lumma | hxxps://www[.]mediafire[.]com/folder/8sb98xf1c76hy/Valorant

Analysis

max time kernel
284s
max time network
286s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2025, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/8sb98xf1c76hy/Valorant

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://uprootquincju.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 8 IoCs

pid	Process
1400	SoftWare(2).exe
3232	SoftWare(2).exe
2476	SoftWare(1).exe
116	SoftWare(2).exe
2608	SoftWare(2).exe
1536	SoftWare(1).exe
3980	SoftWare.exe
1700	SoftWare.exe

Loads dropped DLL 4 IoCs

pid	Process
2476	SoftWare(1).exe
2476	SoftWare(1).exe
1536	SoftWare(1).exe
1536	SoftWare(1).exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 40 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 3232	1400	SoftWare(2).exe	130
PID 2476 set thread context of 2100	2476	SoftWare(1).exe	136
PID 2476 set thread context of 2184	2476	SoftWare(1).exe	137
PID 2476 set thread context of 3892	2476	SoftWare(1).exe	141
PID 2476 set thread context of 3328	2476	SoftWare(1).exe	142
PID 116 set thread context of 2608	116	SoftWare(2).exe	145
PID 2476 set thread context of 4984	2476	SoftWare(1).exe	149
PID 2476 set thread context of 1964	2476	SoftWare(1).exe	150
PID 2476 set thread context of 4000	2476	SoftWare(1).exe	151
PID 2476 set thread context of 4964	2476	SoftWare(1).exe	152
PID 2476 set thread context of 3652	2476	SoftWare(1).exe	153
PID 2476 set thread context of 5024	2476	SoftWare(1).exe	154
PID 2476 set thread context of 5100	2476	SoftWare(1).exe	156
PID 2476 set thread context of 5084	2476	SoftWare(1).exe	158
PID 1536 set thread context of 4148	1536	SoftWare(1).exe	159
PID 1536 set thread context of 5068	1536	SoftWare(1).exe	160
PID 2476 set thread context of 4808	2476	SoftWare(1).exe	161
PID 1536 set thread context of 3004	1536	SoftWare(1).exe	162
PID 2476 set thread context of 212	2476	SoftWare(1).exe	164
PID 1536 set thread context of 2832	1536	SoftWare(1).exe	165
PID 2476 set thread context of 4456	2476	SoftWare(1).exe	168
PID 1536 set thread context of 1452	1536	SoftWare(1).exe	169
PID 1536 set thread context of 4128	1536	SoftWare(1).exe	171
PID 1536 set thread context of 5016	1536	SoftWare(1).exe	172
PID 2476 set thread context of 2128	2476	SoftWare(1).exe	173
PID 2476 set thread context of 1136	2476	SoftWare(1).exe	174
PID 2476 set thread context of 2304	2476	SoftWare(1).exe	176
PID 1536 set thread context of 3344	1536	SoftWare(1).exe	177
PID 2476 set thread context of 4368	2476	SoftWare(1).exe	180
PID 1536 set thread context of 3064	1536	SoftWare(1).exe	181
PID 1536 set thread context of 4920	1536	SoftWare(1).exe	182
PID 1536 set thread context of 872	1536	SoftWare(1).exe	183
PID 1536 set thread context of 3060	1536	SoftWare(1).exe	184
PID 1536 set thread context of 4428	1536	SoftWare(1).exe	189
PID 1536 set thread context of 2476	1536	SoftWare(1).exe	194
PID 1536 set thread context of 3652	1536	SoftWare(1).exe	195
PID 1536 set thread context of 3496	1536	SoftWare(1).exe	199
PID 1536 set thread context of 3896	1536	SoftWare(1).exe	200
PID 1536 set thread context of 648	1536	SoftWare(1).exe	201
PID 3980 set thread context of 1700	3980	SoftWare.exe	212

