eternity | ec404dcd1803afcd25cdeccdcea7078204e2a63789c2e02eb721bdfa94b20c98

Analysis

max time kernel
359s
max time network
360s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hmKBg8jjXR.html
Size

10KB
MD5

b3b36dbf184e4e73bc1939036af7b3d3
SHA1

1606269a3caa2251e90b81faa688619745d22d94
SHA256

ec404dcd1803afcd25cdeccdcea7078204e2a63789c2e02eb721bdfa94b20c98
SHA512

88c3994a80a5cbced62f9d01092f34bbced9e7c6f4959158569465227b38521942bce45333b5c80a25f82439b1c239f875cf730fdb9b129e0684373271aa1ea1
SSDEEP

96:AKQf4iKKwOfRrcLHLYRe5mvtgCsXe5oE9Anx/IJ:BQAkRrcLnoVNanx/0

Score

10^/10

eternity discovery spyware stealer

Malware Config

Signatures

Detects Eternity stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/files/0x000600000001e5ad-790.dat	eternity_stealer
behavioral2/memory/3736-829-0x0000000000E20000-0x0000000000F48000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Eternity family
eternity
Downloads MZ/PE file

Drops startup file 37 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\growdicepredictor.exe	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe\:SmartScreen:$DATA	GrowdicePredictor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe	GrowdicePredictor.exe

Executes dropped EXE 24 IoCs

pid	Process
3736	GrowdicePredictor.exe
3564	dcd.exe
912	GrowdicePredictor.exe
3480	GrowdicePredictor.exe
4508	GrowdicePredictor.exe
4748	dcd.exe
1316	dcd.exe
4080	dcd.exe
64	GrowdicePredictor.exe
396	dcd.exe
3196	GrowdicePredictor.exe
3804	dcd.exe
2776	GrowdicePredictor.exe
4880	dcd.exe
4080	GrowdicePredictor.exe
4836	dcd.exe
2848	GrowdicePredictor.exe
2520	dcd.exe
1116	GrowdicePredictor.exe
4220	dcd.exe
2492	GrowdicePredictor.exe
4348	dcd.exe
2744	GrowdicePredictor.exe
3428	dcd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
55	discord.com
56	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-940901362-3608833189-1915618603-1000\{91C38C7C-AFBB-4E4D-9F33-58242BBA7BEA}	msedge.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 694356.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 999628.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 236173.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 335553.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
1200	msedge.exe
1200	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
4788	msedge.exe
4788	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
4992	msedge.exe
4992	msedge.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: 33	4176	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4176	AUDIODG.EXE
Token: SeDebugPrivilege	3736	GrowdicePredictor.exe
Token: SeDebugPrivilege	912	GrowdicePredictor.exe
Token: SeDebugPrivilege	3480	GrowdicePredictor.exe
Token: SeDebugPrivilege	4508	GrowdicePredictor.exe
Token: SeDebugPrivilege	64	GrowdicePredictor.exe
Token: SeDebugPrivilege	3196	GrowdicePredictor.exe
Token: SeDebugPrivilege	2776	GrowdicePredictor.exe
Token: SeDebugPrivilege	4080	GrowdicePredictor.exe
Token: SeDebugPrivilege	4968	taskmgr.exe
Token: SeSystemProfilePrivilege	4968	taskmgr.exe
Token: SeCreateGlobalPrivilege	4968	taskmgr.exe
Token: SeDebugPrivilege	2848	GrowdicePredictor.exe
Token: SeDebugPrivilege	1116	GrowdicePredictor.exe
Token: SeDebugPrivilege	2492	GrowdicePredictor.exe
Token: SeDebugPrivilege	2744	GrowdicePredictor.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe
4968	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2584	1200	msedge.exe	83
PID 1200 wrote to memory of 2584	1200	msedge.exe	83
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 4012	1200	msedge.exe	84
PID 1200 wrote to memory of 2020	1200	msedge.exe	85
PID 1200 wrote to memory of 2020	1200	msedge.exe	85
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86
PID 1200 wrote to memory of 2636	1200	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\hmKBg8jjXR.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb299a46f8,0x7ffb299a4708,0x7ffb299a4718
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1924 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4996
- C:\Users\Admin\Downloads\GrowdicePredictor.exe
  "C:\Users\Admin\Downloads\GrowdicePredictor.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3736
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3564
- C:\Users\Admin\Downloads\GrowdicePredictor.exe
  "C:\Users\Admin\Downloads\GrowdicePredictor.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
    3⤵
    - Executes dropped EXE
    PID:4748
- C:\Users\Admin\Downloads\GrowdicePredictor.exe
  "C:\Users\Admin\Downloads\GrowdicePredictor.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
    3⤵
    - Executes dropped EXE
    PID:1316
- C:\Users\Admin\Downloads\GrowdicePredictor.exe
  "C:\Users\Admin\Downloads\GrowdicePredictor.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
    3⤵
    - Executes dropped EXE
    PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13654616498849618536,37052943229767536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1156 /prefetch:1
  2⤵
  PID:1964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x334 0x318
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2292

