ramnit | 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a

Analysis

max time kernel
181s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15-06-2022 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
Size

284KB
MD5

0c74c898a73adfbfc35975a833186d5b
SHA1

ab246c4d8c50385c722215caf2b038bb04a92e74
SHA256

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a
SHA512

c80c92797c64f9ba6e1124a1e8cf281d0b8c79231d9e582187ee826280f5024c5e1a6e2addb8b3ed06cf30e8569821665f77b8e3efba06cdd0be3f41b21d1dde

Score

10^/10

ramnit banker evasion spyware stealer suricata trojan upx worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe:*:enabled:@shell32.dll,-1"	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup
suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup
suricata

ACProtect 1.3x - 1.4x DLL software 7 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\fbiE38.tmp	acprotect
C:\Users\Admin\AppData\Local\Temp\fbiE38.tmp	acprotect
C:\Windows\Temp\cbi131A.tmp	acprotect
C:\Windows\Temp\cbi131A.tmp	acprotect
C:\Windows\TEMP\cbi131A.tmp	acprotect
C:\Windows\Temp\cbi131A.tmp	acprotect
C:\Windows\Temp\cbi131A.tmp	acprotect

Executes dropped EXE 5 IoCs

Processes:

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exeDesktopLayer.exeSystem.exeSystemSrv.exeDesktopLayer.exe

pid	process
1120	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
2532	DesktopLayer.exe
1832	System.exe
2144	SystemSrv.exe
1492	DesktopLayer.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe	upx
behavioral2/memory/1120-138-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/2532-142-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Windows\SystemSrv.exe	upx
C:\Windows\SystemSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/2144-152-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Loads dropped DLL 6 IoCs

Processes:

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeSystem.exeIEXPLORE.EXE

pid	process
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
1832	System.exe
1832	System.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Drops file in System32 directory 64 IoCs

Processes:

iexplore.exemsedge.exemsedge.exeIEXPLORE.EXE

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{86471621-ECF5-11EC-B274-5E4EC20DECC8}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\829eaeff-817f-479a-92de-d675b92bd1dd.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\favicon[1].ico	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\ac9d5ea0-4816-41c5-8ad4-072d25e86b25.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RFe5870e5.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\First Run	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe58749e.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\suggestions[1].en-US	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatCache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\favicon[2].ico	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\data_1	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\2d637519-db04-46fa-a7cb-588428b216c5.tmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatUaCache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\f4b9db87-b35b-4e70-ae63-9058dde1b501.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe5879fd.TMP	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000001.dbtmp	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_637909176359256647	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe587fca.TMP	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\f4b9db87-b35b-4e70-ae63-9058dde1b501.tmp	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites-journal	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\data_2	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\b7ceea95-8cec-4a41-873a-ba18146ed931.tmp	msedge.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	IEXPLORE.EXE

Drops file in Program Files directory 5 IoCs

Processes:

SystemSrv.exe294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	SystemSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px1194.tmp	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px13C6.tmp	SystemSrv.exe

Drops file in Windows directory 3 IoCs

Processes:

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeSystem.exe

description	ioc	process
File created	C:\Windows\System.exe	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
File opened for modification	C:\Windows\System.exe	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
File created	C:\Windows\SystemSrv.exe	System.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

System.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	System.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1726213239"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30966018"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1670588195"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{861C2972-ECF5-11EC-B274-5E4EC20DECC8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "362094979"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1726213239"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30966018"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30966018"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30966018"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1670744951"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE

Modifies data under HKEY_USERS 64 IoCs

Processes:

