6e221f752f623d492d4aeb66718b4eb1e3a6408ab6f7bcd71e4e882a6d487744

Analysis

max time kernel
2691s
max time network
2696s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2024 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

15KB
MD5

177462f66e7efa0f38ba4353b6e179b6
SHA1

d59f5f45461b28e77e84c44f5828d035bf8f4286
SHA256

6e221f752f623d492d4aeb66718b4eb1e3a6408ab6f7bcd71e4e882a6d487744
SHA512

39b22f691bc7be3db4b3ac0a55506ad4029e242f5951881ed2ab95177963f927c77f717df70cb248879a3c76f538d50b98f7d72dab7b4aeebafa7e95c6536c40
SSDEEP

192:PNx5Ssv99qXoqTJkNr423ZPiipmAWyuxqSa0KfkYIBIwKflWTsCyEXN:5Ssl9qYoJkN0Jipmzy660KMYjtogEN

Score

8^/10

motw persistence phishing

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 12 IoCs

Processes:

MsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\SETE507.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxUSBMon.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETF979.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETF979.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxNetLwf.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETE42C.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETE42C.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxSup.sys	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETE507.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxNetAdp6.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET31.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET31.tmp	MsiExec.exe

Executes dropped EXE 8 IoCs

Processes:

VirtualBox-7.0.14-161095-Win.exeVirtualBox.exeVBoxSVC.exeVBoxSDS.exeVirtualBoxVM.exeVirtualBoxVM.exeVirtualBoxVM.exeVirtualBoxVM.exe

pid	process
3568	VirtualBox-7.0.14-161095-Win.exe
752	VirtualBox.exe
812	VBoxSVC.exe
2504	VBoxSDS.exe
5804	VirtualBoxVM.exe
3132	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3540	VirtualBoxVM.exe

Loads dropped DLL 57 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeVirtualBox.exeVBoxSVC.exeVBoxSDS.exeVirtualBoxVM.exeVirtualBoxVM.exe

pid	process
4420	MsiExec.exe
4420	MsiExec.exe
4420	MsiExec.exe
4420	MsiExec.exe
3024	MsiExec.exe
3024	MsiExec.exe
3024	MsiExec.exe
944	MsiExec.exe
3024	MsiExec.exe
3024	MsiExec.exe
540	MsiExec.exe
540	MsiExec.exe
540	MsiExec.exe
540	MsiExec.exe
540	MsiExec.exe
540	MsiExec.exe
540	MsiExec.exe
540	MsiExec.exe
540	MsiExec.exe
3024	MsiExec.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
812	VBoxSVC.exe
812	VBoxSVC.exe
2504	VBoxSDS.exe
2504	VBoxSDS.exe
812	VBoxSVC.exe
5804	VirtualBoxVM.exe
5804	VirtualBoxVM.exe
5804	VirtualBoxVM.exe
5804	VirtualBoxVM.exe
5804	VirtualBoxVM.exe
5804	VirtualBoxVM.exe
5804	VirtualBoxVM.exe
5804	VirtualBoxVM.exe
5804	VirtualBoxVM.exe
5804	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3068	VirtualBoxVM.exe

Registers COM server for autorun 1 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

msiexec.exeVirtualBox.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32\ = "\"C:\\Program Files\\Oracle\\VirtualBox\\VBoxSVC.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxC.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32\ = "\"C:\\Program Files\\Oracle\\VirtualBox\\VBoxSDS.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxProxyStub.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxC.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32	VirtualBox.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msedge.exeVirtualBox.exeVirtualBox-7.0.14-161095-Win.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	msedge.exe
File opened (read-only)	\??\E:	VirtualBox.exe
File opened (read-only)	\??\A:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\N:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\Q:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\V:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\R:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\T:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\W:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\Y:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\L:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\U:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\Z:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\K:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\P:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\S:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\X:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\B:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\G:	VirtualBox-7.0.14-161095-Win.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

78 https://www.manageengine.com/cookiepolicybanner.html

flow	ioc
78	https://www.manageengine.com/cookiepolicybanner.html

Drops file in System32 directory 64 IoCs

Processes:

DrvInst.exeDrvInst.exeMsiExec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\SETFE1F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_c5e1a8904c87a072\VBoxNetLwf.sys	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxSup_5018924056E84EABA285BB0DE5B18677DC64C518\VBoxSup.inf	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\SETE613.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\VBoxUSB.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\netvwififlt.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\SETE611.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxUSBMon_4DC22822E5ED15CFAF42864CC0F1E63EBC74D076\VBoxUSBMon.sys	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\SETFE1E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_6389ef9a2a816fc1\VBoxUSB.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\VBoxNetAdp6.inf	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxSup_5018924056E84EABA285BB0DE5B18677DC64C518\VBoxSup.sys	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\SETE613.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_6389ef9a2a816fc1\VBoxUSB.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\netrass.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\DRVSTORE\VBoxSup_5018924056E84EABA285BB0DE5B18677DC64C518\VBoxSup.inf	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxSup_5018924056E84EABA285BB0DE5B18677DC64C518\VBoxSup.cat	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\SETF8A0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_ee187df79249cd72\VBoxNetAdp6.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_ee187df79249cd72\VBoxNetAdp6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\SETE611.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\VBoxUSB.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\SETF8A1.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxUSBMon_4DC22822E5ED15CFAF42864CC0F1E63EBC74D076\VBoxUSBMon.inf	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxUSBMon_4DC22822E5ED15CFAF42864CC0F1E63EBC74D076\VBoxUSBMon.cat	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\netnb.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\SETFE1F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\netpacer.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\SETF88F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\SETF88F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ndiscap.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\SETF8A1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\VBoxNetLwf.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\VBoxNetAdp6.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_ee187df79249cd72\VBoxNetAdp6.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\SETFE1D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\SETFE1E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\VBoxNetLwf.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\VBoxUSB.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\SETE612.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_c5e1a8904c87a072\VBoxNetLwf.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\netserv.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\netbrdg.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\DRVSTORE	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\SETFE1D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_c5e1a8904c87a072\VBoxNetLwf.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\SETE612.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\VBoxNetAdp6.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_c5e1a8904c87a072\vboxnetlwf.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\SETF8A0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\VBoxNetLwf.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\c_netservice.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_6389ef9a2a816fc1\VBoxUSB.sys	DrvInst.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

VirtualBoxVM.exeVirtualBoxVM.exeVirtualBoxVM.exeVirtualBoxVM.exe

pid process

5804 VirtualBoxVM.exe
5804 VirtualBoxVM.exe
3132 VirtualBoxVM.exe
3068 VirtualBoxVM.exe
3068 VirtualBoxVM.exe
3540 VirtualBoxVM.exe

pid	process
5804	VirtualBoxVM.exe
5804	VirtualBoxVM.exe
3132	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3068	VirtualBoxVM.exe
3540	VirtualBoxVM.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel3_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxHostChannel.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxProxyStub-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSupLib.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuth.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDD.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxProxyStub.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_nl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol9_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\vbox-img.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\lgw_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ko.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\doc\UserManual.pdf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_fa.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\debian_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5CoreVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\install\vboxapi\VirtualBox_constants.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_CN.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxHeadless.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VMMR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel5_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\sdk\install\vboxapi\__init__.py	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxHeadless.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_bg.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UICommon.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAudioTest.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_eu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxManage.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_th.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qoffscreen.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UserManual.qch	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxC.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5HelpVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDTrace.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_tr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\debian_preseed.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ca.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_th.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_it.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hu.qm	msiexec.exe