C:\Users\Admin\Downloads\GrowdicePredictor.exe
"C:\Users\Admin\Downloads\GrowdicePredictor.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:64
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:396

C:\Users\Admin\Downloads\GrowdicePredictor.exe
"C:\Users\Admin\Downloads\GrowdicePredictor.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:3804

C:\Users\Admin\Downloads\GrowdicePredictor.exe
"C:\Users\Admin\Downloads\GrowdicePredictor.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2776
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:4880

C:\Users\Admin\Downloads\GrowdicePredictor.exe
"C:\Users\Admin\Downloads\GrowdicePredictor.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4080
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:4836

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4968

C:\Users\Admin\Downloads\GrowdicePredictor.exe
"C:\Users\Admin\Downloads\GrowdicePredictor.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:2520

C:\Users\Admin\Downloads\GrowdicePredictor.exe
"C:\Users\Admin\Downloads\GrowdicePredictor.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1116
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:4220

C:\Users\Admin\Downloads\GrowdicePredictor.exe
"C:\Users\Admin\Downloads\GrowdicePredictor.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2492
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:4348

C:\Users\Admin\Downloads\GrowdicePredictor.exe
"C:\Users\Admin\Downloads\GrowdicePredictor.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2744
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52f9dbcf-3f24-4e68-bc12-9725149866a8.tmp

Filesize
5KB

MD5
cadad5d587fea15fa97c81f5d97b5ed9

SHA1
7ee692380dcf6236171455abe02a8b6882c12d8d

SHA256
8679594f22eacd3334727c3942069fbbf6cfd6002837e9ebcaf12001e168e48d

SHA512
88f74c44e45155862ae904d49789d88f70f9c1292839a41b6af054e285f29b3eaa5df96e80586165963df2f23145a339f7d954be5833a0cd2be0ce5202d5b7c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
99KB

MD5
3037c0077b941dc351df78fd549ac9fc

SHA1
7aa416ed095359fc1140b5fab3c55754650961bf

SHA256
72994185cb2873448f157cbf8cf0b6230abee6886060fdbf6d814be95e1e92a3

SHA512
27ed138b8cad4f3e1b768714a72c833dad25475ac5619fd74dfbee779683a6500e0b726d53c703d08a13983347a5dd472eafdd674c12857df058c0b775b6f61c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
429KB

MD5
65e8d2b5db3b25a4e8ae8f757dd2c24b

SHA1
2aa596ba81dd914914a71aba83e08f7517823e68

SHA256
ad007624604d1cbe1367cc8753afcbcac39cb1d9eb2851637e0745a01baac8f3

SHA512
67c328b7eacb41a8ec0f2d6ca491331f35cc85747308ddec90ea349c7de8f0cb177ffd4d7cc057596e5b7b958c3b6d9ac6f39a4d288bed82a3599898e54754ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f120a364f5052fc0ca0be756a08ef679

SHA1
63ecfbf02e1f93ba2186b52a949ad21e6e3a53ba

SHA256
c18e3bd8efe23207e8ad235bd7c4e8ac89c90a7fbe31162bb979693474a5a6b7

SHA512
aaef61946d4dc7bf9332d89b19e3e1c097bd4c5e9497aa4aac9b7bda03294ff4fd0f58b4b9f45dff7a3d7d26ae3dcc2da23e4ee2b985eba25de2f8225b26aa14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d63299044620a134a2bf4f79ec5e7559

