Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2023, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
Aplicativo.msi
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Aplicativo.msi
Resource
win10v2004-20220812-en
General
-
Target
Aplicativo.msi
-
Size
6.4MB
-
MD5
9775e778c840ebea365009ff78e0f127
-
SHA1
4647585ce90ef3cc299b2a35c50e8a28c1e98f9b
-
SHA256
68b6df03608984d704b949fa4d0bb1de834417fac5c6ad4d0610723ebc6f66c4
-
SHA512
919a679243ff2022361787c9a7bb5c70bfd2125568c2c370d151d8eb0d1a665bb6cc66fe6d820094b52f9ff6e0dff311d85d1c5b3db12469ac6866fbb879a969
-
SSDEEP
98304:k9YAsqg//wYMlviK3mnJre74WU8hNpsQaUicrvbwTVaEfL0OmQ:zgl64OJreMWFN3iSDwRm
Malware Config
Signatures
-
Blocklisted process makes network request 7 IoCs
flow pid Process 9 4544 MsiExec.exe 11 4544 MsiExec.exe 13 4544 MsiExec.exe 138 4544 MsiExec.exe 140 4544 MsiExec.exe 142 4544 MsiExec.exe 145 4544 MsiExec.exe -
Downloads MZ/PE file
-
Executes dropped EXE 32 IoCs
pid Process 4528 MSI918B.tmp 2220 MSIDD35.tmp 4040 MSIDD34.tmp 3420 any.exe 4512 PackagedCWALauncher.exe 4480 any.exe 4196 any.exe 3028 any.exe 2720 AnyDesk.exe 3584 AnyDesk.exe 2560 AnyDesk.exe 4284 msedgerecovery.exe 4208 MicrosoftEdgeUpdateSetup.exe 3972 MicrosoftEdgeUpdate.exe 1940 MicrosoftEdgeUpdate.exe 4860 MicrosoftEdgeUpdate.exe 4184 MicrosoftEdgeUpdateComRegisterShell64.exe 3556 MicrosoftEdgeUpdateComRegisterShell64.exe 2804 MicrosoftEdgeUpdateComRegisterShell64.exe 4488 MicrosoftEdgeUpdate.exe 4872 MicrosoftEdgeUpdate.exe 4628 MicrosoftEdgeUpdate.exe 872 MicrosoftEdgeUpdate.exe 3248 MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe 940 MicrosoftEdgeUpdate.exe 204 MicrosoftEdgeUpdate.exe 1292 MicrosoftEdgeUpdate.exe 4256 MicrosoftEdgeUpdate.exe 3872 MicrosoftEdgeUpdateComRegisterShell64.exe 1004 MicrosoftEdgeUpdateComRegisterShell64.exe 2804 MicrosoftEdgeUpdateComRegisterShell64.exe 4860 MicrosoftEdgeUpdate.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CCB8559-9E10-4759-AEFD-51815C3677E3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation MSI918B.tmp Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation any.exe -
Loads dropped DLL 40 IoCs
pid Process 4544 MsiExec.exe 4544 MsiExec.exe 4544 MsiExec.exe 4544 MsiExec.exe 4544 MsiExec.exe 4544 MsiExec.exe 4544 MsiExec.exe 4544 MsiExec.exe 4544 MsiExec.exe 4544 MsiExec.exe 4544 MsiExec.exe 4544 MsiExec.exe 4512 PackagedCWALauncher.exe 4512 PackagedCWALauncher.exe 3972 MicrosoftEdgeUpdate.exe 1940 MicrosoftEdgeUpdate.exe 4860 MicrosoftEdgeUpdate.exe 4184 MicrosoftEdgeUpdateComRegisterShell64.exe 4860 MicrosoftEdgeUpdate.exe 3556 MicrosoftEdgeUpdateComRegisterShell64.exe 4860 MicrosoftEdgeUpdate.exe 2804 MicrosoftEdgeUpdateComRegisterShell64.exe 4860 MicrosoftEdgeUpdate.exe 4488 MicrosoftEdgeUpdate.exe 4872 MicrosoftEdgeUpdate.exe 4628 MicrosoftEdgeUpdate.exe 4628 MicrosoftEdgeUpdate.exe 4872 MicrosoftEdgeUpdate.exe 872 MicrosoftEdgeUpdate.exe 940 MicrosoftEdgeUpdate.exe 204 MicrosoftEdgeUpdate.exe 1292 MicrosoftEdgeUpdate.exe 4256 MicrosoftEdgeUpdate.exe 3872 MicrosoftEdgeUpdateComRegisterShell64.exe 4256 MicrosoftEdgeUpdate.exe 1004 MicrosoftEdgeUpdateComRegisterShell64.exe 4256 MicrosoftEdgeUpdate.exe 2804 MicrosoftEdgeUpdateComRegisterShell64.exe 4256 MicrosoftEdgeUpdate.exe 4860 MicrosoftEdgeUpdate.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in System32 directory 27 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65DC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriver.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65AA.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65BB.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65AA.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65CC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\AnyDeskPrintDriver-manifest.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65DC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\anydeskprintdriver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65CC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriver-manifest.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\AnyDeskPrintDriver.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65DE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\AnyDeskPrintDriver.gpd DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65DE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65DD.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\anydeskprintdriver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriverRenderFilter.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\AnyDeskPrintDriverRenderFilter.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65BB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\SET65DD.