quasar | hxxp://asd

Analysis

max time kernel
1097s
max time network
1099s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21/01/2025, 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://asd

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.56.1:4782

Mutex

0cd982cc-54f2-43ee-b31f-dcc762e7f4e7

Attributes

encryption_key
1FB7EC82DA3E1ED569E80A26F272CD754A3A5B8A
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0029000000046396-775.dat	family_quasar
behavioral1/memory/5088-813-0x00000000004F0000-0x0000000000814000-memory.dmp	family_quasar

Executes dropped EXE 16 IoCs

pid	Process
5088	fortnitevbucks.exe
1324	Client.exe
960	fortnitevbucks.exe
1508	fortnitevbucks.exe
3332	fortnitevbucks.exe
4576	fortnitevbucks.exe
1620	fortnitevbucks.exe
1160	fortnitevbucks (1).exe
1852	fortnitevbucks.exe
1076	fortnitevbucks (1).exe
5084	fortnitevbucks.exe
2496	fortnitevbucks (1).exe
380	fortnitevbucks.exe
2136	fortnitevbucks (1).exe
2008	fortnitevbucks.exe
3744	fortnitevbucks.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
119	pastebin.com
124	pastebin.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e5abac7e-3fd4-418b-8a5c-588de258624a.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250121121810.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 693811.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\SubDir\Client.exe\:SmartScreen:$DATA	fortnitevbucks.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 226950.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
1428	msedge.exe
1428	msedge.exe
876	identity_helper.exe
876	identity_helper.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
4104	msedge.exe
4104	msedge.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2400	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: 33	4136	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4136	AUDIODG.EXE
Token: SeDebugPrivilege	5088	fortnitevbucks.exe
Token: SeDebugPrivilege	1324	Client.exe
Token: SeDebugPrivilege	960	fortnitevbucks.exe
Token: SeDebugPrivilege	1508	fortnitevbucks.exe
Token: SeDebugPrivilege	2400	taskmgr.exe
Token: SeSystemProfilePrivilege	2400	taskmgr.exe
Token: SeCreateGlobalPrivilege	2400	taskmgr.exe
Token: 33	2400	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2400	taskmgr.exe
Token: SeDebugPrivilege	3332	fortnitevbucks.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: 35	868	svchost.exe
Token: SeDebugPrivilege	4576	fortnitevbucks.exe
Token: SeDebugPrivilege	1620	fortnitevbucks.exe
Token: SeDebugPrivilege	1160	fortnitevbucks (1).exe
Token: SeDebugPrivilege	1852	fortnitevbucks.exe
Token: SeDebugPrivilege	1076	fortnitevbucks (1).exe
Token: SeDebugPrivilege	5084	fortnitevbucks.exe
Token: SeDebugPrivilege	2496	fortnitevbucks (1).exe
Token: SeDebugPrivilege	380	fortnitevbucks.exe
Token: SeDebugPrivilege	2136	fortnitevbucks (1).exe
Token: SeDebugPrivilege	2008	fortnitevbucks.exe
Token: SeDebugPrivilege	3744	fortnitevbucks.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1324	Client.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1324	Client.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe
2400	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2052	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 3864	1428	msedge.exe	84
PID 1428 wrote to memory of 3864	1428	msedge.exe	84
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 3516	1428	msedge.exe	86
PID 1428 wrote to memory of 2060	1428	msedge.exe	87
PID 1428 wrote to memory of 2060	1428	msedge.exe	87
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88
PID 1428 wrote to memory of 4044	1428	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://asd
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff9aaa46f8,0x7fff9aaa4708,0x7fff9aaa4718
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff71d615460,0x7ff71d615470,0x7ff71d615480
    3⤵
    PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=220 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  PID:2980
- C:\Users\Admin\Downloads\fortnitevbucks.exe
  "C:\Users\Admin\Downloads\fortnitevbucks.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1244 /prefetch:1
  2⤵
  PID:3224
- C:\Users\Admin\Downloads\fortnitevbucks.exe
  "C:\Users\Admin\Downloads\fortnitevbucks.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,2869459386277606729,5323398894752416200,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  PID:116
- C:\Users\Admin\Downloads\fortnitevbucks (1).exe
  "C:\Users\Admin\Downloads\fortnitevbucks (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Users\Admin\Downloads\fortnitevbucks.exe
  "C:\Users\Admin\Downloads\fortnitevbucks.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Users\Admin\Downloads\fortnitevbucks (1).exe
  "C:\Users\Admin\Downloads\fortnitevbucks (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Users\Admin\Downloads\fortnitevbucks.exe
  "C:\Users\Admin\Downloads\fortnitevbucks.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Users\Admin\Downloads\fortnitevbucks (1).exe
  "C:\Users\Admin\Downloads\fortnitevbucks (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Users\Admin\Downloads\fortnitevbucks.exe
  "C:\Users\Admin\Downloads\fortnitevbucks.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Users\Admin\Downloads\fortnitevbucks (1).exe
  "C:\Users\Admin\Downloads\fortnitevbucks (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Users\Admin\Downloads\fortnitevbucks.exe
  "C:\Users\Admin\Downloads\fortnitevbucks.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Users\Admin\Downloads\fortnitevbucks.exe
  "C:\Users\Admin\Downloads\fortnitevbucks.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x310 0x3f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:400

C:\Users\Admin\Downloads\fortnitevbucks.exe
"C:\Users\Admin\Downloads\fortnitevbucks.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Users\Admin\Downloads\fortnitevbucks.exe
"C:\Users\Admin\Downloads\fortnitevbucks.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2400

C:\Users\Admin\Downloads\fortnitevbucks.exe
"C:\Users\Admin\Downloads\fortnitevbucks.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2052

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:3772

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:1132

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Users\Admin\Downloads\fortnitevbucks.exe
"C:\Users\Admin\Downloads\fortnitevbucks.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fortnitevbucks.exe.log

Filesize
1KB

MD5
b08c36ce99a5ed11891ef6fc6d8647e9

SHA1
db95af417857221948eb1882e60f98ab2914bf1d

SHA256
cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674

SHA512
07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce3b1f686fe1099f127abf8bb0a6ebd1

SHA1
0d73154910ba712114a54da4a70e1f2fd6af7911

SHA256
ba6fb4f1587708c5b12d41d181d5c0bd794a0a0acdca7b70c7538398ed3f07df

SHA512
aa39919330e2261df585ab526c1dee495a7404f361f0f8f6856c18d38cb5468d463d5135b339d379bfbe39e789a8d994064f845f690cd9ed2c29c780e4aab622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dbb5524aa1aa51fb09065a1fffbc8eb

SHA1
931698f70968b05802e3f1caf59ef833cb49717c

SHA256
98be2d6ca5623fbc27ef9701448face11d39e85297489d63569b40f38ad07404

SHA512
2e80c69ebdb363d3deb8ce8a36f4f582450e932b039f71fb1a2b0a94458add2c978e122b98633430db51125be2e60d746aa88e1fbd0be38434de0784cd685316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ba5ca8e-abfb-4234-8c66-42fd8ee5996f.tmp

Filesize
5KB

MD5
5d608016995c9e13a6c4ab87879124f4

SHA1
efccb1443570ac234416fb6ab2299038f8425d26

SHA256
66c872bba811a97fd807b6b81ca7a118154abaa2802dd2e5a982560fa8b649b9

SHA512
05fc8d3665ca3deddec82d525ba57231144aa9ee2e91e27413e9f498877286f345ecdad396a988028b3e711038844a7d94422d5b4fcd1dc780058b07d16ffa62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
9393d7f810ebb4f1b26b14552e900f86

SHA1
25dd03eb6372d9c9688c853141eb4aee8114c7e8

SHA256
d49069742e8d18fec9cdae960c4f45213d6b522bbca0b5622691a22891ba88f7

SHA512
c83aa2ef3aedbff115bbd7fdb9c05646d3f0ad384367e32baa390bc3cbceea7723d7765b4b6499eef3976c8d2ac6513bfd9be908d20a2c0993cc45d57bf83269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
db338d6c7b0ced71f2fb43cc28a14e88

SHA1
596497a6a4d971e9e394c7cceb26d6189cb9d5a6

SHA256
9b609adffa2e0781d1e20d47826414c3cfa4dc131b12407322ed9dd70b4f6953

SHA512
e61e1816133a09f11a506ccf546bf26afa8b3ec38cc87ce739ca32a4d06b68fb783d84e6d20e9a80940f9423204e86486dcbf37b32c1f26246405d6b6ccd2b89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
63beecfb81e34c3902f14b582c4d96c9

SHA1
c1fe4ef00ac96fbd0da4c60feab18d1a22870d86

SHA256
efa976460365ca16e20aafb8196395e406a8400a700b80e9cbc69fa188aa0bc0

SHA512
58637239c93dfe766d96abd3268c6459b9eab87a3f349c471b1d9c055810eeb8aaa603bf103c1ddc3daa66318551758ed353fc3e0814bf32f96af3b4d143c329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
37650f89e3ab57ca295249849aa61b0c

SHA1
68cec0be349973bae70e313f14466904fdcfe0ae

SHA256
f6aa5f818cf2a2a45b2551387fc38e8924432743b3608ebf10b2f0d67e58af68

SHA512
080f4a5630b9a355aa2de0b8b80d2cab8468aa7c38544145b3468d068e658549efeb575cc96d989db01e137e575564d5d26138949612e8c1bc9d1ce2d6f82489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
1e4fc5b2caee9420fbe21770d6dac1f8

SHA1
31ec5f89621e1d9b028d315f5ee7d5fe83756500

SHA256
369e7c6f85553e7323c34987ba91c19debf4d26c797233ea9b233cdd55f75167

SHA512
eaad46f35b276421325658151d66750287616d50a29823764cae922a93c0c151155eacc3589140cf4bdeb5b1c387c980a99e1e4b366a1e07154762c211299e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
955B

MD5
8f24c9f2aa485af244438a472750539b

SHA1
176bff3efe7f6a9dd7ffc160c5f23ccc4d7d03ba

SHA256
05c331fa603a40aedfefe6fdce61608782c201b48aca072fd055ae66ee7c28c6

SHA512
c89fcd125cd670b69e8ea31697463a41f36f1062a28226ef799bcc9415f760bf1f6ee193d8f76159ba70af6eb666937d6bd7970c1a2a1cd4e532d8c51a8458be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
808B

MD5
6638e7ff45c734661330462a931db8c9

SHA1
94c534fa560cec457de4e32907fdbdcf75ed7ca7

SHA256
a865a1051d5867273cedff81947e52de41a6e11828758c7f2da35a4dec0db515

SHA512
3f03625f9236aff8a4798dfc01780e574bfe366ca8b9f637660cbb073e8634bc177990f2a4ce44f46f9717f80ae6454c1992b454b48afaca9ba4f580ad638460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
245B

MD5
d61d1337b12cec6925a81697b591829f

SHA1
28e59bb7ffac8ad7f698a93167052f61d8069de0

SHA256
ae345b4fe7d274cdea9233bb3ee46b9de85bfb96236eaaff5e3eba841ed538c6

SHA512
4bd1639a5d5b9b75953bdeb62b471ba82d3049c70b290638f802fad8cf7866b1e37471932b3aa6a7e55d58200d75ad8de3985eccee158c1b19e5c7ed66fc31f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58dc03.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1d374778707ca9c38d115b7c01775827

SHA1
fe5f8e46dc260251228aac14e1d2f25854b1d5b8

SHA256
a87a054f30ae80b16908db820816f76ef6f0d6f1b84fe9dd3713db1b2a54112a

SHA512
aa0eac9e6892cc1b0580aa2a7938654153c58d4fa3228869ffc49b9c894c3872cc4c93f574b0045a1c4b927d08879bd6374815520d5dc5b50e9cdad9ab9e0795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7cd031ed8b362fe7d9393b97e86c1a71

SHA1
d14d1eca7a48d0de26d95695750d771e4c5e26db

SHA256
f3ecfd39da06c6ea70ca719265d5d1fe43b953a6d2a22e45a538ac6dee4af0e7

SHA512
e858cebe24abae83ac838e7fbc000a9bbb9bfc36a7aa74c13b6767c9bb1787b9ec6d69e139ff2028df38d19ef341a3b54fc83663eebf62032d0c29cc222f6297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e16be001523643215211fbd7864a1cf5

SHA1
8b53774ab88584c9d8cce4c29bbe1d6e95ba8b44

SHA256
b5701dba49ccfed0912fee1387984636ba4d4f6503762b8a0d135437d04cccb9

SHA512
dda5c1cac1937fe9797c93eed904b41479c15872e7645814919d7607a4c54e244d326ba605b5a0089fc3d8a855dd82849ba824ea6809a779dad68e229eed6c69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ac653cc13886fb918203b35c6434085

SHA1
80e8edd8416454d681f8e1c80fb22724f2e2d6d0

SHA256
85b02050ffd9d90451905613a4b88b48439d12d812ccc9bdb7c5fac42ff9f416

SHA512
99f007932f13cd52fdd19d7533800a952015bfcd8293618089061c1ba5a7ac667ad9b56f7f035498ea288f160c07fcf720d9c8259612d801727312e500030328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ed36cf864baf0be581d2af1b56f320a

SHA1
0369a0db469677566cb1e15eea4fbd785d274044

SHA256
5562b1e1f8e0c504a6e7407f06757773df30ff8550e60ec3531107e06e9f3b40

SHA512
ca9bb47cc7d393db29ad7570374f94034fd45b2c564d36c27a33c6f9ba0ffd79b2642be4da2e81bbe6152bfbcde3cbdaeece2c8b9dab65b56989f41b74707b1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0907f74984b2c91c2b229c73d0e7ba77

SHA1
5eba91bdf70a131100def40444f8617f515b71eb

SHA256
6ef988f9bdf8f22163b79320e7ebb301fb0a288611b784445cdce61a38eff4c7

SHA512
bb7fcd72cf6bfe3f631749eca81503375e61d08e8e6916e5aba00369b6e806af9fc523009ca5a3d6ec0eab7037f5caad35b8dc6cc21b92ea9f42cab0320c3740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5f6ef383c78cbab905f8e01a8928ec08

SHA1
f72b586b8dcc44f7451fb6bceb82c5ac7dc1dea4

SHA256
3c802b284f43235076008b63bcb1360c7df29dbbe603744c9a03e62aa8e6db4c

SHA512
97a22e8b50d6f82d38d6b424e2daf2bad200aa24e36f574588e02804fe337061abb0e59af4f46589f62b833eeeb6c3e9c2ba04f43fe964476ab1f72172528b41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
88a5bab7be033191762d4bd1ca178895

SHA1
cd2023fa1bccb227e0eae4dce1f039f07ff2e5ce

SHA256
0e9d83c52c11727449801ac8983b12810ca5575a550113c42ffb6e654e563e56

SHA512
4fd421eeaf14d8c633a8c92e891d4097f8db525f2b2eefb1a09f857ff7986f488e18477effff7377f4b5e24d5a04230ca45cfa1bc3aa5c14e6f3dd896fe3355f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b34b4baff340a3f6eefe8505fc27e7e7

SHA1
4d1b936588dd1eb659511606f7ae37b4b788bd8d

SHA256
333804cf5fe67abc2dcbfc59e065200af4843e64bf4e6b2cd3fe0ec93fff182d

SHA512
4821914745f500999afc00a979cb251ee9bb08b96501ab8eade9f75565565d568b24422661c81a1b136017151ded5192fc5575990215d1c8f7783e1a9be45257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5614b3ff8da92c0262de324b43eb81b9