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2532	1400	WerFault.exe	128
2760	116	WerFault.exe	143
4076	3980	WerFault.exe	210

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftWare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftWare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftWare(2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftWare(2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftWare(2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftWare(2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2748	msedge.exe
2748	msedge.exe
4624	identity_helper.exe
4624	identity_helper.exe
2528	msedge.exe
2528	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
2184	ngen.exe
2184	ngen.exe
2184	ngen.exe
2184	ngen.exe
3232	SoftWare(2).exe
3232	SoftWare(2).exe
3232	SoftWare(2).exe
3232	SoftWare(2).exe
2100	ngen.exe
2100	ngen.exe
2100	ngen.exe
2100	ngen.exe
2608	SoftWare(2).exe
2608	SoftWare(2).exe
2608	SoftWare(2).exe
2608	SoftWare(2).exe
3892	ngen.exe
3892	ngen.exe
3892	ngen.exe
3892	ngen.exe
3328	ngen.exe
3328	ngen.exe
3328	ngen.exe
3328	ngen.exe
4984	ngen.exe
4984	ngen.exe
4984	ngen.exe
4984	ngen.exe
1964	ngen.exe
1964	ngen.exe
1964	ngen.exe
1964	ngen.exe
4000	ngen.exe
4000	ngen.exe
4000	ngen.exe
4000	ngen.exe
4964	ngen.exe
4964	ngen.exe
4964	ngen.exe
4964	ngen.exe
3652	ngen.exe
3652	ngen.exe
3652	ngen.exe
3652	ngen.exe
5024	ngen.exe
5024	ngen.exe
5024	ngen.exe
5024	ngen.exe
5100	ngen.exe
5100	ngen.exe
5100	ngen.exe
5100	ngen.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	2144	7zG.exe
Token: 35	2144	7zG.exe
Token: SeSecurityPrivilege	2144	7zG.exe
Token: SeSecurityPrivilege	2144	7zG.exe
Token: SeRestorePrivilege	2056	7zG.exe
Token: 35	2056	7zG.exe
Token: SeSecurityPrivilege	2056	7zG.exe
Token: SeSecurityPrivilege	2056	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2752	2748	msedge.exe	84
PID 2748 wrote to memory of 2752	2748	msedge.exe	84
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 3956	2748	msedge.exe	85
PID 2748 wrote to memory of 2636	2748	msedge.exe	86
PID 2748 wrote to memory of 2636	2748	msedge.exe	86
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87
PID 2748 wrote to memory of 1072	2748	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/folder/8sb98xf1c76hy/Valorant
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaca5a46f8,0x7ffaca5a4708,0x7ffaca5a4718
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1948 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1416,4025144342237606330,14206931469373089322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1
  2⤵
  PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0xf8,0x7ffaca5a46f8,0x7ffaca5a4708,0x7ffaca5a4718
  2⤵
  PID:4668

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\vavlval\" -an -ai#7zMap2693:100:7zEvent9759
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Users\Admin\Desktop\vavlval\SoftWare(2).exe
"C:\Users\Admin\Desktop\vavlval\SoftWare(2).exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1400
- C:\Users\Admin\Desktop\vavlval\SoftWare(2).exe
  "C:\Users\Admin\Desktop\vavlval\SoftWare(2).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 152
  2⤵
  - Program crash
  PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 1400
1⤵
PID:3540

C:\Users\Admin\Desktop\vavlval\SoftWare(1).exe
"C:\Users\Admin\Desktop\vavlval\SoftWare(1).exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:5040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:3752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:4688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:1084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:4080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:3696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:3596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4368

C:\Users\Admin\Desktop\vavlval\SoftWare(2).exe
"C:\Users\Admin\Desktop\vavlval\SoftWare(2).exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:116
- C:\Users\Admin\Desktop\vavlval\SoftWare(2).exe
  "C:\Users\Admin\Desktop\vavlval\SoftWare(2).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 784
  2⤵
  - Program crash
  PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 116 -ip 116
1⤵
PID:180

C:\Users\Admin\Desktop\vavlval\SoftWare(1).exe
"C:\Users\Admin\Desktop\vavlval\SoftWare(1).exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:5044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:4608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:4968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:1576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:4808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:4584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:648

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\sussy\" -an -ai#7zMap18409:86:7zEvent8626
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Users\Admin\Desktop\sussy\SoftWare.exe
"C:\Users\Admin\Desktop\sussy\SoftWare.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3980
- C:\Users\Admin\Desktop\sussy\SoftWare.exe
  "C:\Users\Admin\Desktop\sussy\SoftWare.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 152
  2⤵
  - Program crash
  PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3980 -ip 3980
1⤵
PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c9b7e612ef21ee665c70534d72524b0

SHA1
e76e22880ffa7d643933bf09544ceb23573d5add

SHA256
a64366387921aba157bba7472244791d5368aef8ecaf6472b616e1e130d7d05e

SHA512
e195e1ce5e7c06d193aa1f924d0079ea72b66eb22c3aea5b6811172251768f649368734e817996d9f0f72ddfd0e2bf2454aaee0bc650eaffd56fa125a334ae88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f4a0b24e1ad3a25fc9435eb63195e60

SHA1
052b5a37605d7e0e27d8b47bf162a000850196cd

SHA256
7d70a8fc286520712421636b563e9ee32335bca9a5be764544a084c77ddd5feb

SHA512
70897560b30f7885745fede85def923fb9a4f63820e351247d5dcbe81daab9dab49c1db03b29c390f58b3907d5025737a84fff026af2372c3233bc585dcfd284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
82KB

MD5
20c0b14fbaef29fd724b4f7295bddbd4

SHA1
299362366f6ed86cfccf9c02b2c4777a000019dc

SHA256
8e3322579fda5215c5c0e052a710d29c23be05edd76c3834b11965803d3ce368

SHA512
2a4a1f57ebde887d4d9b4861312b4c8656a61cdb128b4d95a74207c78d64eb71287caab3645fffc753edf2324073d5a3bdf666c81fe1ef9a6dfed0b679ee8b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
98KB

MD5
90ee5118911d500c730e8398b49a6571

SHA1
e877605b10976175c3a97434b7ef46ab33f5c1b1

SHA256
2a32c75cbd66365bc3780800b9d0a3b07497b11f8db3ed62df30bebe5430c72b

SHA512
8b66897840e9d6ae08934419f51cdee60fcae463a2a5be79008fbe051067212de478037c4da00b78f88ebc563b748caacf63a9ef82113c28e4fdef96e027d3a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
21KB

MD5
660c3b546f2a131de50b69b91f26c636

SHA1
70f80e7f10e1dd9180efe191ce92d28296ec9035

SHA256
fd91362b7111a0dcc85ef6bd9bc776881c7428f8631d5a32725711dce678bff9

SHA512
6be1e881fbb4a112440883aecb232c1afc28d0f247276ef3285b17b925ea0a5d3bac8eac6db906fc6ac64a4192dd740f5743ba62ba36d8204ff3e8669b123db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
142KB

MD5
30be68e4909a54a97b0891ec458b0d75

SHA1
1c345b1dcf5fc350289b21236670478da894296d

SHA256
1e01740d5569ba169273bb7b09ab1edb2333392332385f805b25b74b074246fa

SHA512
cb81972c5cd5bea665d22c6c9b8cb3e56114d88afbcb644d2a0befe663667b3b8f9d1807e5734a1efd6a2de60f53316c61ae29e13e882175c54fa9a79c22e2da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
73KB