Drops file in Windows directory 42 IoCs

Processes:

msiexec.exeDrvInst.exeMsiExec.exeDrvInst.exeDrvInst.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIDDAC.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI215.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\e59d191.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSID4EC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5C9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD6D.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIFD7E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDBD.tmp	msiexec.exe
File created	C:\Windows\INF\oem3.PNF	MsiExec.exe
File created	C:\Windows\Installer\e59d18f.msi	msiexec.exe
File created	C:\Windows\INF\oem5.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIAC.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\e59d18f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE560.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSID55A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE4F2.tmp	msiexec.exe
File created	C:\Windows\Installer\{8DDF4B7A-DE1A-4619-B426-959B44E40A87}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID4CC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8DDF4B7A-DE1A-4619-B426-959B44E40A87}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7FC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3F7.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\{8DDF4B7A-DE1A-4619-B426-959B44E40A87}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID45D.tmp	msiexec.exe
File created	C:\Windows\INF\oem2.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIF86C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID86B.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exeDrvInst.exeDrvInst.exeDrvInst.exevssvc.exeMsiExec.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\HardwareID	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009b9629f4dfdec3790000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009b9629f40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009b9629f4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9b9629f4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009b9629f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeMsiExec.exeDrvInst.exeDrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeVirtualBox.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6A5E65BA-EEB9-11EA-AE38-73242BC0F172}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADF292B0-92C9-4A77-9D35-E058B39FE0B9}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CB6F0F2C-8384-11E9-921D-8B984E28A686}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E54F6256-97A7-4947-8A78-10C013DDF4B8}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0A7F210-B857-4468-BE26-C29F36A84345}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{234F0627-866D-48C2-91A5-4C9D50F04928}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB3A9E6-7F29-4AAE-A627-5A282C83092C}\NumMethods\ = "19"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5094F67A-8084-11E9-B185-DBE296E54799}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DCF47A1D-ED70-4DB8-9A4B-2646BD166905}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\progId_VirtualBox.Shell.ovf	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0FE2DA40-5637-472A-9736-72019EABD7DE}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{53FAC49A-B7F1-4A5A-A4EF-A11DD9C2A458}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{69BFB134-80F6-4266-8E20-16371F68FA25}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{91F33D6F-E621-4F70-A77E-15F0E3C714D5}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E106366-4521-44CC-DF95-186E4D057C83}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07541941-8079-447a-a33e-47a69c7980db}	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1BCC6D5-7966-481D-AB0B-D0ED73E28135}\ = "IVirtualBoxErrorInfo"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{46735DE7-F4C4-4020-A185-0D2881BCFA8B}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D23A9CA3-42DA-C94B-8AEC-21968E08355D}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7569351-1750-46F0-936E-BD127D5BC264}\1.3\0\win64	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{813C99FC-9849-4F47-813E-24A75DC85615}\NumMethods	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a6dcf6e8-416b-4181-8c4a-45ec95177aef}	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBoxSDS.1\ = "VirtualBoxSDS Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{01ADB2D6-AEDF-461C-BE2C-99E91BDAD8A1}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{813C99FC-9849-4F47-813E-24A75DC85615}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{50CE4B51-0FF7-46B7-A138-3C6E5AC946B4}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52F40B16-520E-473F-9428-3E69B0D915C3}\ = "IAudioSettings"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{537707F7-EBF9-4D5C-7AEA-877BFC4256BA}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{788B87DF-7708-444B-9EEF-C116CE423D39}\NumMethods\ = "20"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B79DE686-EABD-4FA6-960A-F1756C99EA1C}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1f99d9dc-c144-4c28-9f88-e6f488db5441}	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4376693C-CF37-453B-9289-3B0F521CAF27}\TypeLib	VirtualBox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{234F0627-866D-48C2-91A5-4C9D50F04928}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3DB2AB1A-6CF7-42F1-8BF5-E1C0553E0B30}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B3CDEB2-808E-11E9-B773-133D9330F849}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{431685DA-3618-4EBC-B038-833BA829B4B2}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46735DE7-F4C4-4020-A185-0D2881BCFA8B}\NumMethods\ = "56"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B6E1AEE-35F3-4F4D-B5BB-ED0ECEFD8538}\TypeLib	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B5DDB370-08A7-4C8F-910D-47AABD67253A}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F692806F-FEBE-4049-B476-1292A8E45B09}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D0F4C6F-A77E-45C5-96D2-7CA7DAAE63A9}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7FDA727-7A08-46EE-8DD8-F8D7308B519C}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA43579A-2272-47C4-A443-9713F19A902F}\ = "IMachineDebugger"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D23A9CA3-42DA-C94B-8AEC-21968E08355D}\TypeLib	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D0F4C6F-A77E-45C5-96D2-7CA7DAAE63A9}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A033B8-CC87-4F6E-A0E9-47BB7F2D4BE5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F4ADCF6-3E87-11E9-8AF2-576E84223953}\NumMethods\ = "36"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{A06253A7-DCD2-44E3-8689-9C9C4B6B6234}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{88394258-7006-40D4-B339-472EE3801844}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334DF94A-7556-4CBC-8C04-043096B02D82}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{234F0627-866D-48C2-91A5-4C9D50F04928}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A5BBDB7D-8CE7-469F-A4C2-6476F581FF72}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B5DDB370-08A7-4C8F-910D-47AABD67253A}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B7FDA727-7A08-46EE-8DD8-F8D7308B519C}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB3A9E6-7F29-4AAE-A627-5A282C83092C}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CADEF0A2-A1A9-4AC2-8E80-C049AF69DAC8}\ = "IDHCPServer"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{83795A4C-FCE1-11EA-8A17-636028AE0BE2}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{A338ED20-58D9-43AE-8B03-C1FD7088EF15}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11BE93C7-A862-4DC9-8C89-BF4BA74A886A}\NumMethods	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21637b0e-34b8-42d3-acfb-7e96daf77c22}	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\x86\\VBoxClient-x86.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6620DB85-44E0-CA69-E9E0-D4907CECCBE5}\NumMethods\ = "35"	msiexec.exe

NTFS ADS 2 IoCs

Processes:

msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 109605.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 285000.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

VirtualBox.exeVirtualBoxVM.exeVirtualBoxVM.exe

pid process

752 VirtualBox.exe
5804 VirtualBoxVM.exe
3068 VirtualBoxVM.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsiexec.exemsedge.exe

pid	process
2620	msedge.exe
2620	msedge.exe
4076	msedge.exe
4076	msedge.exe
4104	msedge.exe
4104	msedge.exe
4252	msedge.exe
4252	msedge.exe
4460	msedge.exe
4460	msedge.exe
1864	identity_helper.exe
1864	identity_helper.exe
3200	msedge.exe
3200	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
1620	msiexec.exe
1620	msiexec.exe
5392	msedge.exe
5392	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

VirtualBox.exe7zFM.exe

pid process

752 VirtualBox.exe
1460 7zFM.exe
Suspicious behavior: LoadsDriver 4 IoCs

Processes:

pid process

656
656
656
656

pid	process
656
656
656
656

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

Processes:

msedge.exemsedge.exe

pid	process
4076	msedge.exe
4076	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

