hxxp://gofile[.]io/d/LOwlP7

Analysis

max time kernel
159s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://gofile.io/d/LOwlP7

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2064	NOTEPAD.EXE
1240	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	13944	dwm.exe
Token: SeChangeNotifyPrivilege	13944	dwm.exe
Token: 33	13944	dwm.exe
Token: SeIncBasePriorityPrivilege	13944	dwm.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2064	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1612	3456	msedge.exe	87
PID 3456 wrote to memory of 1612	3456	msedge.exe	87
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 392	3456	msedge.exe	89
PID 3456 wrote to memory of 3836	3456	msedge.exe	90
PID 3456 wrote to memory of 3836	3456	msedge.exe	90
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91
PID 3456 wrote to memory of 1208	3456	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gofile.io/d/LOwlP7
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3f2146f8,0x7ffa3f214708,0x7ffa3f214718
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6215168534445080558,3621156211615356116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,6215168534445080558,3621156211615356116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,6215168534445080558,3621156211615356116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6215168534445080558,3621156211615356116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6215168534445080558,3621156211615356116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2184,6215168534445080558,3621156211615356116,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6215168534445080558,3621156211615356116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\xd.bat
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:2064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\xd.bat" "
1⤵
PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" "C:\Users\Admin\Desktop\xd.bat""
  2⤵
  PID:792

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\xd.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:1240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\xd.bat" "
1⤵
PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:4592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:4744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:5304
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:6976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:10244
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:9056
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:12624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:6192
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:9556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:14000
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:5632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7736
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:12784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10412
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:5124
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:7196
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:11720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:8932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:12552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:2968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:1932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7156
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:11648
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:3804
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:11228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7200
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:11956
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:14264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7188
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:12004
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:14284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7208
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:11868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7272
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:11664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:9836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:9316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:7668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:10276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:2328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:4520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:2384
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:8792
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8056
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:6908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:5708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8144
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:7016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:9240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:2800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:3528
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:5256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:6120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:9340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:13288
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:7744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:12700
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:10496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:5280
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:7024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:11400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:9564
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:8636
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:5356
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:5552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:7256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:10888
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:5576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:6364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        8⤵
        
        PID:9736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        9⤵
        
        PID:13328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        8⤵
        
        PID:13616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:8424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        8⤵
        
        PID:13948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:11256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:6720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:11152
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:8804
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:11732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:6236
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:9308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:12984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        7⤵
        
        PID:14332
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13636
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13676
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13692
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13708
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13724
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7632
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:7540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:10196
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:14276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:1264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:1672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:3116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:6520
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:10036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:14200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:14160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:6988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:5784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:7104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:7280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:9860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:14228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:14088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:2108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:5664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:6248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:9612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:9108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:12768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:5244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:9564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:7524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:10072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:6152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:10232
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:7016
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:6268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:6216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:7556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:10092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:14184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:7992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:11056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:4868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:2080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:3920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:6536
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:11656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:5888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8388
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13868
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:13796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:9616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:5332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:1568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:14144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:9460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:6224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:10268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:11164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:8212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:11012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:10960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:3624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11068
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:12400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:8888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:12432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:14316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:4612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:8644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:11980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:1564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:8796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:12232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:14292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:4372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:8940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:12520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:3216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:11600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:8704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:11876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:4876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10080
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        6⤵
        
        PID:6028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:8844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:12688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:4252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:8980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:8852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:12672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:5880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:10204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:8324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:11060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:6824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:11624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:9624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:6184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:9820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:8204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:11004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:3776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:6128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:9472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:7752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:12924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:10440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:7904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:10576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:6280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:10916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:5624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:6208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:9252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:14308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:13304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K xd.bat
        5⤵
        
        PID:12796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:13652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:7372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:14060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:10952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:6876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K xd.bat
    3⤵
    PID:11244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K xd.bat
      4⤵
      PID:6960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:8968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K xd.bat
  2⤵
  PID:13148

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7320 -s 392
1⤵
PID:6672

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
177B

MD5
514b078c30f711cff389c7ed700e5e14

SHA1
8290ee8976fcfa25b290f4c935d3faf4f0183014

SHA256
5ee95304ebab5e5c003780f4439b3ea4d336cb9bb2e917f58574c1f5603314e5

SHA512
1222c17e23b03cc091aa75bdde753dc94f0e3a50b967a60ac168d8754c28d238b5449e828e20f7dd3f03f1c97152b7ac5f5a9312669572f92287709981a76595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23b9636ddf19c0c1d25aba05d6ee2a93

SHA1
467e962877bc1c253799635d718f82d5e0a9891c

SHA256
21f23080bff93bd2f11abd05613e95142b95e18c27590123a46ae014430f7980

SHA512
db9a1194955754227b5a750502d305c71ab53ae502458e6152d385b9befa69724962a78402bce55ec4331ddb499b837150a69be37340c89c182f0a03c7e75a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db325024cebf504cd646e29edcbed822

SHA1
ce28e1cfb350d99e79ecaf4e8c8c454cb195a2d4

SHA256
d150e82aef29a32380ff1c416b093f109564705f12bbf594c1fd93f83b150a15

SHA512
d0bd0f214167b2b3d41d7da17dc51cf821d2ac6b8ed9c0ebad1d9b46f3fa8f174a8311a957c1335e3c28e2860e8124d69ac12797f5237f15c5960887f087849a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
46e5577b526cfb513f3e7d1f5f178965

SHA1
18d1bd8a3d4781d0404b455467ac844601b64ce3

SHA256
dd2bd461069cd53101709ab076ab6df9c3fe968f6d2350ba2b4504a95e3a4e9c

SHA512
487996397a71869467d66eae6f1bb053f7cb07c1241f123cc470308ed7210dd713d6584e11e694ea5ea8305b7fa7cb07c37d76b458436dffbf38d09572f54121

Download Submit
C:\Users\Admin\Desktop\xd.bat

Filesize
5B

MD5
f25d3c84be0310a65527a490959ec485

SHA1
4b6aaf8033ea5bb099781ea2ffbf8360cd8d34de

SHA256
8f18999b6fc5794db155f33517534bf31c2b52ac32e4eb055dadfdd32eaaa457

SHA512
39e767cce975dae9fdb578c5235eeca17eeff728a2933b73eea4e07202125ff52694752960bdd42074bee526190219c9a095edc8532d660b1f61aceca69c2bde

Download Submit
C:\Users\Admin\Desktop\xd.bat

Filesize
40B

MD5
86127d39136c68c5c2329eb7ab3b3449

SHA1
0d578d42a382283a9c6cc28d3da4c4f225b7fc48

SHA256
121f9b86b02846099b90b85c4f91f028bdb4baad0994b7334a2694f747d8f3e2

SHA512
9d2bdd8f5ec006f6b1e164580831c6c7bf51ca73b589a28b94e9ac427e7f903dc27941aab512a9a675b8fa3e6c2ef8c85a7af06af0f8edf1503bbf07c90afbbf

Download Submit