MD5
a00e4eca5f17fbf60c632a40e84b2617

SHA1
8dc43a22089baa9c79758e2befe72819b101037d

SHA256
60786eb4f44c7b9733e115437b0c84e2a4142e2a3416163ce5d6e349ce5aa183

SHA512
e490e0bd14f287da5a91bf04623c98a646dc84e89f7d8dacf5156008453196636402dea8fda2dc8b172500717f796d92bffd2c3699166e58b6ff32a78baffb58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
4781f9eaf7e6b27dce78c2594f118e30

SHA1
ebb2ef5db6cc8959d251e9d8b6b3f7669548ee0a

SHA256
c3d62bae834181f02dca5a78105aae85350893c8103ae890585c0f1b28070399

SHA512
255f848b3ac340b76f624ae427bbe4670777d1073fa25add7f481a1b30752c448a376747d81e0786f4ab3368cdde470fbc813dd14dcb4b06500ac29ac3827911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
638c24217e17c5faca3707ff1526dee2

SHA1
465212186ef880769e389473b19d581ce9a91573

SHA256
40d7646dc2a22221b517ed34cac42dfe0644f079e4f05512eea094fef945c74b

SHA512
0d6c12339177296279f7cb1006b0e3ea8ec1ce47de1011c5864c7a93476851722720390db915d8b8c96d4eafe76cf223c9ae43362c1eaf89713bbb6cb24e5c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4e37ab098dc61f31af6d988b1e443194

SHA1
df8222ba02207b128eaac07cd9089c20385873d2

SHA256
c6a76f16aa786db3aedb4b70d0e41a9389c11d1966c3061ed590a04cf4fc5a6e

SHA512
9859b2e53701d79ec2892bd9514a03b493733720fa69ea0b755fd2a5c9723e3fda818a1cbb86876485e6402bafef8f74567b661caa3b52023d55a1d908ea0dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b654d14e45a40dbdb67e67d761f14630

SHA1
cadf6ffe9e3217ea8c15ab8023af8a2347a4ad69

SHA256
4be6de2b7e776e9cb6fedfcceeac4065309828dd653a32c71bb4af7531eb4153

SHA512
8d893964c031136ddcd4e6c4de15e6f3973af0394c9783083cda4dbb146c0ae0a6e219a4dd6bf9a6feae4ed537ed8e9ac6c0626820e470b85a11c113d6ae497f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7b841393f39301d0b0b492f73193e7bf

SHA1
8f749c2c2dd5fb2982ac00f0e9bcfe83a653229a

SHA256
d3b404e4cc3fbe072e7e252aa53a4489e99f7393157e96b46a07ea5c21e3f429

SHA512
217067a942c4554bc53eccd8c43608475efe0409ee0b26fb0474472cbb13ed67647b7b471dec6c3e472c2b0c773a866bf42acdfbe3816fe50f997d1768150d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b37cc840d9d972c59bc6649d40a1f6ab

SHA1
01755b0e263f48305f034637cc3c624cabc8aa45

SHA256
750360826a3900b5e03477967a51c293687ef2826e0e18605459382f98df7d5d

SHA512
413309cf4e004fea8326e8ea3689b0b4dbc12392c0062e23a4108c82c76e517198812369f6a773dfd9a73dc12273456b4a0db5d3ce8e538f2a8703903c4c57fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
05734d255d8637a828689d801a774567

SHA1
fa1301777e632a297cd067b85a06721f1e4985ed

SHA256
2eb3b28b165ba8e68a5dda40676498966b95b9d86029f1938d37014999479393

SHA512
d73e4f1f8341ebe142f42923561808a29a0cb6c3c4b7e2416ff42f30a810cafb559ed882ccebdb8d8328fb86bced5b228455370855f98f119bbebbcc265c35ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b958ea3535ce0822dda5e9bb05008701

SHA1
d10a15f9aa0303118e417a1980914790585751cd

SHA256
ae816914cf93914662b7b232fd094a5e824024bcfdfc452eff3fdc324163bebd

SHA512
268fc163b1684d66be5c0996b245955424609f9733ed8ed97ab86c9589d78d3ffc1918caef5b8f0e5f22abb3269fc66b38e1ad1184bf4ca07fdac237b45336dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2d0c38a89d8af98c433ce06e910f3932