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriver.gpd DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef} DrvInst.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_kk.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Arbyrd\Arcadia\Archie\infoapp\004_3 msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_ja.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_hr.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_quz.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\psuser.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Arbyrd\Arcadia\Archie\msvcr100.dll MsiExec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\NOTICE.TXT MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_kn.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_tt.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_as.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Arbyrd\Arcadia\Archie\PackagedCWALauncher.exe MsiExec.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4484_1096955000\msedgerecovery.exe elevation_service.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_sk.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Arbyrd\Arcadia\Archie\infoapp\005_2 msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_eu.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_hi.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_vi.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_sr-Latn-RS.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Arbyrd\Arcadia\Archie\infoapp\006_5 msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_sl.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_bn.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_vi.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_pa.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\MicrosoftEdgeUpdateSetup.exe MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.171.39\MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe MicrosoftEdgeUpdate.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\psmachine_arm64.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\MicrosoftEdgeUpdateBroker.exe MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_et.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_te.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_sr-Cyrl-RS.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_el.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_km.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_mi.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_zh-CN.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_fi.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\psmachine.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_is.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_eu.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Arbyrd\Arcadia\Archie\infoapp\001_1 msiexec.exe File created C:\Program Files (x86)\Arbyrd\Arcadia\Archie\infoapp\005_1 msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_fr.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_lt.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_gl.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\psmachine_64.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_fa.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\MicrosoftEdgeComRegisterShellARM64.exe MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_ru.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_bn-IN.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_ca.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Arbyrd\Arcadia\Archie\infoapp\006_1 msiexec.exe File created C:\Program Files (x86)\Arbyrd\Arcadia\Archie\infoapp\007_2 msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_hr.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_de.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_et.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_kk.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdate.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\msedgeupdateres_pl.dll MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_gu.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_lv.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_mr.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_ta.dll MicrosoftEdgeUpdateSetup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\msedgeupdateres_fr-CA.dll MicrosoftEdgeUpdateSetup.exe -
Drops file in Windows directory 30 IoCs