SHA1
d65e40b7c592e4fcaa2453895cb0c90f98807aec

SHA256
e4aee86194fa22b121bd7dec07a95a74a7346e0055570ac11fbd5b6fc47ecc1b

SHA512
4cd0c77b556f48d305830afe65aaa4de493b01b913862bb674029f4dd732136f4a3b9ce673e3d28df1335febddff18e19d6092c2ca550213a9391e4037b91303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
30155f89d853356403ea6b19a5f618f5

SHA1
888ce05a7698a31b099b8579b9f7ce7eeafe6ea1

SHA256
7cb3847c124d0dda2dfb28d7e2c25ef31ef8f9745bd1323604f7a665c97afd06

SHA512
9165bb6fd7461254586a4453712d9a4e98771a3740d6d078fafed9e5f7eecd977998b02b58c13c12cbffd8b824a8a389663e64e3de7a50af330d362cf430703d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Filesize
48KB

MD5
e9deb213f7f7c3826a50cead48552abd

SHA1
6c38146cedc6940322ce05a7e5cbc82eedf3e8d9

SHA256
0f5b93c22c4f42fe6d7ed3693d37cda6f77defb183b2ab46c3f990843cfeecdc

SHA512
0ae865d22516bb38bad7506a44f1f94b74d4e3184ff06e210717d73eca9b161aae08d8466bf0af98a7acab714126b482271dec6f26da495713623ac3ee078121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
837B

MD5
f2c322c1379aa5eee57c215131d8c9b6

SHA1
38246e2f4d3cb0aaee1e1da2943f711ebaa0cd68

SHA256
24b21d5300235e848d1ec26770b8097848cc2fed8f90fafa6fac3e2b699140f4

SHA512
6a1415fe63d6fbe5237580dec714ab3f7188094ddcded3f81b0e07508590d0bfa23b734e842d1d387bb34169ee62519fba9543c354a1b5097cd585d542b8dd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
806B

MD5
c88f0d87e8161c94c7a4497d56cd0b3b

SHA1
3599599be8dd32cceb0d96f1248057f5e55e96ac

SHA256
8e111b45054e56673389d074559776325710fd098e77de029f9d8b2514b76e9c

SHA512
98ecf4d741a21132590bcac3e861d61a127b784e59d5023e9cad89df1a9e66970ae3df6b632fca3406a933a7e0d89147c6493dfd4f625e71fe61fd7222e68bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
8b674d9f56e58f2e17cca9b687bc5856

SHA1
2c64533fa2808f938ddb09e5a010d4ee2dde1f45

SHA256
b368633195ba454fa55c846b15b67c42ad771ad780e5fa09313cae90a47569b4

SHA512
102433864349353856b9da91e47a75a06d662cf5670fe587538f8a84965133c0325a1ac006009829d6238bb35dfcfcbdf75c61d4bd4e866dba3d408d1e27a9fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8aae71620faa4799d18a647706857f21

SHA1
1e7bc46f0e132dea04aca005ca38884cdb91f2df

SHA256
bbf2334936a7b576111c3292edd7b7489de245e39849f030feff1038bedc3c9d

SHA512
882dddf675992541bd59058178de09f3e74db1d1778c2eb62680b18857578a909e7f81f73e56cea9a93ad5f4aaeac53d5fc2b820d70c3cf34d6917d576d71a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c23ab76fdaa88823db0764a669352626

SHA1
163bde9a4a7a3cb4fd060c543e1169c1959e5550

SHA256
c9095aed5c34690f1350d99e752a36b31ba1e9e4c5eec51bd1f34381ef6afd57

SHA512
d00805a46bc62925826819eef6771f5108854af533097469bd8876fde2bdb0c16e1a165a7cec20d1e56820497ccca958ab138d51a36274e0ce68cda4dd49dfbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df30883f20a57344c086bd8413574b07

