9f13ad5afd395df3f009d9ee6edf81fef9d74a31a9fdec1f851e61642912eb9bc8384b39042b70f9d8b7d510

Download Submit
\??\pipe\LOCAL\crashpad_4384_QRCHLKLWBUTLKRMN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3352-248-0x0000000007560000-0x0000000007EE5000-memory.dmp

Filesize
9.5MB

Download
memory/3352-263-0x0000000007010000-0x0000000007033000-memory.dmp

Filesize
140KB

Download
memory/3352-269-0x00000000090E0000-0x0000000009108000-memory.dmp

Filesize
160KB

Download
memory/3352-270-0x0000000007180000-0x0000000007192000-memory.dmp

Filesize
72KB

Download
memory/3352-273-0x0000000007180000-0x0000000007192000-memory.dmp

Filesize
72KB

Download
memory/3352-275-0x0000000007000000-0x000000000700C000-memory.dmp

Filesize
48KB

Download
memory/3352-281-0x0000000007050000-0x0000000007056000-memory.dmp

Filesize
24KB

Download
memory/3352-284-0x0000000007050000-0x0000000007056000-memory.dmp

Filesize
24KB

Download
memory/3352-285-0x0000000009E00000-0x0000000009EB4000-memory.dmp

Filesize
720KB

Download
memory/3352-288-0x0000000009E00000-0x0000000009EB4000-memory.dmp

Filesize
720KB

Download
memory/3352-289-0x0000000009110000-0x000000000914A000-memory.dmp

Filesize
232KB

Download
memory/3352-292-0x0000000009110000-0x000000000914A000-memory.dmp

Filesize
232KB

Download
memory/3352-293-0x0000000009D70000-0x0000000009D8F000-memory.dmp

Filesize
124KB

Download
memory/3352-245-0x0000000007560000-0x0000000007EE5000-memory.dmp

Filesize
9.5MB

Download
memory/3352-296-0x0000000009D70000-0x0000000009D8F000-memory.dmp

Filesize
124KB

Download
memory/3352-297-0x0000000009D90000-0x0000000009DA5000-memory.dmp

Filesize
84KB

Download
memory/3352-300-0x0000000009D90000-0x0000000009DA5000-memory.dmp

Filesize
84KB

Download
memory/3352-278-0x0000000007000000-0x000000000700C000-memory.dmp

Filesize
48KB

Download
memory/3352-260-0x0000000007010000-0x0000000007033000-memory.dmp

Filesize
140KB

Download
memory/3352-266-0x00000000090E0000-0x0000000009108000-memory.dmp

Filesize
160KB

Download
memory/3352-249-0x0000000009150000-0x0000000009D38000-memory.dmp

Filesize
11.9MB

Download
memory/3352-256-0x0000000006E60000-0x0000000006E71000-memory.dmp

Filesize
68KB

Download
memory/3352-259-0x0000000006E60000-0x0000000006E71000-memory.dmp

Filesize
68KB

Download
memory/3352-253-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3352-252-0x0000000009150000-0x0000000009D38000-memory.dmp

Filesize
11.9MB

Download
memory/4648-301-0x0000000000A90000-0x0000000000DB4000-memory.dmp

Filesize
3.1MB

Download
memory/5008-389-0x000000001CB30000-0x000000001CBE2000-memory.dmp

Filesize
712KB

Download
memory/5008-388-0x000000001CA20000-0x000000001CA70000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads