hxxps://mega[.]nz/#!EkQjWIAD!-xeWeBmTJQPsCtNvYIl5M24JHwa_sxPhO-WV-xVBMys

Analysis

max time kernel
307s
max time network
298s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19/09/2023, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/#!EkQjWIAD!-xeWeBmTJQPsCtNvYIl5M24JHwa_sxPhO-WV-xVBMys

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4964	setup.exe
804	setup.exe.tmp

Loads dropped DLL 4 IoCs

pid	Process
804	setup.exe.tmp
804	setup.exe.tmp
804	setup.exe.tmp
804	setup.exe.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\is-AVAHE.tmp	setup.exe.tmp
File created	C:\Windows\SysWOW64\is-JP51M.tmp	setup.exe.tmp

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Antares Audio Technologies\Uninstall\RCXE396.tmp	setup.exe.tmp
File opened for modification	C:\Program Files (x86)\Antares Audio Technologies\Uninstall\is-K0NCT.tmp	setup.exe.tmp
File created	C:\Program Files (x86)\Steinberg\VstPlugins\is-4IKRU.tmp	setup.exe.tmp
File created	C:\Program Files (x86)\Antares Audio Technologies\Auto-Tune Evo\is-N6V52.tmp	setup.exe.tmp
File opened for modification	C:\Program Files (x86)\Antares Audio Technologies\Uninstall\unins000.dat	setup.exe.tmp
File created	C:\Program Files (x86)\Antares Audio Technologies\Uninstall\unins000.dat	setup.exe.tmp
File created	C:\Program Files (x86)\Antares Audio Technologies\Uninstall\is-K0NCT.tmp	setup.exe.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133396136854940853"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packag = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 577a71f814ebd901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 23bf9cf814ebd901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{60E59F60-1096-4898-977D-567980D5B72B} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d3ac56f814ebd901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4536	NOTEPAD.EXE
2116	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4868	chrome.exe
4868	chrome.exe
696	chrome.exe
696	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2004	msinfo32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4644	MicrosoftEdgeCP.exe
4644	MicrosoftEdgeCP.exe
4644	MicrosoftEdgeCP.exe
4644	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4868	chrome.exe
4868	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: 33	2532	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2532	AUDIODG.EXE
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
604	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4856	MicrosoftEdge.exe
4644	MicrosoftEdgeCP.exe
1520	MicrosoftEdgeCP.exe
4644	MicrosoftEdgeCP.exe
804	setup.exe.tmp
804	setup.exe.tmp
804	setup.exe.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 3272	4868	chrome.exe	70
PID 4868 wrote to memory of 3272	4868	chrome.exe	70
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 4908	4868	chrome.exe	73
PID 4868 wrote to memory of 3688	4868	chrome.exe	72
PID 4868 wrote to memory of 3688	4868	chrome.exe	72
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74
PID 4868 wrote to memory of 3968	4868	chrome.exe	74

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/#!EkQjWIAD!-xeWeBmTJQPsCtNvYIl5M24JHwa_sxPhO-WV-xVBMys
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe61389758,0x7ffe61389768,0x7ffe61389778
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4892 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1804,i,16406602729310242274,10873352019981136536,131072 /prefetch:8
  2⤵
  PID:3032

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3408

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x414
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1212

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\" -spe -an -ai#7zMap12431:170:7zEvent3795
1⤵
- Suspicious use of FindShellTrayWindow
PID:604

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\READ ME.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4536

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4204

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4644

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1520

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1296

C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\Software Files\setup.exe
"C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\Software Files\setup.exe"
1⤵
- Executes dropped EXE
PID:4964
- C:\Users\Admin\AppData\Local\Temp\is-O1NMS.tmp\setup.exe.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O1NMS.tmp\setup.exe.tmp" /SL5="$901E0,4131844,104448,C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\Software Files\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:804

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\Software Files\Credits.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2116

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\Software Files\air.nfo"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Antares Audio Technologies\Uninstall\unins000.exe

Filesize
1.6MB

MD5
d8dca33777a18a676c0f4a0ac482271c

SHA1
d3d18721ecfd9f70519d838bd69c0836922c2723

SHA256
bb634b5e55849f79609c6bea2c347c64d4bebcf8ebf9dd36362553f2fe292a6f

SHA512
7d0dd4070a1c1c089c6fdc29ea680c0e1ac785c59ace255d5ddf9ef413d2322a78932819084dca55e067b7a1a9077f46eb4be711ae8f79789458e2e4463e6727