SHA1
693ddcd9aa849fc7688f1ca1e75238c30d370938

SHA256
335cc9981935118575436c78170e189de76040125ffcef5e0c7793d34614a6bd

SHA512
6077773969cae02a27cebc625c3ed79e91dd366cd6e974b365fa3fa3bf3cff84e72be895fa072755a2a4b9188bf228bfbcabceeeba3d1054857fa415f40c00d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
670c1b80f177c3fd784a23ce5da006ad

SHA1
4972d431bd7e747eeaac9befe634b3949f22047a

SHA256
62f275cfd67136ad19e064ee818fd352ff04c06d0bb0fc9a63b36e27b3779a5b

SHA512
aecce07853e389ab56241360d8d8c59a45dc5e9ae25e461b2821715bc10753bce41d01c1c841e9393aa738246914e4d5357d29f5e50f158a9986c54ff2e07136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1bc96875e49c448601549c3b892d386b

SHA1
4a57da97745c73da9b9750be13d0911dd6b5bcc8

SHA256
07c803e8fcae525db615337f2aea40dc619b183fc5fc722afae1c2be21be39f7

SHA512
21187edbeef6bfb4f97144bf813b39e46637ed78373234bbc57cd4874dbd1150b2447a27184c9e80d3c1e370d96c23ed0bb5b0ce72c24a3af3cd1c585b3b443d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2957bfb4bafe5a50e2ab63f5cead4351

SHA1
5520399406f24cc5fcb9b666034027eebd74e62d

SHA256
0e5081ad51c959848e3c754f420efd5447ec8a5821738fefbdbb8a46d08ce0af

SHA512
bc02b128eff4ad587e2ade444fea0e90e52f5a95fbfc64c938f626894ae0c08730e46bb9281072e691d5e9ba77365cf82df35f9aa16bb57530a96126d5f3d1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c3f6afc3cb03451f6f6c4716136ad0c9

SHA1
caa0ba586642d752be5d427fa39a057b5266adb8

SHA256
bdb06b34d36957847cb60288439560208e1cafa2cfccd3d74f91602e06c87c27

SHA512
482dfae6090d28268bf0f18ddc974233239dcc8190335ef28823e5436a6c5b7367896be4d674e0eed317f923ed4b033caa1b67b19eaa169285f90c5fd10f5d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5b8b17a8c59a3aff3ceb1b33025bc046

SHA1
839dcdd131803339671f32e9bbe236661143c012

SHA256
cc82e0d7ba938f07ba27188ed6953f0ceb710315a66d50b7c23170ae2c93cc54

SHA512
ea37afa206d2e4fe1a735cee143fe488e77c434668a7ccb035480a577b501bd1e746965eb8fcfe611edf4d0d0fffc3e734fe2d595fdad32bb1b8587820ed0bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c18bf.TMP

Filesize
48B

MD5
daf8880a288d805f6b731e57ee0616b0

SHA1
f62348afd6bdf76acdf95452d6420f607bc06506

SHA256
3502874340d3915d580bd815d92855066b6c0c2cc0737731c0d2f587bdb9cb06

SHA512
d8de8af2ff8e9677a82c0f9e4ebd7412cb8ad3dbd01fd4c36abca1470238e2083a58673ce040fb4d04145677115c6d04cf05fc5d9459322dcf0d32f6eb4f15a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4f8fca687fd1e25b8f36ad5f5ac33e0f

SHA1
fc1b21bd428aede1e95c7e5fa254b441ba4beec9

SHA256
70bab65a843886947b88c97942660020cf51b20a20b3d64324491604f05f11b2

SHA512
6d7107b0c28865823cd1175b34c223dad30788bc974b97c3c27a3c1e4c0af85f6b804063aa1fc718281454551f2506b296302819b8694610aef7efd655930a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fc7afe02a8bf2808c613ce650d6f4404

SHA1
9a41987faee997d87357fdb071f8207d439ffdb9

SHA256
62d2d4fe7400345fb9d8fa1d15e1a0ba062267695ee8b24b05e76aa982549e90

SHA512
076270786e9da0a3016d5c14b2dfb4fd05a113e6be9675cb73b97a96e9703d51b4ceab95b1e57c2753f12c189dab02fc6ab389ad254d4c35c45c22785102beb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
62a4d30f33fbc5a1d78e04b553256af4