SHA1
77761059561a9cd2a2c954e8d987744ba8a7791c

SHA256
6bdb26f12c5971b53ef779290a984b49f1f704078d8964b4cea02e46a2507a14

SHA512
3c9a007d35c597a98e58d47d4ab1fddc18be2824c04107abe55151622fb455d9cb9382413808a07927544a2c9ab4f3ce5d5f0a8a9413836d4d1fa54a1dbdb9c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
e9f5abf90318109823e7fe6dad5419c8

SHA1
5292f0580c67d4a5fc607fd450beea6392fa4201

SHA256
1e561faa61077c7478a7212dfaad34ac8a06ac3abe8c88d0af055dfbf8e19a2f

SHA512
6b6996dbb243e4f4c594d21bed0ad388760e532debe233a1c17c1b171b65fea4de51776a373ca56d4cddab983b3c21d4531c601359b21a847c89ccb881886e64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
a3569918158cd91714785009a1443171

SHA1
014418ca7fd124f0b018f33d4d5b160127685329

SHA256
150064186366bbba9397e3e0a273934fa8dddd7683c1822fbca61965e67dbf1f

SHA512
54ff9e3397b96dead357e6b6551b089acb04e5f2872b2b9e8a3e9229974ba6d17e11c2643119c9aa901ca881852433376a00aac79363f6e3db044c5c345907d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
b54ef4c3cbb41049cecd8a597df2aff6

SHA1
a1d75d07a6e871b070bb9abb7b39b3b82ad92099

SHA256
bb005207736da5aff19101f0cb818032aede8518f9dc335de5e8bb0c38fa4cc1

SHA512
f8d8eb3c6af229d99eb40272d5980ee0af98a8765bdd814720bd04256e75488d56ad2df2ac69a816b308e303d0844e5596b84982aab02549b3374390bcef0a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
3b5066bdf7cb0ec1e7f64ed98e186d1e

SHA1
7f444c477b5cd555e670cab4695742082bacafe6

SHA256
0462ef88d5a384a779986498fa4baa8cdcb8e95e337f150a0fee63f6f0ff734e

SHA512
fcd92e15f9c3be8430f65380e950edc1e08eb3d426e44ada0a1754e315f590fb67f7950e26c61c4080ee37a20aef200143a164430ea8f9ff1283a30aad6fdcb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4560317cbea3cabb8f2c9d92b11a07c4

SHA1
0c83c81257ce1f56405c26918650df7e01653241

SHA256
4a7428a8074f54bda848e0c49c113f7831619e51fb3187e66d2f21757f11f1ed

SHA512
4bcf15bead63473b34613e734be19ce96ceabefd8db9e586b3329a1f24d816996ec6a179d69e225f6c1db795ac6c8411cbb4f1f6a686da0e166d44f082b2a8b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8fa1412180335c90746e8b63b5c3be5e

SHA1
4ed8dd5f6ecf0829bbc43335504dc54c56e834b1

SHA256
8e1abbb1da61ddac504c56fa2f7204345af35eb86b2bedd93411bb65b71eb60e

SHA512
6071774bb5a70f6b9088a42c10f457bcc34f1bd18f638f8588370985e48a0762c959329e76b1d6f916b16831113f47adfd3553f44b5e0997e6dcef4562652c70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f6641b9811a89e21b2ed03a4c7f8f175

SHA1
07a07eeed3d477faacfce9db6b5ab983eeb66272

SHA256
6fe850d1168dbf3b8f589b12853d7d5c3a36c7161a2f7548fa93a295dc41e57d

SHA512
ce3de9b41c6c41b7414af63ae59fc74e78cd055deba4f92ceeee9d754980a2160c2a3ef7497827f3fc5d36cd3fc6b0db83151ad5ff93f8a64c900c7aa11c0249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e9fd8fbfd51d519e0917e42ebfb6c3c1