VirtualBox-7.0.14-161095-Win.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeIncreaseQuotaPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSecurityPrivilege	1620	msiexec.exe
Token: SeCreateTokenPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeAssignPrimaryTokenPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeLockMemoryPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeIncreaseQuotaPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeMachineAccountPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeTcbPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSecurityPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeTakeOwnershipPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeLoadDriverPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSystemProfilePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSystemtimePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeProfSingleProcessPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeIncBasePriorityPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeCreatePagefilePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeCreatePermanentPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeBackupPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeRestorePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeShutdownPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeDebugPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeAuditPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSystemEnvironmentPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeChangeNotifyPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeRemoteShutdownPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeUndockPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSyncAgentPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeEnableDelegationPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeManageVolumePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeImpersonatePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeCreateGlobalPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeCreateTokenPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeAssignPrimaryTokenPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeLockMemoryPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeIncreaseQuotaPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeMachineAccountPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeTcbPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSecurityPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeTakeOwnershipPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeLoadDriverPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSystemProfilePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSystemtimePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeProfSingleProcessPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeIncBasePriorityPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeCreatePagefilePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeCreatePermanentPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeBackupPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeRestorePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeShutdownPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeDebugPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeAuditPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSystemEnvironmentPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeChangeNotifyPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeRemoteShutdownPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeUndockPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeSyncAgentPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeEnableDelegationPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeManageVolumePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeImpersonatePrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeCreateGlobalPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeCreateTokenPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeAssignPrimaryTokenPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe
Token: SeLockMemoryPrivilege	3568	VirtualBox-7.0.14-161095-Win.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exemsedge.exe

pid	process
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

msedge.exemsedge.exe

pid	process
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

VirtualBox.exeVirtualBoxVM.exeVirtualBoxVM.exe

pid	process
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
752	VirtualBox.exe
5804	VirtualBoxVM.exe
752	VirtualBox.exe
3068	VirtualBoxVM.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4076 wrote to memory of 3484	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 3484	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2148	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2620	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 2620	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe
PID 4076 wrote to memory of 4636	4076	msedge.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe62d346f8,0x7ffe62d34708,0x7ffe62d34718
2⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,88707599967421332,6659004689061577414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
2⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,88707599967421332,6659004689061577414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,88707599967421332,6659004689061577414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,88707599967421332,6659004689061577414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,88707599967421332,6659004689061577414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe62d346f8,0x7ffe62d34708,0x7ffe62d34718
2⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
2⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2432 /prefetch:8
2⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
2⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
2⤵
PID:724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
2⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
2⤵
PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
2⤵
PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
2⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5336 /prefetch:8
2⤵
PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5392 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
2⤵
PID:652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
2⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
2⤵
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
2⤵
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
2⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
2⤵
PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
2⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
2⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
2⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
2⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5668 /prefetch:8
2⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6392 /prefetch:8
2⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
2⤵
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5280 /prefetch:8
2⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
2⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
2⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
2⤵
PID:728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
2⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
2⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
2⤵
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
2⤵
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1696 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3200

C:\Users\Admin\Downloads\VirtualBox-7.0.14-161095-Win.exe
"C:\Users\Admin\Downloads\VirtualBox-7.0.14-161095-Win.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
"C:\Program Files\Oracle\VirtualBox\VirtualBox.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5732 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
2⤵
PID:5884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
2⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,16947935468112313500,6568523007524109466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 7D8EE673597C15C8D76FB9F70DBCFBA0 C
2⤵
- Loads dropped DLL
PID:4420

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:3888

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 21D0394CF96DA0C585487FC145E70790
2⤵
- Loads dropped DLL
PID:3024

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 0D81084CA6024E732462AD7F50E86FEB
2⤵
- Loads dropped DLL
PID:944

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 9D584522B524DFFBDF517FF5F0F5C791 E Global\MSI0000
2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:540

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4C810E664CB8E2D0443C37848C8E744A M Global\MSI0000
2⤵
PID:1456

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4976

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.inf" "9" "48f6bcb47" "0000000000000140" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:972

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf" "9" "473b17b7b" "0000000000000168" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5088

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf" "9" "431e52bcb" "000000000000015C" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1104

C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe
"C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812

C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
"C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe" --comment kali --startvm 4373d647-5328-422f-9624-83030ccdab20 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\kali\Logs\VBoxHardening.log"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5804

C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
60eaff78-4bdd-042d-2e72-669728efd737-suplib-2ndchild --comment kali --startvm 4373d647-5328-422f-9624-83030ccdab20 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\kali\Logs\VBoxHardening.log"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3132

C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
"C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe" --comment kali --startvm 4373d647-5328-422f-9624-83030ccdab20 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\kali\Logs\VBoxHardening.log"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3068

C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe
60eaff78-4bdd-042d-2e72-669728efd737-suplib-2ndchild --comment kali --startvm 4373d647-5328-422f-9624-83030ccdab20 --no-startvm-errormsgbox "--sup-hardening-log=C:\Users\Admin\VirtualBox VMs\kali\Logs\VBoxHardening.log"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3540

C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe
"C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3536

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "E:\install.amd\initrd.gz"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1460

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCAT E:\isolinux\boot.cat
1⤵
PID:4652

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520 0x510
1⤵
PID:5464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e59d190.rbs
Filesize
2.5MB

MD5
7eacf6fa85e816c25af620e80a3a1e2f

SHA1
a76b00fd0fff27ce069defe122625eca828c2d78

SHA256
5f6042bc4e215fe3d568479fac3a87b120b33f695501a49bed62ef908d990831

SHA512
2635024c1d69accdf3ee8d5de77423b1015cbc4d70f83ca76ebf651e3c6fc5db4c8c122110c17024bbdc4ed1c1b8486c4ae91039f9dd94f2d6c4d1449db58689

Download Submit
C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
Filesize
2.6MB

MD5
be3cbab296ab1c9fbbe7dc8e97b06e07

SHA1
1f6a242ff2039606ac558c56e4237cc9a9fe28fd

SHA256
f640902d85cbeed89f1f2237297b2eba3240cb4431c64131f2253331e0b67f6d

SHA512
2742b09e99d45201d2f70df76d9d69369eb666194c39b99627c0d8a06da4de19f3bdc5b83fee7e7f84e7a26db123b5463060b748f4b27eeb3a27049a8589e28a

Download Submit
C:\Users\Admin\.VirtualBox\VirtualBox.xml
Filesize
1KB

MD5
d9d28bd2ef7192fb0efb99607d7a0807

SHA1
7fb6f32f1c0f227118613dd7779e1bf0a6e2ce4a

SHA256
dad710b076d96b3de34a58363a3241935bfe205b7240ce57f9d85bf2058e6dd5

SHA512
e058987d5fd8ea6cd3c3081c7ac45ce1e3719c4a38b46390133b19539fad35a0d8ad699023a3d934d18e3356cb6def62bd197b5a32ad496b620469c55d9efb13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
53017c14047795f8025ce72bf80eb767

SHA1
906a5319c418f6c3076aef79ba77043ed8ff4e8a

SHA256
d006afbfc162aa4bd04cca2af538b8ec068394e724a51870706465efac9d4941

SHA512
6142ff9738fb4e0ef492cb4100c2169df845fd527ea0db151063b5091fad9b3aeb3a46973a9e8f46a3269c27e3ac4fd8e839dbd262fa7720e9485b3ab3ddb288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b85412a5d1f098bd0fd84dcfdded6b21

SHA1
4617ef9ed4c86a68b334557d597476e4570d22ff

SHA256
9544ffe3bfa167e5deb291b447f5303ac897a63a3c6c61b7c0a4597cdf25da90

SHA512
12c12a0dabdbfe72439a287b192dbf5619e77edc9fe8d3dabfdaecce31e583e0f0d400328ca0d167a4222e4aac17ad80306b6cad6ae5ff9a4235c0bfffd4dc3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5583362f-35c5-47f7-b9df-1bb3126efe32.tmp
Filesize
7KB

MD5
fd8e419449d6d49b4fa3ecac68a83b76

SHA1
0b560eda634f476bfaacbe4b8fb49bbe4ac8e6e7

SHA256
7d7f49bae1b9092f8dca8321edc432f303a491ed135797c37b75cdba26b3f12f

SHA512
a0378edeb47976b24b8d6596681ba60830846e3d7dc7403f1fc619ebe52f0f544df8b9f8c1e2864287eeb4b15abde860caf186e9b8020903df475a9e362144f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Filesize
35KB