description ioc Process File created C:\Windows\Installer\e5683bb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI95C2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI99FE.tmp msiexec.exe File created C:\Windows\Installer\e5683be.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9875.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log rundll32.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI87E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8871.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI918B.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log expand.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{5A529E45-907A-468E-848E-E6CFEEFEBCA5} msiexec.exe File opened for modification C:\Windows\Installer\MSI9798.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI97C8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9B18.tmp msiexec.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI8496.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI87A4.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI9903.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5683bb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9788.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDD35.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log expand.exe File opened for modification C:\Windows\Installer\MSIDBBC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDD34.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString any.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AnyDesk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AnyDesk.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 any.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\msedgeupdate.dll,-3000" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\"" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.169.31\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CurVer\ = "MicrosoftEdgeUpdate.Update3WebSvc.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebSvc.1.0" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService\CLSID\ = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateBroker.exe\"" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CurVer\ = "MicrosoftEdgeUpdate.CredentialDialogMachine.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdate.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 4928 msiexec.exe 4928 msiexec.exe 4616 msedge.exe 4616 msedge.exe 4676 msedge.exe 4676 msedge.exe 3800 identity_helper.exe 3800 identity_helper.exe 4480 any.exe 4480 any.exe 4512 PackagedCWALauncher.exe 4512 PackagedCWALauncher.exe 3028 any.exe 3028 any.exe 3420 any.exe 3420 any.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 4196 any.exe 4196 any.exe 2720 AnyDesk.exe 2720 AnyDesk.exe 3972 MicrosoftEdgeUpdate.exe 3972 MicrosoftEdgeUpdate.exe 3972 MicrosoftEdgeUpdate.exe 3972 MicrosoftEdgeUpdate.exe 3972 MicrosoftEdgeUpdate.exe 3972 MicrosoftEdgeUpdate.exe 4872 MicrosoftEdgeUpdate.exe 4872 MicrosoftEdgeUpdate.exe 4872 MicrosoftEdgeUpdate.exe 4872 MicrosoftEdgeUpdate.exe 4628 MicrosoftEdgeUpdate.exe 4628 MicrosoftEdgeUpdate.exe 204 MicrosoftEdgeUpdate.exe 204 MicrosoftEdgeUpdate.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4512 PackagedCWALauncher.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2548 msiexec.exe Token: SeIncreaseQuotaPrivilege 2548 msiexec.exe Token: SeSecurityPrivilege 4928 msiexec.exe Token: SeCreateTokenPrivilege 2548 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2548 msiexec.exe Token: SeLockMemoryPrivilege 2548 msiexec.exe Token: SeIncreaseQuotaPrivilege 2548 msiexec.exe Token: SeMachineAccountPrivilege 2548 msiexec.exe Token: SeTcbPrivilege 2548 msiexec.exe Token: SeSecurityPrivilege 2548 msiexec.exe Token: SeTakeOwnershipPrivilege 2548 msiexec.exe Token: SeLoadDriverPrivilege 2548 msiexec.exe Token: SeSystemProfilePrivilege 2548 msiexec.exe Token: SeSystemtimePrivilege 2548 msiexec.exe Token: SeProfSingleProcessPrivilege 2548 msiexec.exe Token: SeIncBasePriorityPrivilege 2548 msiexec.exe Token: SeCreatePagefilePrivilege 2548 msiexec.exe Token: SeCreatePermanentPrivilege 2548 msiexec.exe Token: SeBackupPrivilege 2548 msiexec.exe Token: SeRestorePrivilege 2548 msiexec.exe Token: SeShutdownPrivilege 2548 msiexec.exe Token: SeDebugPrivilege 2548 msiexec.exe Token: SeAuditPrivilege 2548 msiexec.exe Token: SeSystemEnvironmentPrivilege 2548 msiexec.exe Token: SeChangeNotifyPrivilege 2548 msiexec.exe Token: SeRemoteShutdownPrivilege 2548 msiexec.exe Token: SeUndockPrivilege 2548 msiexec.exe Token: SeSyncAgentPrivilege 2548 msiexec.exe Token: SeEnableDelegationPrivilege 2548 msiexec.exe Token: SeManageVolumePrivilege 2548 msiexec.exe Token: SeImpersonatePrivilege 2548 msiexec.exe Token: SeCreateGlobalPrivilege 2548 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe Token: SeRestorePrivilege 4928 msiexec.exe Token: SeTakeOwnershipPrivilege 4928 msiexec.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