iexplore.exemsedge.exeIEXPLORE.EXEie_to_edge_stub.exemsedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\metricsid_enableddate = "0"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAO Settings	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge\LastStubPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\BHO\\ie_to_edge_stub.exe"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ie_to_edge_stub.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Flags = "1024"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\kmendfapggjehodndflmmgagdbamhnfd = "91A0CA2F27A37DB029C43D5608FA754D49C31F77AEA2ECD139DD007CB7467728"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Count = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\DualEngineCacheContainerTracker	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\pinned_tabs = "BCAED1CCE1E10AF3AF2CE3490E1F9195A4A77741892AFDD2AEAB8C04451433AE"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000496c6253a3a43144adfae35bfbbb8612000000000200000000001066000000010000200000005fca3698d5c6e681c3bcb287aa6dc69c0c189afce4019443c9d16f8bffd94152000000000e8000000002000020000000c2081ce2885ddaedc2f2bfef7102546c41737b1467716da0c0430dc7d727278c50000000da31ee688b0d5de974ec9124f8f41c59ebd2d5233d1c0ef7911532554dd3976d8a99d837d269697ac25211af0880b7fa2ebf45c270c14b5336b502987d5655058ab65e7f4572603e28f9b9d52c9718064000000055ee0afcbd42d9e97295468aa0cde7672e538dc2fcad69e82417cbe2a15f1704dc37b9084119ac65897d8b1a5caec7e27dc9a11cab367e18aca3a84c87884d6e	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon\version = "92.0.902.67"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@ieframe.dll,-12512 = "Bing"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Setup	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics\user_experience_metrics.stability.exited_cleanly = "0"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\software_reporter.prompt_seed = "2E1CD8B69845F9942B88A05D21520D200786E2FCF544A83399FF806033520403"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\settings_reset_prompt.last_triggered_for_startup_urls = "43E3AC3CBF6424281D41D83A15EBFCC5B05631F0E9D97748F70A24AF7851897C"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e607060003000f00150035000e00380300000000	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\geiinlhabolacmdgdkbkppfmijlemjep = "9A1F57E3D6620AC6EFBA946E50EC912F6F7C2E360B8BC66F1A8F5248E4DD0251"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Type = "3"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeDesktopLayer.exeSystem.exeDesktopLayer.exemsedge.exemsedge.exe

pid	process
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2532	DesktopLayer.exe
2532	DesktopLayer.exe
2532	DesktopLayer.exe
2532	DesktopLayer.exe
2532	DesktopLayer.exe
2532	DesktopLayer.exe
2532	DesktopLayer.exe
2532	DesktopLayer.exe
1832	System.exe
1832	System.exe
1492	DesktopLayer.exe
1492	DesktopLayer.exe
1492	DesktopLayer.exe
1492	DesktopLayer.exe
1492	DesktopLayer.exe
1492	DesktopLayer.exe
1492	DesktopLayer.exe
1492	DesktopLayer.exe
1684	msedge.exe
1684	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe

pid	process
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1104 msedge.exe
1104 msedge.exe
1104 msedge.exe
1104 msedge.exe
1104 msedge.exe
1104 msedge.exe
1104 msedge.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe

pid process

2336 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe

pid	process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeSystem.exe

description	pid	process
Token: SeDebugPrivilege	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
Token: SeDebugPrivilege	1832	System.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

iexplore.exeiexplore.exe

pid	process
3648	iexplore.exe
3648	iexplore.exe
924	iexplore.exe
3648	iexplore.exe
3648	iexplore.exe
3648	iexplore.exe
3648	iexplore.exe
3648	iexplore.exe
3648	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeSystem.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
1832	System.exe
924	iexplore.exe
924	iexplore.exe
3648	iexplore.exe
3648	iexplore.exe
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe

description	pid	process	target process
PID 2336 wrote to memory of 1120	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
PID 2336 wrote to memory of 1120	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
PID 2336 wrote to memory of 1120	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
PID 2336 wrote to memory of 612	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	winlogon.exe
PID 2336 wrote to memory of 612	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	winlogon.exe
PID 2336 wrote to memory of 612	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	winlogon.exe
PID 2336 wrote to memory of 612	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	winlogon.exe
PID 2336 wrote to memory of 612	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	winlogon.exe
PID 2336 wrote to memory of 612	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	winlogon.exe
PID 2336 wrote to memory of 676	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	lsass.exe
PID 2336 wrote to memory of 676	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	lsass.exe
PID 2336 wrote to memory of 676	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	lsass.exe
PID 2336 wrote to memory of 676	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	lsass.exe
PID 2336 wrote to memory of 676	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	lsass.exe
PID 2336 wrote to memory of 676	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	lsass.exe
PID 2336 wrote to memory of 780	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 780	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 780	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 780	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 780	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 780	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 808	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 808	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 808	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 808	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 808	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 808	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 816	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 816	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 816	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 816	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 816	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 816	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	fontdrvhost.exe
PID 2336 wrote to memory of 908	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 908	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 908	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 908	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 908	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 908	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 960	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 960	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 960	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 960	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 960	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 960	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 328	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	dwm.exe
PID 2336 wrote to memory of 328	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	dwm.exe
PID 2336 wrote to memory of 328	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	dwm.exe
PID 2336 wrote to memory of 328	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	dwm.exe
PID 2336 wrote to memory of 328	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	dwm.exe
PID 2336 wrote to memory of 328	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	dwm.exe
PID 2336 wrote to memory of 404	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 404	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 404	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 404	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 404	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 404	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 520	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 520	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 520	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 520	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 520	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 520	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe
PID 2336 wrote to memory of 904	2336	294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:328

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3420

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
2⤵
PID:3356

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3248

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
2⤵
PID:1772

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
2⤵
PID:1884

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:4028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3672

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
2⤵
PID:3508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
2⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1060

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2068

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1344

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2568

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:776

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2604

C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
"C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe"
2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336

C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1120

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2532

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:924

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:924 CREDAT:17410 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2584

C:\Windows\System.exe
C:\Windows\System.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1832

C:\Windows\SystemSrv.exe
C:\Windows\SystemSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2144

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1492

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3648

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3648 CREDAT:17410 /prefetch:2
5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1005c
6⤵
- Modifies data under HKEY_USERS
PID:308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1005c
7⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff8f30046f8,0x7ff8f3004708,0x7ff8f3004718
8⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13189791446205115658,4778819253488670051,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
8⤵
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13189791446205115658,4778819253488670051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
8⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13189791446205115658,4778819253488670051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
8⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13189791446205115658,4778819253488670051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
8⤵
PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13189791446205115658,4778819253488670051,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
8⤵
- Modifies data under HKEY_USERS
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13189791446205115658,4778819253488670051,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
8⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13189791446205115658,4778819253488670051,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
8⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13189791446205115658,4778819253488670051,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
8⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13189791446205115658,4778819253488670051,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
8⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13189791446205115658,4778819253488670051,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
8⤵
PID:4212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
253626de057b0d04c41cb8a08245fcbe

SHA1
ffcb46236625dc17807021f8fe706efda9970958

SHA256
75b3965bbb50f8e182b84896c7496cc36b3710b95bf607734a2dae8c40588989

SHA512
6bab75dea365fe30bc00ac7d53db9d9876929ad2f7576d9090fdd5a3950f2e98b46edd573f3c5c8ab2ccaaab9c4c2e36cc515fa6419b7931a4a9e8b2b44e3113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
859c7f07e3f3b49c80664314d18f95b8

SHA1
9f9d8fd238dcc8712ce3b92d1c182e8bf7bd3dd6

SHA256
8dfad33dac4cc62280cfb4475b6f92295e2811a41fa135d4db991f345e249b5e

SHA512
5cdc569abf52d20b783a85f31f5b7e12a5e1a0eee3b4764369f47896b804a8c352aec89909c68f43c0eb99beb3e2e6a59cdd8809dd0ae19afdbdc1014fea9c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fbiE38.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\fbiE38.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Windows\System.exe
Filesize
284KB

MD5
0c74c898a73adfbfc35975a833186d5b

SHA1
ab246c4d8c50385c722215caf2b038bb04a92e74

SHA256
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a

SHA512
c80c92797c64f9ba6e1124a1e8cf281d0b8c79231d9e582187ee826280f5024c5e1a6e2addb8b3ed06cf30e8569821665f77b8e3efba06cdd0be3f41b21d1dde