MD5
c1149eb0d6ead8c20321070edd65340f

SHA1
e551411b31d21b5d3928f0b9ff5d5012291ea748

SHA256
5b40e9708d2cfa765237fa34692e7e624bf00e64ec5f8baa5fdfa1a0e4559c1b

SHA512
7f66928cb761143babaf11211eecc462696aad5f68860b686f6fbce5f6822f3c19b7bc454c885d3270a9cce2d64916026051f58bc51a6e6b5e7827cab8e93775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Filesize
1.1MB

MD5
d404b61450122b2ad393c3ece0597317

SHA1
d18809185baef8ec6bbbaca300a2fdb4b76a1f56

SHA256
03551254e2231ecd9c7ee816b488ecbde5d899009cd9abbe44351d98fbf2f5fb

SHA512
cb1a2867cc53733dc72cd294d1b549fa571a041d72de0fa4d7d9195bcac9f8245c2095e6a6f1ece0e55279fa26337cdcc82d4c269e1dd186cbbd2b974e2d6a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Filesize
32KB

MD5
bbc7e5859c0d0757b3b1b15e1b11929d

SHA1
59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

SHA256
851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

SHA512
f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Filesize
74KB

MD5
bc9faa8bb6aae687766b2db2e055a494

SHA1
34b2395d1b6908afcd60f92cdd8e7153939191e4

SHA256
4a725d21a3c98f0b9c5763b0a0796818d341579817af762448e1be522bc574ed

SHA512
621386935230595c3a00b9c53ea25daa78c2823d32085e22363dc438150f1cb6b3d50be5c58665886fac2286ae63bf1f62c8803cb38a0cac201c82ee2db975c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033
Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034
Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
8862e0e7a043742223e696a0bab49e8e

SHA1
473abc8c82760feff53fea04753c77548a2e4219

SHA256
09eb4afcd271e40c08fd462b6ce575f34befb31457be43830736d6abaefcaed5

SHA512
121f2f6357730d9e723d790b2a5b9833daacde57e281d48d8835c63434ebbf4b547a127f7a5c7064912ee19c8888e9c8841490f4ee1bfc1b19dd528896c73897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
7fc42e1d3e81ed54a9ff803f7058974f

SHA1
4c2bef38e63506b6dce66442d3bb30a3fcb17706

SHA256
dabc419a392ca2ea6405f2fb2f1cfbb038bb7f5c707fe9709ca932b7e990a299

SHA512
ebfd1e9649fc51df069af42c60d90b05745d08c3f2acae7ab70561805dcfff158400ccf13ef623dee97a236ca0769bc8ee143da1640cf03dd1d23904b9c141fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
118f686bc5c22caadd1c8de089c3cbc1

SHA1
77d0d48be1a6a210b44c9043e23daeadff560cf3

SHA256
4d1c6c113d19f88fd1ee54352836ae31206f5d074c18ee031a6de583e8c5886a

SHA512
606db2382c85d8ee226f467db42c675e81c3cd7a1dac4e2b7ecef819859c4520c529203dc5948004ee4b328a871194c1224b488f33562f9746e0f044d1851715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Filesize
319B

MD5
3162ebf0e918ffed077695c2d75e2c9a

SHA1
54fdc3c1a00f6ed2e53e027460f1df346eb22b80

SHA256
36c01028382b3371cc8167155c41b03eb5b5ca46100cd7f9e5a4b93b4ccdcf82

SHA512
94cc61424b8172b7505e2a169bb34db61e6cb4bd483aa0a7f68150cc1ce02912b4eaffd66610a8d12b433a38ccd90da7573cc581bb86a78024ee5d83685dc629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Filesize
124KB

MD5
3112886bf8ed0c195782cb13240ec4e3

SHA1
36f75f8c56483b50b656e9a4670348f844b0a426

SHA256
ddc9f5300baac54ab39f44b120afb8b776d18ef58d01205773804d4cfebf53cd

SHA512
7a4c4d2b853dd0440a1c5e79d13102e97e72a40df87df54b5f6e59d88d7c25811043a25ab21d207bb1f0ea26ec571a17bac20e9c4ebbc0a93abaf55991469727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Filesize
648B

MD5
08365bb70b7075940a2611da5048108e

SHA1
ad29d202ab21030b698d5e0becd352b820fea9ae

SHA256
7061292f0a297d4c63aef0887a45872b2070f3fd79893605194e4d114afc6bdd

SHA512
77f6236b8c06ed1937f5e90061e9d478aacd7e63ef41204caf9d99f0635e2fcde9063127cf0ad4be81ffa9d6d11aaa91693d8670b99008dc70e3262becd6bb86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Filesize
44KB

MD5
1e96deebce6265a8436a39cd77322176

SHA1
ec4cc630af01a4ee9f949e4500d5b1bf4fbf9609

SHA256
73721868cf2a32d80543bbb703b9c6cdd2f469336f99d7f7de6e8097236b0c8f

SHA512
c1d1756ee71395e738dc16c1655fff795c526eed7a8cc0151daedc9714a268eef7dfcc7108e6c0e0253fde4ffbc023bd9db02ebd97e9963d0cc328c5f47ebe57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Filesize
334B

MD5
1b2406f6e229cdf9fc556765928435f7

SHA1
038a66d2b5622a93022c22aadca684eddcfe5813

SHA256
2ab689b78d7a8c92bc3fbfd401e538b94c32ac0123eb23d52bbcba611e32c3db

SHA512
38e0b65b7e00071fcd891bb26e31bf786cf2aba118a3c151ffce1bd34bd82efd0b55578a6f95e190622ecfff3cf910d519493ce1f2cf1054042d4fd1073c5062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
68d5f7e6feccf4fdcbf1bf7773b9ec96

SHA1
52feb18eb9ad2aaa3c2cd94b6b8589c07f9d26d4

SHA256
8d3252da9e390a2e5f44872347a6e611e94494ad04a8a3c48e12821098167f11

SHA512
cdcd67fb19f2752b27438a480d18eba6a624de5d6b04e9e06eb3b177d427bde4f06b7ae5b8eb4dddf090cf697cf6263d988411b0deb9d8b72cc5de0de28c5115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
7826ce2cfb95f6415441fcc9418b0789

SHA1
8a72807254bc2c3fd8af664be2cc6dd957d9d5ad

SHA256
c2b7fe0b67189ca395d7ba8132aae9f7caf99cbbed396688e8ce3fb6e4854cfb

SHA512
edd478df73f74ee972b2155a739b8814e2b2886b91c43b6917ddd34036a06c92cb574296b719924c4d15e294d9830f046d33d156af4d42468090ff9a0b8cd14e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
c469589b4faf1e47454eb0d1f508df92

SHA1
bc3bbb25493ca406086e41bae1fe493107820ae8

SHA256
327245b487cb67142ba2a54173071fe515f27135dfbab0b1e301b69929f5df5d

SHA512
ef64e544a34e91b5eb95d60dcc95be44e99a985f4274903af80b50197c24d03956035e2451c77fac92a89a02365c5899da8ac87e976a432640e05cb317c73211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
da0c0b113ec77652db3da3f85f2cdb52

SHA1
df80985886cbea24f6d0c406857d7477764f22ed

SHA256
ffda284036a69dc6769a386d8f700ab2c53c89be887d0b247dc7a95c9c3d85e0

SHA512
b35790d9b574d46f258fee47e95ad036c441867f33541ab3b4d31fd63376c2cf8539b92a057aaa3ec2c1ea1b2fcd5ce7a88368954e1558673a65c969816c3964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
5d90c84ce806145ec002bac3be92f716

SHA1
cbc167fe234e163ac5307185e87797b91477d50b

SHA256
8ab5ea33e1e4af006485987a6fa80d600be5d8ce3e0373e24c52e25bad84de74

SHA512
bcfb668314036ba724fdeda9fe83908acf6777bec1d2800d4f34e035b82f1c4480ea83efea20e045a3b03f7200142f18136aed2876789c1eea42187eb8675070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
04876ffeaa2bbfd54fe1196eebc445c3