SHA1
d313dd6760e336a522ba05f3918e9aa4d8bb0a11

SHA256
4f9380552bf22ef4ed93687f44b76aee52c56dcb373c6c3fe5613f6370100275

SHA512
61957fa440c545bc3c83e2579f14fbc4945377c2df935bfb1ff2a71361ca8effd821418b3d6a64005038741837ed4fbf0a55101d9d1f69ed0881d9ed28a57954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9168ac0fd40f2774c3c473d9b3636118

SHA1
fab0432acd634a2d16e64d9daca79c583d56b443

SHA256
9e2aefbb2c8dee0a0a6454bf2840d411b77f4c53e20a6f15440e5bf007c2e755

SHA512
5ac1308568874b735dde1e0988e60ca0a5ff1a7b8c24aa8c7a8068d7921901587e998e7549f2bf6f635653671acdd3e41423e32ced1a502b6d0426915c6a7297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ee165.TMP

Filesize
48B

MD5
61da7872a1a5d7591cb77363b819aa41

SHA1
2bdbb9e0c9899714d78473e3d73b5670a64499fc

SHA256
9b7db582a6716b800001e89cdce7b34485f0c3a67f717f4cd23b1df7eff8e387

SHA512
1339e0f51e447dcc80ac5bf65820abf1d21106e97b54d50f4f56a6c91d990f8962e308615f36142946fc1d42181de063d319bca2fa61bd02c3928004fb39a3a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
0452a3de5dc1132341e7b93d990d43f2

SHA1
40f447d82d22009d9c96c05c29fd25bbe25a0c05

SHA256
135afa900a4f32466ae5ba52c24a2b3e532ccec19f9001182ed810c947a32cff

SHA512
0e90303ee4e2419aee93d4a692bbc3a7b24ad9c1dfab4aad53751585e08e6dcef4045951ec6ad1bf3e4c87f9ea45b9b2136e0b913536d2e7bbe15d47da3cd0c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
027ae27fef66bb22aa7902450cd4142d

SHA1
d8fe5f85a8d1b9b73a31e7209bcdff45c652cdc9

SHA256
fbc013e66cd30167ff7001e0637bc7ec66acbbd0ba9f5a2230edd06f4e8e6273

SHA512
6aee3c8f7424947033c292b1fed51e020d4cf12db63173d53b28bfae43bb8c387ff732518a83b0546bdfea47347052a02a66b1112c55b050ddf84e2f789a43b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
52263d7eca7247d56d2646d0457c182f

SHA1
6b37cb7d74985dd4e345e1da06abbcea6018b11a

SHA256
04b5a3ba8e73564237413c497dcec6d816ee738eb4c3e4ef9a6c9795d343c08f

SHA512
4b0088d41dd2d8976bc3bde7199a4df3371d67db11e9dd97cf568a3763bb5e1e4f9869c311d3fe23d7526bf730583408bc14521fc1c99de0e1a8c3b56f35f6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e7ffb.TMP

Filesize
371B

MD5
03fd2a65182c59540b6c2143dbb70628

SHA1
be61fe3ca0139b991e7f89945722f79bd7755039

SHA256
71890a6f943fc497ed13291c90334ea2180c2851320010d9e0ae6f51580e1873

SHA512
018da9675514ad26abefa02367ce547d0d1f498d8f324c8028f271d28b09f3db31ff2e5bba7469dd278bcf3556378373548494dbb0abfa2e1e74761961dfdee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be269162014e95679c538634bdc1033c

SHA1
fb8cf4ef84f582c049c3f7a60c5653c9f671237d

SHA256
e04bb623f4486d627a0263e497def786cae9ffd8d252b3b9d1b4980021b68f87

SHA512
c9a6e9aab8927cec44bbdaacde408f5b8846fac0ad8cf43e7e687c8f327f7047eebbe20b74f7adb204058319abb0aa4f266eecd0f67a2f788761676f49dc8537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d36d3b21e1e913f6edcc718edd6536d7