pid Process 2548 msiexec.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe 2548 msiexec.exe 4196 any.exe 4196 any.exe 4196 any.exe 3584 AnyDesk.exe 3584 AnyDesk.exe 3584 AnyDesk.exe 4196 any.exe 4196 any.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 4196 any.exe 4196 any.exe 4196 any.exe 3584 AnyDesk.exe 3584 AnyDesk.exe 3584 AnyDesk.exe 4196 any.exe 4196 any.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 4544 4928 msiexec.exe 84 PID 4928 wrote to memory of 4544 4928 msiexec.exe 84 PID 4928 wrote to memory of 4544 4928 msiexec.exe 84 PID 4928 wrote to memory of 4528 4928 msiexec.exe 85 PID 4928 wrote to memory of 4528 4928 msiexec.exe 85 PID 4928 wrote to memory of 4528 4928 msiexec.exe 85 PID 4528 wrote to memory of 4676 4528 MSI918B.tmp 86 PID 4528 wrote to memory of 4676 4528 MSI918B.tmp 86 PID 4676 wrote to memory of 4744 4676 msedge.exe 87 PID 4676 wrote to memory of 4744 4676 msedge.exe 87 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4304 4676 msedge.exe 90 PID 4676 wrote to memory of 4616 4676 msedge.exe 91 PID 4676 wrote to memory of 4616 4676 msedge.exe 91 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92 PID 4676 wrote to memory of 4300 4676 msedge.exe 92
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Aplicativo.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2548
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 55110CC736C135EE25DFB81BD722616F2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
PID:4544
-
-
C:\Windows\Installer\MSI918B.tmp"C:\Windows\Installer\MSI918B.tmp" http://bit.ly/3VNrTvV2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/3VNrTvV3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xc0,0x104,0x7ffa6dc246f8,0x7ffa6dc24708,0x7ffa6dc247184⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:24⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:84⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:14⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:14⤵PID:1292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 /prefetch:84⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:14⤵PID:2528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5668 /prefetch:84⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:14⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:14⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:84⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵PID:720
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ff732515460,0x7ff732515470,0x7ff7325154805⤵PID:1964
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5264 /prefetch:84⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3212 /prefetch:84⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3712 /prefetch:84⤵PID:3056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:84⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:84⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3684 /prefetch:84⤵PID:4296
-
-
-
-
C:\Windows\Installer\MSIDD35.tmp"C:\Windows\Installer\MSIDD35.tmp" /HideWindow schtasks.exe /run /tn PackagedCWALauncher2⤵
- Executes dropped EXE
PID:2220
-
-
C:\Windows\Installer\MSIDD34.tmp"C:\Windows\Installer\MSIDD34.tmp" /DontWait /dir "C:\Program Files (x86)\Arbyrd\Arcadia\Archie\" "C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe"2⤵
- Executes dropped EXE
PID:4040
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2216
-
C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe"C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3420 -
C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe"C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe" --local-service2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4480
-
-
C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe"C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe" --local-control2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4196
-
-
C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe"C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --install-driver:printer --update-main --svc-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf" --sys-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3028 -
C:\Windows\SysWOW64\expand.exeexpand -F:* "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver"3⤵
- Drops file in Windows directory
PID:1744
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"3⤵
- Drops file in Windows directory
- Modifies system certificate store
PID:3296
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /run /tn PackagedCWALauncher1⤵PID:1548
-
C:\Program Files (x86)\Arbyrd\Arcadia\Archie\PackagedCWALauncher.exe"C:\Program Files (x86)\Arbyrd\Arcadia\Archie\PackagedCWALauncher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4512
-
C:\Program Files (x86)\AnyDesk\AnyDesk.exe"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2720