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
a1a844f011d920f0def268c5da6b5a1e

SHA1
8585d9e74c9f3bec80f87424bda59633e46d038a

SHA256
8470b54c50d666608001ac466c4c388698e80342f3a075fdd955ae9398536f55

SHA512
486f1970c46b12f5642d9a54130721679f66795b3b4e58022fc9ba08702e1c7e323a35bf26b8e51597d22388664902d42d69b6ca83a6634872657aa9627ad48b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
707cba56b61bfff6db972e639bdb6600

SHA1
2e1c39fb6889069bbd386e26f21b7215f60f2746

SHA256
574f50dbb506cde43096b2a0cd29b139ad413687b1bb889d6a0a721f812211bf

SHA512
ad0ae03600594fedfde7087d1f6315fbd8bfb4976a6911f679cc7ccb9ede96c316e98ef5b6d2928aee66857e28d0e8995744c7d4c5e5019c8402b276574d0d4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
536B

MD5
b24209bc1178fa079e0635b6badea454

SHA1
9d20fa96014d18ea4e168617217e92630ba33682

SHA256
85364a28a4e8c8acbdb3857bda047297ecb80f48226847b0f341849a89f423d8

SHA512
f98281785e7ebe02539762b868f174e5c0baffa373b51d53656ec1ff07be5b71f8a4e2ee7c65393df97b135f69ee5754ac3c0e25783ac1be775fa29f1df7428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4ae9c9104d6c43b12323e51369990799

SHA1
5a1f98d5d8771417a725776ec46a038d8f707964

SHA256
4900031f889290c0fb4f464459e927989f18f9e25f8fc07f4fbd65b916ee03cc

SHA512
50c767648518c5cf93bf4ed2141ede0c49c051fcc5d2b685ed3c4872de20b41316b5347582cf762d223ca2083530f6e1a5d82ae55910024c33d5c97675721a38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
659d42cae48bffa740708a59a71fc6eb

SHA1
4e25577661faff38b2680c89941c546bd5f97653

SHA256
f35597aa7620b8438097ee7634c0d153fae893d90d2c2587f4c07b89de3bf097

SHA512
c8b916f9ca038e58b7c3da963c39e57983a5c865e6317feecebcbef1affcffad8415ffb00f88899e69f2683eaa3637fc1b11020e12049a7f25f14819450b2c57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0db4a173282380f683db6be58b478b7a

SHA1
6fa8522509f4717263b6e82cbaa54eebbe552e7e

SHA256
e5ff2db222001d57fc2a5fb044bec25e2a33ec77f91832cb57ac012a48995218

SHA512
5e8f8b2de7c166a776d8e6fb9f1d754b7416efdbfb326773866778eaf7bba3a9e173809f9b7e5c20c6a5a699e00e69a100a1191b9afd85a3ce7801fc8d4ff1c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ce8ec970b42a0cfe72dfa68bd59e8a2d

SHA1
a73f4fc95f3b067c2405cfd8492d0371c590fd3a

SHA256
6b4d887431a6be9494394c6b6d16c2e78281274e26e5629681bce099844d93c6

SHA512
7e3e5a16e328818e496bdcda8b5bd0c78d64abbb4dafae0cb473c7834b978c9ef313b79ebb39e1c8cdb4b12611759b93deb378ce5774bab49632602cb973513a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
843d9e15ca73835be82397b56909fef7

SHA1
7720f269323f0f71d979e5a6093252555341f825

SHA256
38f70904acf1fa5315b40dcf636f43b9cd38c68ad5e79865d2d809ded2a22720

SHA512
54e3ae4e7e9f4f3515d56a77528d9df62dff1dfc28137c1ea27879a6f2aefacbfb3a6a6fb3af94eaa920f06df3b4365c57819f37a39f339fcab974179e1dfa7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5808a6.TMP

Filesize
48B

MD5
be7ac84499505d47be5ec3c100fc9f85

SHA1
43cb10e0a9234bef42b96da611831264e4991f3c

SHA256
6129a920ad4c4b51538f27ab2f3092de1e9886a611fbbf014b5361a2a49bc1ee

SHA512
4fc072f1e079097aa8dff84b3daf7c55b76375eda58b425b48b8b4383ad9c75766b405fc77139d5ccd43586c72e0e499a9fcbea8f656331615b2f056f0809d6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
102KB