SHA1
7f505e66671dc7f94de2dbdf071712bc7bbdb6fe

SHA256
0a5468626d3a1fb485f146ded7f78105233ab2b2ac1c6f8e250da1fd661972e8

SHA512
4b39f46c883331fb1caa80b25590e4907af7fd1e1562ae9ccc38d5766e3df37d7588d64c31af4842d3534a44ffc014381605886d9639560a1a9bb2c435f80fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7337c687b34db7c5e6029bd07eef040

SHA1
6dc6cb80425b8a04eee41cbb9154eccd4fa32218

SHA256
7f21d361ec634e919c2057baaf52585311795d457f284243628b208506823c88

SHA512
1b5c7fb766a664b207a34f70cb8ed93a8f76ae22c60020dbac5a8eb79675e686d2065c51fa6a9771238d2e4cc761b3667cddc4953a697c31325179e8a077f129

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
ce5fde5746d325539e323f6873e4895c

SHA1
0d8c2823c428c77cc7858aee68303579228eec13

SHA256
90efa6fc501284c641506edbbefad4cbf3734575addeee34d5f00e668460a3cc

SHA512
d6e6295da5d94f4e5a667b075a47aa194518196f9c0f976d12101bd8eded85939ad60122d611bd5afd096923e0850e63a8a55641037c473783248110cb7db77c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
8031ccf5c0a0492e3ef141a45ee785ee

SHA1
fa5df1002e3479c1065c17803c0dd66ca40068d7

SHA256
3ee9f03fc5818de546d0e4145aec0a78a9373f539d4d97cb391ede1a24605af0

SHA512
efab5bcabb688f0bfac02e63e82fddbb9ebc8a90b326a0b4d5e8b9065284fb6b86a3985b2ba8547b4b6f818d4776d97c8976899daf88c1dcb461dc94a6ca3dac

Download Submit
C:\Users\Admin\Downloads\fortnitevbucks.exe

Filesize
3.1MB

MD5
ec732255821a1a773ea1e05057029fb1

SHA1
78f1503853d06c66f8aebf9ba7c2c072abf6956e

SHA256
befc205737580baf9bd8c54eca5867f5a10dac471ce9f10980e3db5a91a94e02

SHA512
609a8e65b794ff3130bbcf3a41d6a60cb5510f18f9b3c35df0e66703b471b2dfcf9c01a52280b22bf1f86fb693a6772511060f515bfe664ab015130551129d66

Download Submit
memory/1324-816-0x000000001CD10000-0x000000001CD60000-memory.dmp

Filesize
320KB

Download
memory/1324-817-0x000000001CE20000-0x000000001CED2000-memory.dmp

Filesize
712KB

Download
memory/2400-871-0x000001EBF9FD0000-0x000001EBF9FD1000-memory.dmp

Filesize
4KB

Download
memory/2400-873-0x000001EBF9FD0000-0x000001EBF9FD1000-memory.dmp

Filesize
4KB

Download
memory/2400-872-0x000001EBF9FD0000-0x000001EBF9FD1000-memory.dmp

Filesize
4KB

Download
memory/2400-863-0x000001EBF9FD0000-0x000001EBF9FD1000-memory.dmp

Filesize
4KB

Download
memory/2400-870-0x000001EBF9FD0000-0x000001EBF9FD1000-memory.dmp

Filesize
4KB

Download
memory/2400-868-0x000001EBF9FD0000-0x000001EBF9FD1000-memory.dmp

Filesize
4KB

Download
memory/2400-862-0x000001EBF9FD0000-0x000001EBF9FD1000-memory.dmp

Filesize
4KB

Download
memory/2400-874-0x000001EBF9FD0000-0x000001EBF9FD1000-memory.dmp

Filesize
4KB

Download
memory/2400-869-0x000001EBF9FD0000-0x000001EBF9FD1000-memory.dmp

Filesize
4KB

Download
memory/2400-864-0x000001EBF9FD0000-0x000001EBF9FD1000-memory.dmp

Filesize
4KB

Download
memory/5088-813-0x00000000004F0000-0x0000000000814000-memory.dmp

Filesize
3.1MB

Download