SHA1
1e7329354b9c3ccf3e27afeb22dadd592fe60cb3

SHA256
038ad9c62b7e5c306ed048421b6cb7fc3514a8fe5f5f0ec2e35676adccefaf2c

SHA512
f705e48d7492b451db784eca35f0262963d6c7e8e7d6bfa29dffce012a2003d697e0603a3829556992fa9a5b137656f0e17d78fbd0ce87bdbd83c46f6dc63494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
75c6dff55464475b0f3dd1d7cd6971d8

SHA1
7e98805724cb575eb9ee7d460e5a5c4b38068d58

SHA256
cd89fdeaeace3caad6342007c2469c713dc157d1f3447b231004322f13b724e2

SHA512
1982967e91f01092b6833a4218b00ae10b710ba8fd40bc0683fce5a18187288f76118511097ff4aa69584ea543623f037d17c6029c483d86dbd35104a6769fca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d93cf7f80ea19dc6af2e5d8ec03c101c

SHA1
df788bf069ccc07f261fb61aa6f16b1368865253

SHA256
c95b41eac684e05f087e401212c9d01cd1e75af7e1ac127bd8faf9f39848b5c1

SHA512
b28ce3dbee7f78648eeb6722d91e902d7a5c43aee738243573d6384c6ba3156756501c36fe35aa35ad2bbc81f84b329b25f5d3d685868ce95b1ebfef3b889d37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
4d00f3d7938bd85662a739368c54447f

SHA1
b8f3deef353a62f0eaecad298296c775aa4f48c0

SHA256
f956a07884027263e1e6d41e20a333ec62b9817244203e387cd5b25c561c5de0

SHA512
56dc36f48108c42eb60cc67642f663f9d85ba92065365e781e32dacf7c4f52cf49a053bb464247534fbce3a0dd72efde2d5cb65e552c4caf44acac1ef52e022a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
689ae98c10de8b74c6780b557a7f23a3

SHA1
4d6860e967bf9d1816f6c660143cc1f52154cbe3

SHA256
8b26ca35742284f110d8cb01b4eaddfb30e4112c62bc548e7f1917fdece490c6

SHA512
fa664b8c53ce08bd606baf05243321fd4d154b5536d46325e4249c172a3a128e9dae1f729c0fd52768969e11b544a84687edf15380d560a941ab74937c4d58b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ae9d5.TMP

Filesize
48B

MD5
06915724d47242c09697c800aedb1b5b

SHA1
79a56ef700378e5ef51371e3dfbfe22b9f796a36

SHA256
4b8d9839f8ed317bfd3eb26d60beba194ae1892542adcd10939349d9f147b6c3

SHA512
6bd3d295ffdd2b4a0815555c76a09676e78a75a7ae57d7373d23b4d73fe650b1c908d0e7fc305643946f619be701ac6629da5095b2ab1cbe89de000f223e25e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9b5f4ef6b0d55c5c82f4fffd7c642974

SHA1
9f92debc8d6029b27f7df68378bed0e4635d74f5

SHA256
d2ef1ece611833aec082859eebcbb95606efed23e749af1cb64eb10b2489a721

SHA512
6c10d2349a9905e10e0ee7bd302b70457575efd09d1a5f81c98b2cded8233f864b9a3f8e4dbe4fe46c40cfbf7411bcdaabd0206492da748c4a763abb72dcf8dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2fe09248bd0848efd9a24a6799c22000

SHA1
ff378bc1f167c3c81298f5a3cb617d5e5e60f257

SHA256
3e45222068c284af8068332bb6c00e4e975a7d3cc252ac7e4d5972dace6dc0d8

SHA512
91b5e46df012a8e410dcc0026317a7a4be03fa729dc79a02ed3df9e08aa3b947954a65ac2a6365086c7c5202828be201205e695f60d59d7c93a4a58037473ed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e02e.TMP