MD5
6e16b9e65281ac8532ce724c065eb631

SHA1
2fb95cc94886fd835f385d264563a9c0f89e8f97

SHA256
3ede60fd8322a3cb95989ae456fd61520b0b1f89d2a0867762b1b3e87fccafb4

SHA512
17f66e6a4d820ef756ce035a688d92e943d515140a7d94b66e86686fdbac0a8105624b34ad079eb1a0ab45f159e2a840515fe558910e674f42e0b2d99c062aa0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
1331daed3dc4ebdbe92e147e34859945

SHA1
17aed14497f9b04bea95f035f2f5281313ca70ab

SHA256
ad0516ff93823379075133fc457cfedb05772c83cd63554579d0dc65a3a60eb8

SHA512
fd8b245dd8c090d87fd04a5bc544390e60e4a5b7e6af8b5253af718773b8e891e71a842ced2acaf25ee80cf4cd25d1b63873e364ad4fea77d3ff22357a6b593a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
104KB

MD5
178f5eaba8da42eb41d40030116595b4

SHA1
d5dd4256e5a1d26c2506309e4b9ae93212e0e27b

SHA256
c210f58d699ca932bac7045a6164763af252fd3c0f8ac92138ff6b0b4f066b82

SHA512
65dc6f18b1ee859c3207fb053c47903047145f6d6aa62fe829b038d33865f4c7b297b4cbf389569d154d29c7327068b8a93f2863689cff101307ed1e99f86833

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580589.TMP

Filesize
93KB

MD5
34cd7df6a8fa8dd4cc7aa17d2f5c06de

SHA1
371ad5ebee8963a1cb1acce2b8aa0c64c12442da

SHA256
39f25c5b1fb6d12d715251bd3e43a34113c6b147eb04b593b5ef5b368570d9b1

SHA512
100ca0c273b400373052d5fd8604cebc282003c838b30a985d28c160fdd17b1508967352480520a71323ba5f3098488b69b81b0a5159dad78d345df4426be685

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\QNDJD9BO\MySoftwareFree-Mobile-Logo[1].png

Filesize
627B

MD5
bcedb1dc8c4222414fa9baff2b501a5e

SHA1
98bc135ba55b4810c373bef0441b164864c98cca

SHA256
8f259747153b86b2e7e5418ca64161b9e78de4e7001bc4fdcf5e08ea441c3277

SHA512
7fb93af4eb163682dfa62f532389aa93480e1bca2c395510d557d2d2b8942c4ea2aaf3dc00f280f3b6e87aa1b08dda2639f4ba26ab85bb2301b6ac3c7fa07f3b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF9A65747B18E79080.TMP

Filesize
16KB

MD5
f2cf8fea5d00758b558aa7153afc4aed

SHA1
a2e89d3ea04571c89b618facafacca853b93af42

SHA256
2bcda8942766c784b2215295a840dcf47307224e66911e752fc671b1f4d78835

SHA512
035d4664ae1ad523ec62031027b7bdb137032e3b0f0d919a578fa65bbdb85815e2b9f71caa4d17c70047198902b33d3e32fc3a0df6d8eba1f7d9de40c1a6f45d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O1NMS.tmp\setup.exe.tmp

Filesize
1.6MB

MD5
c3189bdbce1b62bb3003ed25d7d42300

SHA1
5cc03d97a60f8afc7095faefcb6032a1a0108df8

SHA256
09178384f340b88f258bafa5a7af3dc2c2864004df8a33a71900b12d13fe84ac

SHA512
5e1440f5b24c692e9346bcccfe331af00a8d09e2099fd2c528f0c07c4e2275d87ec29559c74e976d2ca762884587008a92072537f8c0ca40356a9c30d0149292

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O1NMS.tmp\setup.exe.tmp

Filesize
1.6MB

MD5
c3189bdbce1b62bb3003ed25d7d42300

SHA1
5cc03d97a60f8afc7095faefcb6032a1a0108df8

SHA256
09178384f340b88f258bafa5a7af3dc2c2864004df8a33a71900b12d13fe84ac

SHA512
5e1440f5b24c692e9346bcccfe331af00a8d09e2099fd2c528f0c07c4e2275d87ec29559c74e976d2ca762884587008a92072537f8c0ca40356a9c30d0149292