SHA1
230f50d6e9b4f18be925665d72f33e9450d44c38

SHA256
4e45d92061de598d4b4f7e0d706c5d054193db0b0f68127270ccdd8bfbe88dd2

SHA512
6d3f03d2beb7475d0f92328645c2da75fd4dd58ae9ed1626496527802634e8725e062a46c1e8455b7daa59d2c5055575b852fdcb1138d9d0182f3c852a567101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
61d2cb856a4709661145b40a2268103c

SHA1
9976abcfcc756bdbacea5487493a8efaa088d080

SHA256
ca75c2074babc5480d58397367ed0fc8445fb1e9bca8cee0817b655ff2694c54

SHA512
630f910705e71f6b2c430540628a3ae8e2fb5bd1577104bc49737d3f9469de59de8a99be3a9866d60724fbc8851fd94494a16b4f076f28f0d2abee21fb575232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
38cae550cbae0de2554484de966d8eef

SHA1
0ab0dca930293861ddfac95f748a87af13058b55

SHA256
d421636cd9a177e188d3931b6bf06045298409e91bf30b979724b3800e7c8154

SHA512
e9a18572dff53771e3341eaa0bdff26a7f8c3978c3c702eb0a7ff222ea5434141f906142f912cce6b7b10f300ef53984191386cacb4357cc06784faa3be7d684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d6c3c47dbd59672a2df0c4d47d76f3f9

SHA1
edf044fbcfbe873055db4684dbf7ff729d7cd7f4

SHA256
108f7457e906262110ba775db23acfcc9adbf0ba5650547241a42f192a0ac6bc

SHA512
dc5ddca026dae0fa832bd03193df4b7146fb29736082145a6bbb54da31cffdcafc10f3df946d2b0b2824ce85ec70ad9173547c9af65f6ed607e2dee8365a513e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
935497e9a4b3c9d791b4bf16d315159c

SHA1
9f5232bbf072b7b2812fbcb30b4a512587cccc33

SHA256
063d9fac81d3146cd19ab961487b8a7b6e09f825044096a660cb7b9faa5212b6

SHA512
8df6441a5d71c17f28897bc3196d89524bab02a56fe2843c003e40497aa91af4fd9cf96a4cb83b799b5118705a01e0f4437cd90bf29644d8d14527a64e80bc21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3e8f2c7268ee1bdfaf688873f5e1d071

SHA1
78d9bfaeba9a573d0e028e9907ee652f8cb00535

SHA256
cf6eda6ed2665fd2ca33cf5871b6df692cd751625e5c5e0159ec471f468ffaf6

SHA512
c3053d46e4d88c19133ef577f7763f16e2e3048b1b273da647be1b3f89e9760f5971a51134bb123dc33d1f8e8616b109412d31dede4567b52004a164a3eff641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
29020f0ffc8f5eabeb109fe7c8ab842c

SHA1
ade4e01671672f48a40bc0c02f59925d117ca195

SHA256
64c75ff23024c2127cbb8f0b103d7ac752cebc0f44bc06fa99b3cffd4b67ba7f

SHA512
2f3b7b71c55d1767c06543235986c3b48200591976433e958730e7961561ac9dbae3d6b124c67dd996c37551fa2fc99e2bdda5d3905f67cfa5fc8d242768a3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58601c.TMP

Filesize
203B

MD5
a65933bfa5d1f01a3b7ea53ef7a75232

SHA1
2478ed6d39143d0670dc192ae21c928ee3931eaa

SHA256
f4e8dd441a3324569720e262a0335ed42a95c185bbbcd0c0d40389997d2ae1cf

SHA512
91cdd0ea53087306d8cdc3939316022a05f293c96d3854b5b4ae962cf7bcd1ce7759cf72ebc5a180c9c937095b433830a6e85bd8cc511cb51ea75c4d1d42df26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f27f0a52748e980c5d774d5c95e9e63