Filesize
1KB

MD5
8b93f3a349f121081916dae7ef39a376

SHA1
640b78e90959242320fe72a48cee6b3066cf04f1

SHA256
927e1f64667bfcf4b70b88e77f598d42f3b88701b6401ec6adaeeb3de40bfeae

SHA512
af3bbea51b34b2ff202c19fc57cd8ca8753d3585527e8e3aa47b50c0d4da7587529d3aab2d43e5f8d1df5a6a9e605c12f27e2297dd5e8963ea8fa3a2b7a08c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b84c448f0dbe3c0c9305771d19c8d7c2

SHA1
3c541b580b4c8dd95233d8029daddd381a7bed44

SHA256
f7802de6f22678c6131fdbaca8bd4e4d3d6dbd7f65c4bc8b7b9f66d332b9167a

SHA512
22705301a29b9d08af58a324a0a4ae02db94ad83d1837769f97ab036baae35a5ab8198171f00bb43375c85aa2a4a031b1ff678abc33c6fcefa74fb06e33050cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
65bc7a80b452a1150a668a214aad7915

SHA1
cc581f53d67c839b1b049cdf29403893309e4716

SHA256
50e11a4b2af966b5691d8233873ec5b3a673b18adf0544964f00541a45d0d931

SHA512
c4dab96d2813ebeeadfe5d095a4657f1f48edc82e999634e100bd23cbce57de3ec8091557bf591b1a14ee43052cf4a93ddbee2a4325e6d5f8d4af9887ff6df36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f53a01c93a7629532966a7b151481899

SHA1
35eae07cf8aec54a347db28dff576604e33a2e90

SHA256
85011a2c7aa5be74955b47335f27f42dc4ce6ae957409a2ae798a8349a9aca87

SHA512
4c57904729b6e63e5add10b18347f24adb3f4ccc4ed85e83e1c83686d895265452654dd1973b02f47bd92cb2cab162070b6491c16720a1481fa7faa9d57ef851

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
432cf7f22a0ffb3ad741cf2700a3a51e

SHA1
58e0e487a5a6f8b631748aa0211cf888f9fd13a4

SHA256
23101de8659de4c23f29081b6722e81c9385f4ae47e38a30a9d56a7412eda3c4

SHA512
3b8c30b3b8b94c0009da412d842046a4e598be31ddfab2ebfa30a34bbf8098b65566b5ecb46f75fe9bd412c6655a1fba9b1c764b59e1fdb1c2fa84d3fb045135

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
7f58a9d1bf47162202b3302394c07931

SHA1
c170337e20c2c30dd4de0d7fc10c1a6e6352bc13

SHA256
dfd41695db45de072fd518ad7c933f02888ec00cf4c6881dfe02540b3a7cb76c

SHA512
3b36383f848526bc9d9c2ecce0afc407497d0a923aa24893d9cb2f2ccdcafbd4e6ad7796b572fe7b933f5b1502c42068ba8eb94f99ffc809316b31d233b686e4

Download Submit
C:\Users\Admin\Desktop\sussy\SoftWare.exe

Filesize
658KB

MD5
2fa6b6874bf3ca482c9cad2a47e4d158

SHA1
cc8a47113416e7bc9e8f6adf2baae113ab69e0a6

SHA256
9bd8d7af544ca8e498330a3ded52871ae68968ac0a3a963208073a38045f5523

SHA512
b961c29595c50551c59bdf395c673255e529875bbc1ed0d504ec37af8f58a20951155000780aafe32dfb8d85cd3bbdffa4b6ca620c2849700a9642b7b9df43ce