SHA1
197f8ad15c94944e789d199d951c8ddf122f34e3

SHA256
9933ed4f1261f7b757865db37f928512db373e536cd7d813f33d8d072adfea5d

SHA512
00e9d066b4f239e37759f63b2b1c987eef757713bc11f5bffdec44af23bcb7b13326846a3aaca9fe8f2eaa6eab1838ac4cdb44d694dd3c1912fa19c6984cab81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
16ee86d2ea19c598937a65176f1fb58b

SHA1
df4d3cd157453072839686db3c65e87d941ca396

SHA256
9bb59c6828e5c14d7bcb49c710667557428b0ee056e082ce6b0b68c1af92269c

SHA512
09bf9306cbffe94db1154ffd44a8c3388e2e41d8fb02fb9d1d5f835a21bf8c3d169a1228f7c8d6abf0698f612876958641aa664b70c875a61cfc8465a0d03e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
eb50063c242d3db1732bf404076247d6

SHA1
f2dbb049b87be881b0b216aa77921fcd9a6ab070

SHA256
23c4f69f4ec160756c0dbe5c15941b197e7e323cba7d33af4cf90d65517855fb

SHA512
ae85fa14447d1e20807ae3e341ce7c319e5ca7ebb426715c658a440adbe7b7878dd616d1c3e4f99b0086ffca0880f1f075c7fd86d8925b9ada9f810e3eb7ea28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
75f795e7c8920724dc21133bcc3a71da

SHA1
a261eced0d1b92c92f80297c4afbbdd6ae04d54f

SHA256
6cb359168da4f666ce89e45c50b3ae48223550860297a4a20084cf34422cdd4f

SHA512
15704aecc68f85ef4dc5256e0749f18a3c31d358484c14266925a59059dfe3359d46074500af54a6760592ff78ecb97f4dca8f2f06d2dc5d43c00654fb698a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
18cb9fd93dd6fd122549146a72cda030

SHA1
9951df2130dcdcc5ea520edce56240862126dc11

SHA256
908037fffdf12d4689a10866873fb559ad7ea989657418cd8aa8dc1d917eebc9

SHA512
16df810c634e501bb4dfa5606e3c5239f4a9fa534257a00f91debb4ec4aa4c0c0c62e1523ccd1626f855edccb9d7ae92ab1d463a74a09ce74b1a8539f92f7354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d5f24a7d63192de76ed806f1425467cf

SHA1
895a378cadf28034a226dc50d9e39715ce83b6c8

SHA256
ea1c49187e168c5f9de43b37e934891151a0fdcd5cf1108fb07167b8138559cb

SHA512
7aec4b7ae1c0200f7fd19f82c0b80bc1b04556a203b9d2a27aee5babd4c4d95bd97b91a41ee4630455451e43bc1278b7f9278c86f0fd447337d21730cd052f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
936738c2c487ddbeeab08c8d5e1ff44d

SHA1
00fc5c1e3c2a2a12b0141069ed2a7a4e8360074c

SHA256
011930f9c541608bd8a0b06d9ee48f63353dc9dd1af8619bdc346c9194d0814b

SHA512
ff803da8ff445a57c0cceb39cdd4cd7f999016b9d792e5bb4bb69ca84a90bbcf839b3cfe86369050508640ce3b31d1c1c80b2b5abf9c112eb31d8b85f51417af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Filesize
175B

MD5
6153ae3a389cfba4b2fe34025943ec59

SHA1
c5762dbae34261a19ec867ffea81551757373785

SHA256
93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

SHA512
f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Filesize
319B

MD5
20d3d7716333360633712a533ac4cfd2

SHA1
5542200472a452964d5f5909e87478b656d574f3

SHA256
c7fa3d6e646af50eba59b256b678f674077df90d9501f69f77da42a76c9f5b34

SHA512
a2841bd92715a274b2bff290b460a312b936b2f6ecf94a166d03f26956c5835689b2cab011398cf8555e2886f6c20f34f495cc817eeed8c7278dc89b91c88c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13357390297527956
Filesize
1KB

MD5
6f05cb9e635da308eb3f1ba5aa51857c

SHA1
dc91c2b666b00a5bc4c3b29394b8c35ee1d67ce9

SHA256
22051e33e5e802eda2513a711e52cdbb9022d33c2d374c35ee986155f7113778

SHA512
9918a05ae2605ca08fa4810d27825e80150b83cc4e4ae1093d860cc7b5aabd24566b316757c44ff3683e5c8a811a3aeae3e8b547475a62ae511ab6e2002a7c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13357390297547956
Filesize
1KB

MD5
6642c4c39d8217e96cf38b83411e7501

SHA1
092b0778ae59012e9e1d1dadd8ebd87c1b70bceb

SHA256
d59e6ead0a74a697ccfe0a52b466724fc7d5180194b45719d2f35e226318240f

SHA512
3adb886a475f65a4c6e62efc80a5245a1127fc2b66de2ef8d68f26d8fe786d20c129414a6f9024843081bb1a92a256cfa64c46b6c561991238bec29e14d8d172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Filesize
347B

MD5
04d3194080c4952ba5556b29c92d7b69

SHA1
fe27cc35906937994979bcc69d4c19d4b3dc4434

SHA256
bb90b8747a365fe75e2f874bab95d8e53e7a13aaac630095b991a6c6e97fb0e8

SHA512
c1e42fafa40e69d3813f17527a0b27b7b65f0ac5348fc63095f1ca13cb0592a105cbe6d4e2d5c2ec90b02b2be0fb9250c283fb8f186ad903e97f832fe52d42d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Filesize
323B

MD5
6346f1fc4676eaec471b9cdd6e73710c

SHA1
3a5292772de42d770f8ed3e822800157e12ace2d

SHA256
df4294914473b83629eebd81c8669c1b64c8248e56b415380f94db88f6706712

SHA512
2d007b010ac91bcb83040bcdd1b4f427bda6808e4bd62f971da8a69f8ae07812276348725bf19652912b11f35d8c6a10a2756ad236a67419af42adf051c31fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
0ea948aa8d7d8622ddf5cfa7f3b3c788

SHA1
e461255ce1bd089cc2a4cc1416eb870a70de13f9

SHA256
4c418073fcb100645b978a433708bd7f37cede7532b3fd1ac20ef21285f64fcc

SHA512
dccc493b602f393e3d0645741fff95647d296f829fd16ca2c14740937f9afe19121ddc9773eb22fd7a5e696bcd5da151264388734ad6c37339fcec8cfcbc4e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
78ad6792a3d5321eec3e2121024202dc

SHA1
104002895a0695a8845254b47695dfdd57c6a167

SHA256
f5ea80dec55015e696ce1efc243d8904ecf28819c788339766abdfef1bf972bb

SHA512
62b088ba3b34819c53707d912da6247bdc58c287b6ea628229672a1cf45b8a2503b236dfb6b894a9a28aadba514202cff999d2bee690f6410869af81813b36e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
082360aa007353307bb083e070657abf

SHA1
aec6f3953919010177d7c8fe46725ea10ed1db7c

SHA256
5689a1f5a9b7a8871615d77a6a8c2056cff12aa4ae0386b3b1566284bc6c2326

SHA512
953669943ef4d4973824a7607fe87219363a4027acd1b0a6cbcfeb05fdf0ad5908fd66c0cdec4b2337586e295b9c106a3cad10cfd4c8078f751c7654936ed1a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
4f7df288259e55204a0d6bdfbfbabbde