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O6LQ5.tmp\gdiplus.dll

Filesize
1.7MB

MD5
c5ea2d4f8f7ac5188a98c6a9efaddc26

SHA1
fe5c1e41d2eaa24e2af4770c1d507c6fba08dbe3

SHA256
5f25405d991a2118dffcaa4929aa94e44a8692916e363a84011555f4c8c4c423

SHA512
197bc8083c6d8a1ac6f5f48ec17d0128b08e09926162abdd73a1b0b8f0921a5ac050e8429c93d15612964dd217036382139ee57f4157b89436feefa0b14455fe

Download Submit
C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com.rar

Filesize
4.7MB

MD5
b8cafd4c17aa3d4bedc136932b81ecba

SHA1
1a2632c9117fb1f5c1a1ef38156eaab142d9e7c7

SHA256
5c45a4478c14e1688996e2194a9e9ef3879d1366df1970e27bab0e8630f70954

SHA512
82d3a6b49b0eb4137253bf87e16c7b2331e90f0b13756f239d603278fc1da44888cf67aed31ab105d92ae12f136b123a8e6b5976c41fead9c2fa50c6cdab3595

Download Submit
C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\READ ME.txt

Filesize
143B

MD5
c44a8d143df69d4dc9e6eb167e3ff9f2

SHA1
43c30b4556bee61fa468a910e99a2e8f108547db

SHA256
ba5b1c22ca52be53120a9739a7ef4bc6ea530f60039944fe142301078d4f22e2

SHA512
d55f8e40865fd8aeb752ddeb516215e084160343ba729f547222d1e3879a64e5c2815bd62d5d440ec187956e2bf7ba027265fc489601a22e0289f3e8780f7576

Download Submit
C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\Software Files\Credits.txt

Filesize
2KB

MD5
32381718c38864153e772b8c37c737fe

SHA1
9baddb5d5b992dca071b4ad67907d8f7253f3460

SHA256
3dca8dd8053c6196bbd16355a6d6171897a97e402a0ead27355e1de80490d839

SHA512
6f619116bb190517484cc4d8ffcce515f55ac16e59603bd7f839f31e8d8061d59a33118058db4a7944eb7a19f885717e587e087d4df7c646586aa924c7fae566

Download Submit
C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\Software Files\air.nfo

Filesize
6KB

MD5
1d67d6139ac794d5c60f5b5e8b08f29e

SHA1
2ad5f6bf7cc54761979a3c1c2747b7c0adc75da2

SHA256
b023a3a8437d0f8b314da6ea485c5774b869089fde21cd4a97b112d11e273e06

SHA512
b7614f1044b0ce42cfa9e53e0794224d0e34a460c5663dc2b248220a3f76f43c692f02bc164c9caa9c4fa242b7d8980ee87bb1b10b2e90f0af9b2400b3ff9441

Download Submit
C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\Software Files\setup.exe

Filesize
4.7MB

MD5
bfacc36c3a7ba82c2f28f870a3fe5651

SHA1
f553d7e9adcd7ebae440bda9b0bd1ccee0a8ce94

SHA256
ec815652769b8547a36d6d50145b36da5688184f4148a64faeee41e4c93d053e

SHA512
6bac710c5fd8cf6f8cf7acdf0071a2d2069616488c317e89db8563cb03448415476c22bac63646e1968ecfff3132cb26c3f28c320b1d46d54f234c753941c345

Download Submit
C:\Users\Admin\Downloads\Auto.Tune.Evo.VST.RTAS.v6.0.9 - www.MySoftwareFree.com\Software Files\setup.exe

Filesize
4.7MB

MD5
bfacc36c3a7ba82c2f28f870a3fe5651

SHA1
f553d7e9adcd7ebae440bda9b0bd1ccee0a8ce94

SHA256
ec815652769b8547a36d6d50145b36da5688184f4148a64faeee41e4c93d053e

SHA512
6bac710c5fd8cf6f8cf7acdf0071a2d2069616488c317e89db8563cb03448415476c22bac63646e1968ecfff3132cb26c3f28c320b1d46d54f234c753941c345