Download Submit
C:\Users\Admin\Desktop\sussy\Valorant.zip

Filesize
20.7MB

MD5
193623ba9f6d8f4c5ba4daa8224b3b30

SHA1
56da745ae44093ad73c190776da7dc2b8f2f9630

SHA256
383297b3a23bfe0e797e53794097eb6bdc88c4529d5eb1c2b3bd371c407d6e4b

SHA512
1e4605c00f4ec20e856bacef21f1b4f034a63d5b5d045b3e86a1db0220464fd7996e0f073ea551a777d8ec2c83de4849e7830bcaf8b5b7d087f98c61ac991804

Download Submit
C:\Users\Admin\Desktop\vavlval\SoftWare(1).exe

Filesize
633KB

MD5
a3d33d33f8b10595c252ee8e61a8892c

SHA1
f8bf529297b99ebdd0d6214a1a8a20bffb1bd875

SHA256
fe0c0a5da033e86e09a721070bb2e1116a28160aaffd803b8e65a57ed25e62c1

SHA512
5a8d8cfcb0ad0e73ce3a4ca2d23a8cb55216f97b1d4f490b3a7beee963e494e8c122fd7ec70a32eef8c1eb9b6b4e86da4cf2207beba6324d70fada7c36303bf0

Download Submit
C:\Users\Admin\Desktop\vavlval\SoftWare(2).exe

Filesize
688KB

MD5
34d31426b3e9ab9ee6be8f483f3dca21

SHA1
d47c1d75a3288b34f470ee91792258b6111ef043

SHA256
84f1da624d1de4bc49a0a64e709fa40c077731a9ed017458d3c177af772671e6

SHA512
7516d8b8dcb2a4d09544d156ff98fb9f502d321f9f91e324d5d41a6a325d86d134105b13131acd1515ae304d4ae390a25d1c0d437ee8e292a6e6efdecd9cda93

Download Submit
C:\Users\Admin\Desktop\vavlval\Valorantcheat.zip

Filesize
15.7MB

MD5
337a44005673440c61944449d862df5d

SHA1
74327348f05f1b2db1ba7c38a7f3061fae1d79b3

SHA256
18d8931044540eb365bef4f590edf1ba8fd77984309015463e430e96faabeacf

SHA512
28699c5009037aba11b4757f7db80c4aa7077f0176bc025f170168b2cd696eed007c5815c2268638db11163379fd7413283bf05c18fb3b473af250e6244b66c5

Download Submit
C:\Users\Admin\Desktop\vavlval\tier0_s64.dll

Filesize
410KB

MD5
328655e0f2611479a90db044ab130373

SHA1
d678fd28927f05bde277bc3dc5fc51e2b4dce8b8

SHA256
586a9c2a27e906a54182166ec63a02bb6a28eb4e2e7e53a799db928b76fd036d

SHA512
8849dbfa9406c94b9750a6771ba391be95d8b41c53f19f446be92f4f22633975aa7d11b999e9f25b93bc682173ad6e4993486a2ec51c7475046db8daf9b1ebc2

Download Submit
C:\Users\Admin\Desktop\vavlval\vstdlib_s64.dll

Filesize
4.1MB

MD5
4fc1435376b3e8c071dd611b54039feb

SHA1
73721daddca91e82fd111a06b4a8952422820af3

SHA256
5404ecc836fee4b6a3fed0d52a78472ed68d5c6972a0652e51bed3dc309c65fa

SHA512
223ec67ec5a51c2f7b2e9701087a358a4d1f2c4b3a525bb94a901abc00deadd436ede927ddcbbafe27e8833c8869459864fe58be13e96d86ddf3df70d62e447f

Download Submit
memory/1400-465-0x00000000005A0000-0x0000000000654000-memory.dmp

Filesize
720KB

Download
memory/1400-466-0x00000000055B0000-0x0000000005B54000-memory.dmp

Filesize
5.6MB

Download
memory/2100-489-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2100-488-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3232-468-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3232-470-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3980-1043-0x0000000000450000-0x00000000004FC000-memory.dmp

Filesize
688KB

Download