SHA1
633c09bd4243f7aafb49ac24f17901bc5edc1ec2

SHA256
e49e36e2b54883a70d04bd745016e57e79c17459e5b89fa9d83e3207e6ced45a

SHA512
27b2b41d7ce1aa182eda2c44b5a1246ef6001db272996796e1c376e0ffbe5d5c6c7c993619d002255e3205a05eecc02e20975a7053560d7ed3047c949d92bbec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581623.TMP
Filesize
1KB

MD5
17b5e006cb18e9acf0ee15ade4345ffa

SHA1
912c9c573801e74c7cbe5d6faf3e507afc80db9f

SHA256
d2414069321035d3ecd330c42cca755cf0d1b3a76a94e251f937713c14a646b7

SHA512
1ae379500018939e3c934be23073e2643ae680cea51e794859ba539e465596e1fc91ddd0e810fcefb6b09fd33bb9c6d6455af09e93699517e633ff7c218aa8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Filesize
128KB

MD5
ad9b5a29a31e37ed6fab2083de4a7fad

SHA1
25eb4c42b0ce049c34e2eed8cde91d7449abcb35

SHA256
15c70401abb83eae429e1bcbe2e1d7f497e450cae7b46421c78fb262521cbeca

SHA512
a866357822c1cc4067d24ac4c95b0fadd6507b7ac9e63d73f0ae0dd857a1960b519b030162b2e7e03fc0ac86e08d9c8f189819953d3affaaf87d6ca6edbbb594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Filesize
319B

MD5
b3dd9f9b45330d9649028d9906864628

SHA1
75f9c18e7bba12202fd71642e9484eff53c28b1c

SHA256
0114b80e29bb6b3c39c99823b1efe895431feeae4969f10324b60a9b2ff52033

SHA512
5847a3a1a31e6633280d820a26452f5921c5453b41832e6916ef2056aab4f97b1f73ca3a3828e1dfcb3c206ee5dd744289a8ab19f6f85cd7ee922dff8f89b10c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Filesize
565B

MD5
5c1f3300a103644930e4553c896cc04d

SHA1
72a83dae5d85ecb76c03301cef7d08975b2b5d9d

SHA256
f94a7190b40c9fb48a696f25368972e39989399d9518be2ed67569ecf339e0c1

SHA512
4ee5d226ee190758d3a0c5bf0eb5abe6ce3bf76b3e58951b39b1bf680854fbf2c53c15532558a07e87cbae86f1eac1129ccb67428d9e4791c81c3140aaf6a471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Filesize
337B

MD5
0ce1958f775eecf015103052387e5b99

SHA1
b461d80162a33aaf988ae6f86caca4a2e3f29786

SHA256
abe06e80a3b278c47725550da2fdd72576f3f3a79e7557480b5fb8682d9cb9dd

SHA512
a652dfd435cf353bf7fe9148ebbd62827145a0106836c59045f787da700d09bb94f9bede2049bd604ee09582c3e32931dba8f366bf3f5160f1db30f26c5f5f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Filesize
44KB

MD5
7502594b04ab0e5008557839420a2bdf

SHA1
e310a18a54c5e31e14003828f0151f060d8a34bc

SHA256
4585ebb0ab8b501a1e668a0d16238250eb9a9e5f8a8ebbf2c0aba6a80833b698

SHA512
18a8207a952497a094b17c202f8c50b8ea5860023637a4a19f3e8ba6d7ec2fd46cb2b8b8f69e445c1693333f33f1bb1581b19fbaa8109753a2d3dccd0574d0b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Filesize
264KB

MD5
8a74ad3d5283eca53058b741bca21daf

SHA1
b807962278798f33d5e1d63a3f70e095465c8fc4

SHA256
7cd5f14932cfde22a6abb562161e950d5a23751cbc0906901ae01bc1e16cc6e4

SHA512
c49952adf3230507a8016d38d8594200235aa8d8729d5f440c84f9b4a58c0dc26f36b92623f3c0f966e87928783d750262b6c2583ff5a3a47adec2c3273e4d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Filesize
4.0MB

MD5
4459bf26eebf0293b75c624cdf1c6b23

SHA1
2a0cf63d7d2a2a729b1b84e221955a5ab46f2e47

SHA256
2ddd13a6fc974d25f11c33a905c39ba8b6d266f7c58a93a41e5ada5975c821c7

SHA512
f9246c653ea54d90833734d359ebba743e97a7978639a8c48f64f2b026affed9281e65a44d12af2224e0493df1e3ca3dfd8fd101bd4c5170471b5dd6dbaf8f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c2e27490b48a830f7281befe754a0d4e

SHA1
6d729305c4aaad44382a42bd726f59401caefcc8

SHA256
6be6d775657518af82c629877e66b5dc4e3ab3647075b73a690bed16da0c94ce

SHA512
d3e1fb29ffd20dbd5465489a5302ae53acfe07c1386cc5562c762ddc40eeffa69bebd35e0a221be8f531662b3528eb70f0a2b67bbc0d7aee72726622203df173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
0aadb60dee60ff2c324896374574f3de

SHA1
61aad810b121e916fc341d828fc6f69c2be63873

SHA256
f75595085af73e23bde8b85395b77ba0b6e4c07e3e6a3f8f6b4665ebf3b9d484

SHA512
d8a9f16c1bb005e8a4ea0a09516ae7ffe05ce584a7c8e3ac4e589bb82be9ec38f054252d82a3fd8c63d1d6c2701f42de203d98a1706781418e8572b032855120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
ac95f393ab0c6f6fb3b78f916b9b50a0

SHA1
662dd29dfbdca5f7313467eff68bcf6534d8dd62

SHA256
522ec62f7ff48ca61f599c4cdeaa6e369925bd5b7f8a37fa52f73f8153f8eb25

SHA512
7903cb02208563742d9c103b950fd35f075c8d3587489dd32e5c207d7e1f3369f7daacd143dd90a9f3bea7fd9179dbfb13bd93a86b4b4ccdffb087ad1941297c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
de892e2bddec271928ab95c5f730f826

SHA1
b5f44e063f49f0f17cd1fbce5a8cf6449d184054

SHA256
a428db24358a19893e9ccf8650c3512bf7c5828cdfec04c005d17678bf25286e

SHA512
303164dde496ce9a847430cb56595f7e8676ec61c659b6d9d6f28669ca7c9fd5254b75871bf2546cc8da9181a529669904b2f00d98babc220c40c1b9c75822f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
8cb57338b7b7d403be4b9dd4155c9572

SHA1
04f9564fbbbc333392b3cff2af3e3cd32cfb10a3

SHA256
66adab07341eb15ca6077f662ed8e33602120a49d8d54206984bc26873bf64d0

SHA512
3cfc80c87b826cd6396ead970e3771f15d53b273567cd3a52dd02d83d0312fbdf32474a003477e78964fb0cb0e6e9f42794d8a265915b7eb8226d1b309f1e693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
bbcb0a7fcbf2b58c5575ffc10e82075b

SHA1
ef4505e8b3a970d7e2c0f17281450652436bf4c9

SHA256
d13a589ba9eb933f71d22b43c63548ff70f77d97825fa246ae88857076df10e8

SHA512
c5bc62ccb627f4d6dbbe4851f092db1b0d63c45a248929a29171de681d549e5ff5f2168f9c0dd011bb68307f851bedb427291c5a52e7657a272ebf2011e59161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Filesize
4B

MD5
fa00a9d8c19887ac3444360f929ad2cd

SHA1
71cd4ae2bbd3b5c5bf21f7a2df800e723d636b3c

SHA256
15a94f0cf348f8671a43dff217a26e50f033d17cbbc5293515b694bf4facc5df

SHA512
5bc0678aee12ab6d064fb99b6b6f66655c19aefa3f246f537567c21ad7faa3d7b4fd9271c164e4328d6d5d9d1e93dce1059fa77e2158c16ab064454cc3846984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Filesize
4KB