SHA1
90118c8936b26611b4be42f4f0a65ff5d40de574

SHA256
91ff96557d48f2b16dfe2ecf00961e663302591274e77db5d862f995a2486ace

SHA512
ec71cdc0e3d01563dba1ec295b93205999076c287af0b1d1684d4c0949124e8c41fcd7d051a1cc707a87b528d43b93fc13db4e30b18a82bfcf50e38aa09c0788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5dbb4c6df915085348fbecc095d253cf

SHA1
a021da5d3832916551c861fea41fe6f11ca6f870

SHA256
ff56efd6ad7a42e435ce735849748c4e206e44aebf40cee83187686fcdbb9238

SHA512
0401b8cfddecae2b9eb171b55395966773cea75899369be6925a3daaa0c2b705bf02e1b7c5c7cf69573819dd153bb4267007ac165261233b572a1ceda52a3046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1a8aca7d63daefc5e363a61a00bf4301

SHA1
5971dcb951f424dc7ec44e58071eecaa43942ab0

SHA256
a6ce0d724f987d15849c03a2f512819319a7ac964874251b06c9a79523b5ca99

SHA512
8026a94f914cec2189a08477d72d1e9e6a87e6d2376a0a5daab00d1b69c314c3f3d51e60ef11e0e4cfeebc99ac809082a94ada3a361a2b3600f2d524d1e938e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b20d57864d829dd74c98bdaa79d7bba2

SHA1
bcc651d6fe95c4c5bfd62b283612c3f2f171f0cc

SHA256
71a9ace5122bc5b1f69dd8a667c9a7d2a34b0860de7dd16e65487ec7e3be501d

SHA512
36a607821648fdb7e22a22b315c328040d9148c17e637937dda4646cc74ecce53c486824ddf65f9e3079488e938dda6ca103daaab97bc3e6f928e1fb34fa9b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GrowdicePredictor.exe:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\GrowdicePredictor.exe

Filesize
1.4MB

MD5
919b066d95698a1dba9d2c216c0c3ef5

SHA1
5ad23d59693bb1a612f452ee2bb70f7479d6846b

SHA256
fe4d9eeec0b20f146dc3a078e6f9412c497e273ee5955b60a8f58c51c97a49e5

SHA512
dd9bcc38de0862bc70b43fcbb9f26748df63c1aa55fb33aec558eadebc97e2b236b362753d0f8572abf7f086ba2a64c79c4e9052f8d4dc457a5970fef1631e77

Download Submit
memory/3736-830-0x000000001BA60000-0x000000001BAB0000-memory.dmp

Filesize
320KB

Download
memory/3736-831-0x00000000030F0000-0x000000000312E000-memory.dmp

Filesize
248KB

Download
memory/3736-829-0x0000000000E20000-0x0000000000F48000-memory.dmp

Filesize
1.2MB

Download
memory/4968-1058-0x0000019D8A2E0000-0x0000019D8A2E1000-memory.dmp

Filesize
4KB

Download
memory/4968-1059-0x0000019D8A2E0000-0x0000019D8A2E1000-memory.dmp

Filesize
4KB

Download
memory/4968-1060-0x0000019D8A2E0000-0x0000019D8A2E1000-memory.dmp

Filesize
4KB

Download
memory/4968-1068-0x0000019D8A2E0000-0x0000019D8A2E1000-memory.dmp

Filesize
4KB

Download
memory/4968-1067-0x0000019D8A2E0000-0x0000019D8A2E1000-memory.dmp

Filesize
4KB

Download
memory/4968-1066-0x0000019D8A2E0000-0x0000019D8A2E1000-memory.dmp

Filesize
4KB

Download
memory/4968-1065-0x0000019D8A2E0000-0x0000019D8A2E1000-memory.dmp

Filesize
4KB

Download
memory/4968-1064-0x0000019D8A2E0000-0x0000019D8A2E1000-memory.dmp

Filesize
4KB

Download
memory/4968-1070-0x0000019D8A2E0000-0x0000019D8A2E1000-memory.dmp

Filesize
4KB

Download
memory/4968-1069-0x0000019D8A2E0000-0x0000019D8A2E1000-memory.dmp

Filesize
4KB

Download