Download Submit
\Users\Admin\AppData\Local\Temp\is-O6LQ5.tmp\gdiplus.dll

Filesize
1.7MB

MD5
c5ea2d4f8f7ac5188a98c6a9efaddc26

SHA1
fe5c1e41d2eaa24e2af4770c1d507c6fba08dbe3

SHA256
5f25405d991a2118dffcaa4929aa94e44a8692916e363a84011555f4c8c4c423

SHA512
197bc8083c6d8a1ac6f5f48ec17d0128b08e09926162abdd73a1b0b8f0921a5ac050e8429c93d15612964dd217036382139ee57f4157b89436feefa0b14455fe

Download Submit
\Users\Admin\AppData\Local\Temp\tmpE5B9A1A.tmp

Filesize
492KB

MD5
07cd14db0608fc557c4fb35d5606d7f6

SHA1
0f3c9b916c2dea3ed83907c776709d6217ad5763

SHA256
f047d2371f204ad9709b891c5e2b59b8c0e13b6899746b2b449529e7375016ba

SHA512
44577784e45ca24c3029570fe312812d1467273651ce5822a0e33e88581a736ec81962c112a9b5878da708f2a79826e82630ad0000153272a1b16b83af5f9bae

Download Submit
\Users\Admin\AppData\Local\Temp\tmpMME5B9AA6.tmp

Filesize
90KB

MD5
0be4a226874eccb9f8bfe3d8dced0c09

SHA1
00ef65d450c195b3c790a87c2b6e350829ebbbd0

SHA256
d98cd5d6ed9c4a95701684aa83777cefd5d8096e14c836493f67159d68161c01

SHA512
fc7d885414de92707bb20deeb45189b340a4503f379ff98503266d69b197fd450b71585a16a8de40f16428595ff38a3ae9ed7a3738286b9995cebcb91c14a85e

Download Submit
\Users\Admin\AppData\Local\Temp\tmpMME5B9AA6.tmp

Filesize
90KB

MD5
0be4a226874eccb9f8bfe3d8dced0c09

SHA1
00ef65d450c195b3c790a87c2b6e350829ebbbd0

SHA256
d98cd5d6ed9c4a95701684aa83777cefd5d8096e14c836493f67159d68161c01

SHA512
fc7d885414de92707bb20deeb45189b340a4503f379ff98503266d69b197fd450b71585a16a8de40f16428595ff38a3ae9ed7a3738286b9995cebcb91c14a85e

Download Submit
memory/804-809-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/804-877-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/804-868-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/804-838-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/804-836-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/804-821-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/804-820-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/1296-486-0x0000019FCABF0000-0x0000019FCABF2000-memory.dmp

Filesize
8KB

Download
memory/1296-357-0x0000019FB83F0000-0x0000019FB83F2000-memory.dmp

Filesize
8KB

Download
memory/1296-477-0x0000019FCAA80000-0x0000019FCAA82000-memory.dmp

Filesize
8KB

Download
memory/1296-359-0x0000019FB8510000-0x0000019FB8512000-memory.dmp

Filesize
8KB

Download
memory/1296-481-0x0000019FCAA90000-0x0000019FCAA92000-memory.dmp

Filesize
8KB

Download
memory/1296-343-0x0000019FB83B0000-0x0000019FB83B2000-memory.dmp

Filesize
8KB

Download
memory/4856-790-0x000001AEBF8D0000-0x000001AEBF8D1000-memory.dmp

Filesize
4KB

Download
memory/4856-536-0x000001AEC5EB0000-0x000001AEC5EB1000-memory.dmp

Filesize
4KB

Download
memory/4856-537-0x000001AEC5EC0000-0x000001AEC5EC1000-memory.dmp

Filesize
4KB

Download
memory/4856-324-0x000001AEBF8A0000-0x000001AEBF8A2000-memory.dmp

Filesize
8KB

Download
memory/4856-787-0x000001AEBFDA0000-0x000001AEBFDA2000-memory.dmp

Filesize
8KB

Download
memory/4856-794-0x000001AEBF890000-0x000001AEBF891000-memory.dmp

Filesize
4KB

Download
memory/4856-305-0x000001AEBFF40000-0x000001AEBFF50000-memory.dmp

Filesize
64KB

Download
memory/4856-289-0x000001AEBF720000-0x000001AEBF730000-memory.dmp

Filesize
64KB

Download
memory/4964-835-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4964-803-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4964-878-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download