-
C:\Program Files (x86)\AnyDesk\AnyDesk.exe"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3584
-
C:\Program Files (x86)\AnyDesk\AnyDesk.exe"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-install1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5024 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b7ef6422-815c-6842-b60f-8ea61a9406c9}\anydeskprintdriver.inf" "9" "49a18f3d7" "0000000000000150" "WinSta0\Default" "0000000000000134" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2748 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{fd3a6c2e-f53c-f74f-ab0d-982e946ea074} Global\{e0078771-a395-b04e-b8e0-7b32eefdb86b} C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\anydeskprintdriver.inf C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\AnyDeskPrintDriver.cat3⤵PID:3872
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Drops file in Program Files directory
PID:4484 -
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4484_1096955000\msedgerecovery.exe"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4484_1096955000\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.67 --sessionid={7ad5b235-bc4a-4d5e-9fab-6b406221e520} --system2⤵
- Executes dropped EXE
PID:4284 -
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4484_1096955000\MicrosoftEdgeUpdateSetup.exe"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4484_1096955000\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4208 -
C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent4⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3972 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1940
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4860 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4184
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:3556
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2804
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REQ0ODhEODktNDlGNi00ODg1LTk3NkItQUYyN0NFMDc5MEU5fSIgdXNlcmlkPSJ7QzExQzU5MEItMzBFMy00RDNDLUI2MzAtOEIzQ0EwNTMxQjk4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezRBMzVDQ0NCLTI0NEYtNDBCQi1CMkM4LThCOTMzRjY5MDZGRX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7bTQ2SzVLNXoxdnZrTkxIcjRjMXgvaENqZTdaUUxkcUt5WjVOd2d6VjNBOD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE2OS4zMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTkxNzY3MjA5NyIgaW5zdGFsbF90aW1lX21zPSI2NzYiLz48L2FwcD48L3JlcXVlc3Q-5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4488
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4872
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4628 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDFDOTFEOUYtMzYyMi00QzcxLUJCMTItNjdGOTUxNDhBQTI0fSIgdXNlcmlkPSJ7QzExQzU5MEItMzBFMy00RDNDLUI2MzAtOEIzQ0EwNTMxQjk4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezgwNTIxNTYzLUQ2ODQtNDlCNS1BODQ3LUJBMEFDMTI2M0QwMn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cVdKU3pXd1BmZGNMUitYR0l2NnhyWmZpWU94aFBVMnMxTldtaldjYUZQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iODkuMC40Mzg5LjExNCIgbmV4dHZlcnNpb249Ijg5LjAuNDM4OS4xMTQiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDI0MTYwNTY3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BB95670-9B97-4322-AC21-ED3A3E47C7A9}\MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BB95670-9B97-4322-AC21-ED3A3E47C7A9}\MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe" /update /sessionid "{41C91D9F-3622-4C71-BB12-67F95148AA24}"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3248 -
C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{41C91D9F-3622-4C71-BB12-67F95148AA24}"3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:204 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1292
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4256 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:3872
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:1004
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:2804
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDFDOTFEOUYtMzYyMi00QzcxLUJCMTItNjdGOTUxNDhBQTI0fSIgdXNlcmlkPSJ7QzExQzU5MEItMzBFMy00RDNDLUI2MzAtOEIzQ0EwNTMxQjk4fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7QUJDOUUzMDctMkREMy00N0Y2LTk5QzUtMzgwMjU0OTlFQTg4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTY5LjMxIiBuZXh0dmVyc2lvbj0iMS4zLjE3MS4zOSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjaHJvbWVyZWMzPTIwMjMwMlIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTY3MzQzNjMwNiI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ3MTk4NDU0OCIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4860