MD5
6f469a68599c1526c2c8564bd6ecddcc

SHA1
d2c68ae382a2a84b83c3c64683ae4d77c7a2a2a8

SHA256
2d68a965a314b17991616732fb49cdef51ed72d8ccd6f409d3109d83c3461132

SHA512
9d19f1bbdad6dea5dc02c2c9e57be9620170d8c6b7675da9d3f2e3fe2ab0fc8d1d759c33bcb8a1a7f2a0664c2ab862874bf6b9e3919bfd6a37bcc7d6854c9fe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7xp06zd72yer47xrh4xjg3jg\95rcuwgz982fkggcdrwcqtuh.msi
Filesize
105.4MB

MD5
44b650efeb2e9a34fbf89ab916190ef6

SHA1
201b1836361273c0ec80bae316f4a650314684c3

SHA256
5747fa25731c99b296ef76813a4e9d12478a54ce3dd0a495acffa71d270a6901

SHA512
f693236022f4992f48bce546a0649fe4f27a1c6d39dc140805fd3a40d26d4b0e5b3dfcfb85ff8defae9363c4c2a8e5d49208fe9bcfeffd01d05d998f33cba02b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7D75.tmp
Filesize
297KB

MD5
3e96d4bbea9f87cccdb9f1ba6d14309e

SHA1
1de6ef91b7d961ea5cbd4e23ca14174dc966b4e3

SHA256
b5cc30d5a2678bf4a8d1889e1db385bccac012156562551e6c508e0801e912ff

SHA512
e25fcca4699aaeae4f0953c69b65b2ea150c0049c5cf5e4370e279617d6553461f7ce2729fce049d4118ff66c2cd3f7eb537e0fcd8249fad32ce17373cf4b9b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
11KB

MD5
ff6688a3682b048f326e0aa4ebb93182

SHA1
beaa34d3c0ce7cb4bd826b4c28c0ca30ed5e4123

SHA256
0e0dd727de7c7af9fde451cb66de82e621bf87c6018880db2d1d040e2999a775

SHA512
5cefa7e04058e60061138f1901300f31910598eae13b0f5bf4cde8100f9af6b605b8796049990df3c6ea1d094b5fd86a323fcc713f196873912273f61c21ea72

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 968171.crdownload
Filesize
83.6MB

MD5
91cf026ecf338b2c31c8ed205233c6da

SHA1
9efe9c772add012f6e90f7788581592de21beb7a

SHA256
a0e5f7aac1d892299f12df1a463438f1d1707d8fa40a175e40fef23857115c6c

SHA512
24da7d3e29e826c40ef7ea930558810d6ffd80ad546b788b9bfe1dc0692b496addee20d56354911b52c5aa23a6154c412f7bd76f9e0549fc2ffb2ec750408cc3

Download Submit
C:\Users\Admin\Downloads\VirtualBox-7.0.14-161095-Win.exe
Filesize
106.0MB

MD5
cdf2059571281b67a232c4933d7632e2

SHA1
5a7496a1adfb5dd3ce6b02ef51dffa0a5c0ea2c7

SHA256
4719b38e7a276b43099ce4d6349e6bfc80edf644ee59d9dafd264bc7ed7691f4

SHA512
bca6b7770162cf02dce019230097d107ff876c0ca6a32fd78e7a361f6a5a183698ad4d0bc026c59dff5eb43ac209434ca2e0adc3e9f6b4f9dab20fd3542c2d28

Download Submit
C:\Windows\Installer\MSIE560.tmp
Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\System32\DRVSTORE\VBoxSup_5018924056E84EABA285BB0DE5B18677DC64C518\VBoxSup.sys
Filesize
1.0MB

MD5
6276906d6a4ee29b29ca50b4825d4098

SHA1
b542ea87c12b788c87ed693d549fcffd562c354f

SHA256
73fa8b463ee9a95930d98da3f9dd0637e63f06e8cd510bcaa285d91e4dcae2c7

SHA512
bab6e0947bcc54b95e504e24d5305dbfb7d6c1e60795655a5c308c0a9fd2433bf4449b838f8cbb021479dcf6383f853445f719c8347a7e13f1e05b622b09207a

Download Submit
C:\Windows\System32\DRVSTORE\VBoxUSBMon_4DC22822E5ED15CFAF42864CC0F1E63EBC74D076\VBoxUSBMon.sys
Filesize
199KB

MD5
ea4f74bf86589c6e8f0fb2866b3820aa

SHA1
17a542351d8cefbc25ba2a184f80a6897566ac7b

SHA256
ade2e8d684cb59bfea99ad09e55bc5f2a808d824c2905ded1366b7d32e906529

SHA512
397a2129d9df502636776d49c62ce2887999f3e24f975905f108bf7c2a7196e0227f20f7644cceba9513384781f2988c6e1ce8047f705c872fb3970ce15466cb

Download Submit
C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\VBoxUSB.cat
Filesize
11KB

MD5
351ea41c61b4b84fbc0a461b1768e104

SHA1
e9fb74d027a25e4298eb751e2ae156c8806428c6

SHA256
36b73da2bc1b809022fa8c8072a52d082a869243dd78b08dfcf75f1146255a31

SHA512
d0b2f30bcce8e324856f6184f50f7bc24ecf220b575c14166a81ebad7acaa3b14250aefce10e095bb90ea0565be85c7638a03ea289f61c46921b800d3b5a5b5f

Download Submit
C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\VBoxUSB.inf
Filesize
2KB

MD5
9cbb45c10d1d5920e4d9320e8dde36d4

SHA1
3efb47a5381654a7f996c4049ffcb7ad671f2c3f

SHA256
b97746731c3f8ceb709020ef1be969721b004f001ea2e55f61a0c395d611b109

SHA512
e72d534560789d15a6bdaa481d022fb5111b75e8321f0e1947e653c598e7cb8ed1ca25dcc01a4c341cc7bb0fca133f6c92bbb7f3cfb188fdafa0babc7d558ee1

Download Submit
C:\Windows\System32\DriverStore\Temp\{0a16d658-bea5-a941-ba95-e62e1ae01e05}\VBoxUSB.sys
Filesize
184KB

MD5
4669d1db0f07515d41f21f308b4b390d

SHA1
3400d9f8ce5541e5fd59f546a7a44d98ca7eb331

SHA256
a6c70813d6afd3c9e191de5127c219d912a11db1a6fda80fd6793a97e5a9e692

SHA512
3b285fa9b2fc63cd8f7b756dfcba56022b67aa4ddf5d40fd4611037af92a31502df43b0c2ffe8f28faf5ae97e69497d540cc4028be1abf42b34cc6433eb307a3

Download Submit
C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\VBoxNetLwf.cat
Filesize
11KB

MD5
6d9d62401ebc8d8b48e6724c2e162d2e

SHA1
7d64d6c2b98e6545382a5c3ec31bc71e2d6b3035

SHA256
e308cfc6edf3b6e969a115eeb111d0fefe0be93e00856ab1280459dd83a9f93f

SHA512
46244a02f61d6048630312a0827f0141b8e99501d367a6feeaa5d9ae5c157f98969dc50642ad4d03b5863b196456d8d903241b1077809d280b860bd6aba6bee4

Download Submit
C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\VBoxNetLwf.inf
Filesize
4KB

MD5
4b79c4041164c4d8b24a4f51f25b026a

SHA1
e877f526967674a90108da7be7cf38744e5969c9

SHA256
dbcc2c6f3dc2a68eabc698d2d7d94837e9f79711dd13b414299e20c00c016779

SHA512
8c7ab281df799538f0dd1a2b353c072cb1cada3b57e6aceba5e7f228cecfe5634e26ff05b927d46a6fe0f9e6cdabb4c266cfc1e1a425f04f0f2be9a179bd4a30