Download Submit
C:\Windows\System.exe
Filesize
284KB

MD5
0c74c898a73adfbfc35975a833186d5b

SHA1
ab246c4d8c50385c722215caf2b038bb04a92e74

SHA256
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a

SHA512
c80c92797c64f9ba6e1124a1e8cf281d0b8c79231d9e582187ee826280f5024c5e1a6e2addb8b3ed06cf30e8569821665f77b8e3efba06cdd0be3f41b21d1dde

Download Submit
C:\Windows\SystemSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\SystemSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\TEMP\cbi131A.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Windows\Temp\cbi131A.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Windows\Temp\cbi131A.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Windows\Temp\cbi131A.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Windows\Temp\cbi131A.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F
Filesize
7KB

MD5
807e162bb2da71a06f1fbe1d9483feaf

SHA1
1a1a40df79ef75a13db9079b7312ef0d724a9984

SHA256
5ba3084095b6d963fac933448c2751174cb46052eb5a202fbbee1af9740cf1a1

SHA512
cb693a8762a22086e2e9e996baf247a820ed51fb7ca975e39f5541fee607ff997ec0f5af4a0b0621b559abbc886a6d25398a660b49134b3c774b145099fa0967

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F
Filesize
226B

MD5
4d543a25ba6ee1f934cfd23a3e67d489

SHA1
bfb4a979989ab933e3e4f38fe007314a6f137ce3

SHA256
8553ba0a5f97b2ae798048e57f00c5c3230b6761f0708186830d6b371ab0a58f

SHA512
baea2108befdfbcdc0961601fca91836eb5b83c801f9777c87ed5c4813af6a35d5c34c20e66461e1f99559dd39f8cb947476175a6aee847273944d9eb19bddd0

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f4bffb1c8ef52e04326c15e0d178ac71

SHA1
0821f78e54661267112f4c22553834bbfaeb2c74

SHA256
b29c3747d228d11030e1ffcc663cdc904bf1b12138008cc3f4d3917f21ef7464

SHA512
5973010679206c580839b6e9b1e05b7bd87b3870e8709f9543892fc3683d969b3a750064864f64e69082c214118a1745d6f4dbf3986859badf972ae07e11049c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat
Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
\??\pipe\LOCAL\crashpad_1104_TADYUCCXJFQFMLYI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/308-163-0x0000000000000000-mapping.dmp

Download
memory/876-177-0x0000000000000000-mapping.dmp

Download
memory/1104-164-0x0000000000000000-mapping.dmp

Download
memory/1120-133-0x0000000000000000-mapping.dmp

Download
memory/1120-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1492-150-0x0000000000000000-mapping.dmp

Download
memory/1684-170-0x0000000000000000-mapping.dmp

Download
memory/1832-157-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1832-158-0x0000000000D20000-0x0000000000D93000-memory.dmp

Filesize
460KB

Download
memory/1832-190-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1836-179-0x0000000000000000-mapping.dmp

Download
memory/2144-147-0x0000000000000000-mapping.dmp

Download
memory/2144-152-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2336-155-0x00000000006A0000-0x0000000000713000-memory.dmp

Filesize
460KB

Download
memory/2336-156-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/2336-136-0x00000000006A0000-0x0000000000713000-memory.dmp

Filesize
460KB

Download
memory/2336-154-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2336-130-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-141-0x0000000000540000-0x000000000054F000-memory.dmp

Filesize
60KB

Download
memory/2532-142-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2532-137-0x0000000000000000-mapping.dmp

Download
memory/2600-183-0x0000000000000000-mapping.dmp

Download
memory/2632-162-0x0000000001FC0000-0x0000000002033000-memory.dmp

Filesize
460KB

Download
memory/2632-191-0x0000000001FC0000-0x0000000002033000-memory.dmp

Filesize
460KB

Download
memory/3368-169-0x0000000000000000-mapping.dmp

Download
memory/3484-165-0x0000000000000000-mapping.dmp

Download
memory/3904-172-0x0000000000000000-mapping.dmp

Download
memory/3956-185-0x0000000000000000-mapping.dmp

Download
memory/4104-187-0x0000000000000000-mapping.dmp

Download
memory/4120-189-0x0000000000000000-mapping.dmp

Download
memory/4212-193-0x0000000000000000-mapping.dmp

Download