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDFDOTFEOUYtMzYyMi00QzcxLUJCMTItNjdGOTUxNDhBQTI0fSIgdXNlcmlkPSJ7QzExQzU5MEItMzBFMy00RDNDLUI2MzAtOEIzQ0EwNTMxQjk4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezMxQ0RGQjAyLTEyMTAtNEYxRS1BNkJBLTI2NjNCODlFRjc0N30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE2OS4zMSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iUHJvZHVjdHNUb1JlZ2lzdGVyPSU3QkYzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNSU3RDtjaHJvbWVyZWMzPTIwMjMwMlIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0Mzk2MzAxMzgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQzOTk0MTkzMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ0NjE5MjM3MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2RiOGM1YmY1LThmNmItNDMxMS1iMTU4LWI2YzRkYTNhZDBkMj9QMT0xNjc0MDM3NTYwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWNwR0gxNFFLWEwyeUt3dmY5V09MbmVYbmc4MyUyYk5mMHZyNVFNMHprQ0NqeG9uNTlQb2FOUFRmMGxSWFVKWHIzVEtwenh6SWo2cXFKMHZKUnBDcmh4bEElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDQ2MTkyMzcwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9kYjhjNWJmNS04ZjZiLTQzMTEtYjE1OC1iNmM0ZGEzYWQwZDI_UDE9MTY3NDAzNzU2MCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1jcEdIMTRRS1hMMnlLd3ZmOVdPTG5lWG5nODMlMmJOZjB2cjVRTTB6a0NDanhvbjU5UG9hTlBUZjBsUlhVSlhyM1RLcHp4eklqNnFxSjB2SlJwQ3JoeGxBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTU4NzE2MCIgdG90YWw9IjE1ODcxNjAiIGRvd25sb2FkX3RpbWVfbXM9IjM1OSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDQ2MzQ4NTM2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0NTE4MTc2NDIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48cGluZyByPSIxNTEiIHJkPSI1NzAzIiBwaW5nX2ZyZXNobmVzcz0iezAwRTEzNkNFLUNCM0EtNDJDNC05OTU3LTkxMTNBNDZCQUIzRn0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzMTc5MDk3MjgzODk0NzUwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9IjE1MSIgYWQ9Ii0xIiByZD0iNTcwMyIgcGluZ19mcmVzaG5lc3M9Ins3QzM5RDUwQy05N0RCLTQ1MjUtQkExMi0zRTEyQTYzNTg1QjF9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD5ef3e115c225588a680acf365158b2f4a
SHA1ecda6d3b4642d2451817833b39248778e9c2cbb0
SHA25625d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
SHA512d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a
-
Filesize
16KB
MD5d10706dac1ec9ca4a80830df17bc4012
SHA1b98c90460cfef059434b266dbed5c6a75a67d3d9
SHA256eb57f739dc64a239bd8e131d4abf3d551440a47aff678ca8b9a46f70de60371e
SHA51241f3574b867870d057988739cecda0eeeba58b7b09d87417d7deef185904188fd36478e0b6c9e7241f88d4a7029238d526a7862349e6a34d9367f876c2957dd6
-
Filesize
16KB
MD5d10706dac1ec9ca4a80830df17bc4012
SHA1b98c90460cfef059434b266dbed5c6a75a67d3d9
SHA256eb57f739dc64a239bd8e131d4abf3d551440a47aff678ca8b9a46f70de60371e
SHA51241f3574b867870d057988739cecda0eeeba58b7b09d87417d7deef185904188fd36478e0b6c9e7241f88d4a7029238d526a7862349e6a34d9367f876c2957dd6
-
Filesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
Filesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
Filesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
Filesize
3.8MB
MD59a1d9fe9b1223273c314632d04008384
SHA1665cad3ed21f6443d1adacf18ca45dfaa8f52c99
SHA2560f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359
SHA5123ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5
-
Filesize
4.2MB
MD5bf5ecef4749f7cf4b1665904594ad132
SHA1262ce964149908054d6a978fa8332b8179f50847
SHA2561543fed94c78df0101171f04da73604f7b163f2c7bb01f6d7e7e5eac291aca8e
SHA51208bd4b95a079b7607678f6b9cb5cd748c80e4cf71b89ff4b5ea6fb88e6250c4b584386a6ce4030f114e8387a3f435a54d209ea00aac792ebafa93e270f07e3ca
-
Filesize
4.2MB
MD5bf5ecef4749f7cf4b1665904594ad132
SHA1262ce964149908054d6a978fa8332b8179f50847
SHA2561543fed94c78df0101171f04da73604f7b163f2c7bb01f6d7e7e5eac291aca8e
SHA51208bd4b95a079b7607678f6b9cb5cd748c80e4cf71b89ff4b5ea6fb88e6250c4b584386a6ce4030f114e8387a3f435a54d209ea00aac792ebafa93e270f07e3ca
-
Filesize
756KB
MD5ef3e115c225588a680acf365158b2f4a
SHA1ecda6d3b4642d2451817833b39248778e9c2cbb0
SHA25625d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
SHA512d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a
-
Filesize
9KB
MD5403c971784ac3f9a35c1f5745fa74379
SHA1c63a9566a37c6af361284c693c6e8e3e655f5d46
SHA256c224d6617b7c9330a8eb2002ce9fa528fa3530c0d0ce011e5c5f6dba3859d7f0
SHA5127b60c8f52b911cde5fec892015699395ecfdc53f9b0a808d4660ea85844598aec2d93ed049c3880b52a0667a15048c7ebf591f0fc78d4679d9def0f5e94ca886
-
Filesize
9KB
MD5403c971784ac3f9a35c1f5745fa74379
SHA1c63a9566a37c6af361284c693c6e8e3e655f5d46
SHA256c224d6617b7c9330a8eb2002ce9fa528fa3530c0d0ce011e5c5f6dba3859d7f0
SHA5127b60c8f52b911cde5fec892015699395ecfdc53f9b0a808d4660ea85844598aec2d93ed049c3880b52a0667a15048c7ebf591f0fc78d4679d9def0f5e94ca886
-
Filesize
2KB
MD54677e83279429923a594e48152970398
SHA11895a32bb4dae950322311cb2efe10e0fc196d53
SHA256cd6b9dc5a6b33c79a078204f9dfbf8a4872f60bbb0b1de8f921bcad789798948
SHA512390878d9ca1d1ae88c1e3c264587c4f508fa880c40c387111e568ab42119eed7d03a80bbf9eb111c40329f683adc4d57eec6b50a07d1e13b2cde9effbcb16707
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD5ef6d05f1243987733ca566e64e1d647a
SHA165b35ad51b94a8673694903c072dcd199ab8600f
SHA2566edd46335f840ca162169e6766d7a01a10bdffc77c60185fe775e3c3dcdf6e57
SHA5127d4aad5a1d98d499d5bda2c2863489b0b8be7385f37d4ec93f0d83046ca9d3adf32a5af19a2a722ad48192e3d785a78501a41ed80d5ee4a1477cbb3cddb39f38
-
Filesize
424B
MD5439d4e6a07b734ec262050a7113c8b98
SHA1cb35de864cd0f3dd59d49740326186d41c3d496b
SHA2566b7cce7c285a1d6244170a84556b4abb8872953f3cfe9e70ca99a382caf4a93d
SHA512ba6a030596cdd078c568cb8c48026caa767b04ebbad1eb04e1b99bc657f73cf5d11c9add7672ad6cd048ff54d156f92164b84a1530e9816a7232eec12a6f21ff
-
Filesize
1KB
MD55db1fcd45f9b948993e57756c173907e
SHA1358c54b7eae659a2b1c21dd7aa5cf35855acf11f
SHA2560d95073b3d1c5afef02378dbf2596be3f65dbb388005abe66833e3f998d7229c
SHA5120403c7a8ac468d030215295e472fb07580e2e1d5c14805176b8231d4da0244bbe218238dc95604bb18b3a2d9f6aa83aaa1751c16fe83db5aa7e5d7d44c127462
-
Filesize
1KB
MD55db1fcd45f9b948993e57756c173907e
SHA1358c54b7eae659a2b1c21dd7aa5cf35855acf11f
SHA2560d95073b3d1c5afef02378dbf2596be3f65dbb388005abe66833e3f998d7229c
SHA5120403c7a8ac468d030215295e472fb07580e2e1d5c14805176b8231d4da0244bbe218238dc95604bb18b3a2d9f6aa83aaa1751c16fe83db5aa7e5d7d44c127462
-
Filesize
1KB
MD5056b1691f5ca79325c72b81ca47d61b8
SHA1f340c6ac5bc3772130d1c29fd022a18aabd1f875
SHA256140e4a0baf9cc077475b802251ad85a8fd595478392adfcf88ddfb465873cee9
SHA512fb6ff3f1a4ebbc8d1f743213fc8f0dca7896f459f16d635f288ba267757361bd799217eb6f19663f023bc4b2286c3212e1a515cce70b32e1d72be62b25131057
-
Filesize
1KB
MD5056b1691f5ca79325c72b81ca47d61b8
SHA1f340c6ac5bc3772130d1c29fd022a18aabd1f875
SHA256140e4a0baf9cc077475b802251ad85a8fd595478392adfcf88ddfb465873cee9
SHA512fb6ff3f1a4ebbc8d1f743213fc8f0dca7896f459f16d635f288ba267757361bd799217eb6f19663f023bc4b2286c3212e1a515cce70b32e1d72be62b25131057
-
Filesize
1KB
MD5056b1691f5ca79325c72b81ca47d61b8
SHA1f340c6ac5bc3772130d1c29fd022a18aabd1f875
SHA256140e4a0baf9cc077475b802251ad85a8fd595478392adfcf88ddfb465873cee9
SHA512fb6ff3f1a4ebbc8d1f743213fc8f0dca7896f459f16d635f288ba267757361bd799217eb6f19663f023bc4b2286c3212e1a515cce70b32e1d72be62b25131057
-
Filesize
1KB
MD5358abe004494ec57692ea84fd280ef79
SHA14e84e9e0efd32564120f73674341306e01df78e5
SHA2564f7839558aa3605c2087965896b0f9b4643a54202d80a8e4a140207a676f6361
SHA512c26bac1cf65b4664de001ab583c5913bb46f7d89f638558ed88f7b45fa85d87ea30f5208b2b23a5c358138a9594d2536f132165b763edb584333ceb0ec529aa9
-
Filesize
337KB
MD5dfe7442a09a0809f22e0806040a0202e
SHA1e6f76a86fa46e8e2c659c1c326457e6eb6b253f6
SHA2561cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d
SHA512331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197
-
Filesize
337KB
MD5dfe7442a09a0809f22e0806040a0202e
SHA1e6f76a86fa46e8e2c659c1c326457e6eb6b253f6
SHA2561cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d
SHA512331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197
-
Filesize
337KB
MD5dfe7442a09a0809f22e0806040a0202e
SHA1e6f76a86fa46e8e2c659c1c326457e6eb6b253f6
SHA2561cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d
SHA512331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197
-
Filesize
337KB
MD5dfe7442a09a0809f22e0806040a0202e
SHA1e6f76a86fa46e8e2c659c1c326457e6eb6b253f6
SHA2561cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d
SHA512331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197
-
Filesize
337KB
MD5dfe7442a09a0809f22e0806040a0202e
SHA1e6f76a86fa46e8e2c659c1c326457e6eb6b253f6
SHA2561cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d
SHA512331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197
-
Filesize
337KB
MD5dfe7442a09a0809f22e0806040a0202e
SHA1e6f76a86fa46e8e2c659c1c326457e6eb6b253f6
SHA2561cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d
SHA512331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197
-
Filesize
611KB
MD5d8d35c923abf8429b35edcd43fbb803a
SHA15184cd865807409c4e9ef0768f58c5fe68d897ff
SHA2563ab49159965665944c8653c74ad21a4fa2ae807e7c0af6e069e71eae46155070
SHA512c45f166b0fc04fc1ea6f15294879f2692ea2ed8efb773a57e7a08802824de87ed6d6d28bcd6b723884638450da5e470c9ac703076cd4797de84bc4b7b182a7e6
-
Filesize
611KB
MD5d8d35c923abf8429b35edcd43fbb803a
SHA15184cd865807409c4e9ef0768f58c5fe68d897ff
SHA2563ab49159965665944c8653c74ad21a4fa2ae807e7c0af6e069e71eae46155070
SHA512c45f166b0fc04fc1ea6f15294879f2692ea2ed8efb773a57e7a08802824de87ed6d6d28bcd6b723884638450da5e470c9ac703076cd4797de84bc4b7b182a7e6
-
Filesize
107KB
MD547eb3f90716249abe63ae508e1da718a
SHA1a31d824596f752a5fa613b3f96d19f1eb08f3f77
SHA25669aeb1df4ddf4147938428839bf8af58bcbfb2eda5ce2cc34d4d2bb769b687ac
SHA512b0732a8d26b66dc42eb14bb6dadbe865e394cb88154599fdd2590d267b05c9038e1bf1685a39c8930de08126ba9a0cb9b7b20ec69bb805a88ed5f9ba29b1a0a0
-
Filesize
337KB
MD5dfe7442a09a0809f22e0806040a0202e
SHA1e6f76a86fa46e8e2c659c1c326457e6eb6b253f6
SHA2561cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d
SHA512331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197
-
Filesize
337KB
MD5dfe7442a09a0809f22e0806040a0202e
SHA1e6f76a86fa46e8e2c659c1c326457e6eb6b253f6
SHA2561cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d
SHA512331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197
-
Filesize
137KB
MD55d18d6ef2ea0a99a9a51e7411c74f764
SHA1d694d2d5d9548b3ed921f5eda9024be5bcff71a3
SHA256a04899b8472b24e658219a6f7f280d2deda028b440aa261a9f49a0c14ac3830c
SHA51267d034beef69534cd77d082bee36d5ff2f22a7b194422357461353b491d92bf3be24ef1f58c507a44649f3685e389d57fa23f5baa1ca7314fd9376d878a99d00
-
Filesize
137KB
MD55d18d6ef2ea0a99a9a51e7411c74f764
SHA1d694d2d5d9548b3ed921f5eda9024be5bcff71a3
SHA256a04899b8472b24e658219a6f7f280d2deda028b440aa261a9f49a0c14ac3830c
SHA51267d034beef69534cd77d082bee36d5ff2f22a7b194422357461353b491d92bf3be24ef1f58c507a44649f3685e389d57fa23f5baa1ca7314fd9376d878a99d00
-
Filesize
177KB
MD5fec86737e209820ab1d8200164d62c9f
SHA1a4b22cd2c7c4d40df2e106064ea3bc4108764e5f
SHA25689bdcea03c659f63f307629e11254191a290f62e05f465245cbae2f37d2bccf1
SHA51223e31eb641a61fff1c80a8088fa296516e409b099c8643300326611aabbcf333fcc084607a00bf9376dffa7eb3b46c2ef931a8e61ecbb416832b35f02c0ae954
-
Filesize
177KB
MD5fec86737e209820ab1d8200164d62c9f
SHA1a4b22cd2c7c4d40df2e106064ea3bc4108764e5f
SHA25689bdcea03c659f63f307629e11254191a290f62e05f465245cbae2f37d2bccf1
SHA51223e31eb641a61fff1c80a8088fa296516e409b099c8643300326611aabbcf333fcc084607a00bf9376dffa7eb3b46c2ef931a8e61ecbb416832b35f02c0ae954
-
Filesize
477KB
MD5a267b52453fb899a95b14c8e4dca1073
SHA1e22e41dc79e782019c7275ed9a76739ee391b17e
SHA256dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7
SHA512829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f
-
Filesize
477KB
MD5a267b52453fb899a95b14c8e4dca1073
SHA1e22e41dc79e782019c7275ed9a76739ee391b17e
SHA256dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7
SHA512829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f
-
Filesize
477KB
MD5a267b52453fb899a95b14c8e4dca1073
SHA1e22e41dc79e782019c7275ed9a76739ee391b17e
SHA256dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7
SHA512829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f
-
Filesize
477KB
MD5a267b52453fb899a95b14c8e4dca1073
SHA1e22e41dc79e782019c7275ed9a76739ee391b17e
SHA256dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7
SHA512829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f
-
Filesize
177KB
MD5fec86737e209820ab1d8200164d62c9f
SHA1a4b22cd2c7c4d40df2e106064ea3bc4108764e5f
SHA25689bdcea03c659f63f307629e11254191a290f62e05f465245cbae2f37d2bccf1
SHA51223e31eb641a61fff1c80a8088fa296516e409b099c8643300326611aabbcf333fcc084607a00bf9376dffa7eb3b46c2ef931a8e61ecbb416832b35f02c0ae954
-
Filesize
177KB
MD5fec86737e209820ab1d8200164d62c9f
SHA1a4b22cd2c7c4d40df2e106064ea3bc4108764e5f
SHA25689bdcea03c659f63f307629e11254191a290f62e05f465245cbae2f37d2bccf1
SHA51223e31eb641a61fff1c80a8088fa296516e409b099c8643300326611aabbcf333fcc084607a00bf9376dffa7eb3b46c2ef931a8e61ecbb416832b35f02c0ae954
-
Filesize
477KB
MD5a267b52453fb899a95b14c8e4dca1073
SHA1e22e41dc79e782019c7275ed9a76739ee391b17e
SHA256dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7
SHA512829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f
-
Filesize
477KB
MD5a267b52453fb899a95b14c8e4dca1073
SHA1e22e41dc79e782019c7275ed9a76739ee391b17e
SHA256dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7
SHA512829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f
-
Filesize
477KB
MD5a267b52453fb899a95b14c8e4dca1073
SHA1e22e41dc79e782019c7275ed9a76739ee391b17e
SHA256dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7
SHA512829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f
-
Filesize
477KB
MD5a267b52453fb899a95b14c8e4dca1073
SHA1e22e41dc79e782019c7275ed9a76739ee391b17e
SHA256dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7
SHA512829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f
-
Filesize
107KB
MD547eb3f90716249abe63ae508e1da718a
SHA1a31d824596f752a5fa613b3f96d19f1eb08f3f77
SHA25669aeb1df4ddf4147938428839bf8af58bcbfb2eda5ce2cc34d4d2bb769b687ac
SHA512b0732a8d26b66dc42eb14bb6dadbe865e394cb88154599fdd2590d267b05c9038e1bf1685a39c8930de08126ba9a0cb9b7b20ec69bb805a88ed5f9ba29b1a0a0
-
Filesize
107KB
MD547eb3f90716249abe63ae508e1da718a
SHA1a31d824596f752a5fa613b3f96d19f1eb08f3f77
SHA25669aeb1df4ddf4147938428839bf8af58bcbfb2eda5ce2cc34d4d2bb769b687ac
SHA512b0732a8d26b66dc42eb14bb6dadbe865e394cb88154599fdd2590d267b05c9038e1bf1685a39c8930de08126ba9a0cb9b7b20ec69bb805a88ed5f9ba29b1a0a0