Download Submit
C:\Windows\System32\DriverStore\Temp\{14dbd245-f273-a14d-ab32-46f40411fe66}\VBoxNetLwf.sys
Filesize
259KB

MD5
96a60dbff3c4c7217741e0007d0f4abb

SHA1
1651f89d9ab8455dd4458f605bee3a4ce429e42c

SHA256
cd3af3b853c27626fcfc85997feead0a48e56d618e2129f62fe1b96a203a44c7

SHA512
bb7de376b7fbb8e8dcf2a49f9c4e195510ae5895d0f612dd9f80fa56197b55b81cd31151bdcacafc616c7998513cca81192460e09b9a433f9b688d706ebf3d48

Download Submit
C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\VBoxNetAdp6.cat
Filesize
11KB

MD5
75eb3dc02a8ee04f1f3c96bd80e253a2

SHA1
ace2f9f1eac41cf6bd3dbb2d69530c6f044afefb

SHA256
a27ffe3f719b5f87c694b273af7e5796cf93a495cd195aff25e44e24fecf8e1b

SHA512
3d451852408ac7045c1558fb97a21a61d99bae207e3e28050109170999fcaf7f091108d3a15596946aed55497611110040726bccb939850744c5b628db369a75

Download Submit
C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\VBoxNetAdp6.inf
Filesize
3KB

MD5
6016637d32182738bfc71e7e86bfa1a3

SHA1
ee76c95ba76286743ab9d3420c58c41e0f1793eb

SHA256
68fca318c6f63b1d46f3a75ad62aedf1977d135411d82e850f09a6e6e7e8765d

SHA512
dc1c2584c8f25b527df9aaebba3ff7cb5ea9427825b1af9f72005f6789aa8502bfe2a16ce1c2229d1ee62b3d553b7792ff943807d753fb5dd50f084cc1815ddc

Download Submit
C:\Windows\System32\DriverStore\Temp\{8841846f-5629-6540-8e21-1a731dbd1cbb}\VBoxNetAdp6.sys
Filesize
248KB

MD5
2ac0caba931fd7736866c3867f8ca6eb

SHA1
610700909bb66d0842706dbdeb6540bc843a5d89

SHA256
4e619bb6370f4bc4be52f43d6c43f3a86e3e2ce7bb04baadff17d3b731f18f3f

SHA512
cfb1dbd3227941e3f04f366ae661ebe3503ef789e70bc0a438569fbbdc2a2bd89e8d3b978db44e5182f81a0b98b01cc5d70690ebc8d0b5b24a00bba48c3eb866

Download Submit
C:\Windows\System32\catroot2\dberr.txt
Filesize
19KB

MD5
7f2a10f540015917efc862b601632e7c

SHA1
c91f24ffc9af54dcbbf5fa10283c26e7b57ba049

SHA256
c73fd4ee32b45277f5b99dfc0df06424a9edb7ff41ca97fdaa0b32022892656d

SHA512
79bee805a70fdf4ae0a0b83f02ef5a2514e43d35121e441aa373a34aef9c44094a2bea118bea17ffc2e123da6c640b0c2322f9d804fe4ad4255c0c065912fb7f

Download Submit
\??\pipe\LOCAL\crashpad_4076_CHGHMCDYITGQJYUV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/752-1956-0x000002B871070000-0x000002B871080000-memory.dmp

Filesize
64KB

Download
memory/752-1967-0x000002B871120000-0x000002B871130000-memory.dmp

Filesize
64KB

Download
memory/752-1799-0x000002B86D480000-0x000002B86D490000-memory.dmp

Filesize
64KB

Download
memory/752-1798-0x00007FFE49B00000-0x00007FFE4A041000-memory.dmp

Filesize
5.3MB

Download
memory/752-1797-0x00007FFE4D560000-0x00007FFE4F13E000-memory.dmp

Filesize
27.9MB

Download
memory/752-1945-0x000002B86DE00000-0x000002B86DE10000-memory.dmp

Filesize
64KB

Download
memory/752-1946-0x000002B86DE10000-0x000002B86DE20000-memory.dmp

Filesize
64KB

Download
memory/752-1947-0x000002B86DE80000-0x000002B86DE90000-memory.dmp

Filesize
64KB

Download
memory/752-1948-0x000002B86DEC0000-0x000002B86DED0000-memory.dmp

Filesize
64KB

Download
memory/752-1949-0x000002B86DED0000-0x000002B86DEE0000-memory.dmp

Filesize
64KB

Download
memory/752-1950-0x000002B86DEE0000-0x000002B86DEF0000-memory.dmp

Filesize
64KB

Download
memory/752-1951-0x000002B86DF00000-0x000002B86DF10000-memory.dmp

Filesize
64KB

Download
memory/752-1952-0x000002B86DF30000-0x000002B86DF40000-memory.dmp

Filesize
64KB

Download
memory/752-1953-0x000002B86DF40000-0x000002B86DF50000-memory.dmp

Filesize
64KB

Download
memory/752-1954-0x000002B871040000-0x000002B871050000-memory.dmp

Filesize
64KB

Download
memory/752-1955-0x000002B871060000-0x000002B871070000-memory.dmp

Filesize
64KB

Download
memory/752-1796-0x00007FF755E70000-0x00007FF7560F4000-memory.dmp

Filesize
2.5MB

Download
memory/752-1957-0x000002B871080000-0x000002B871090000-memory.dmp

Filesize
64KB

Download
memory/752-1958-0x000002B871090000-0x000002B8710A0000-memory.dmp

Filesize
64KB

Download
memory/752-1959-0x000002B8710A0000-0x000002B8710B0000-memory.dmp

Filesize
64KB

Download
memory/752-1960-0x000002B8710B0000-0x000002B8710C0000-memory.dmp

Filesize
64KB

Download
memory/752-1961-0x000002B8710C0000-0x000002B8710D0000-memory.dmp

Filesize
64KB

Download
memory/752-1969-0x000002B871B00000-0x000002B871B10000-memory.dmp

Filesize
64KB

Download
memory/752-1840-0x000002B86D480000-0x000002B86D490000-memory.dmp

Filesize
64KB

Download
memory/752-1968-0x000002B871720000-0x000002B871730000-memory.dmp

Filesize
64KB

Download
memory/752-1966-0x000002B871110000-0x000002B871120000-memory.dmp

Filesize
64KB

Download
memory/752-1965-0x000002B871100000-0x000002B871110000-memory.dmp

Filesize
64KB

Download
memory/752-1964-0x000002B8710F0000-0x000002B871100000-memory.dmp

Filesize
64KB

Download
memory/752-1963-0x000002B8710E0000-0x000002B8710F0000-memory.dmp

Filesize
64KB

Download
memory/752-1962-0x000002B8710D0000-0x000002B8710E0000-memory.dmp

Filesize
64KB

Download
memory/752-1970-0x000002B871B00000-0x000002B871B10000-memory.dmp

Filesize
64KB

Download
memory/3068-2020-0x00007FF6CB2A0000-0x00007FF6CB3B4000-memory.dmp

Filesize
1.1MB

Download
memory/3068-2019-0x000001F6CB4C0000-0x000001F6CB4D0000-memory.dmp

Filesize
64KB

Download
memory/3068-2018-0x00007FFE4D560000-0x00007FFE4F13E000-memory.dmp

Filesize
27.9MB

Download
memory/3068-2017-0x00007FFE4F850000-0x00007FFE4F997000-memory.dmp

Filesize
1.3MB

Download
memory/3068-2016-0x00007FFE49B00000-0x00007FFE4A041000-memory.dmp

Filesize
5.3MB

Download
memory/3068-2014-0x00007FF6CB2A0000-0x00007FF6CB3B4000-memory.dmp

Filesize
1.1MB

Download
memory/3132-1986-0x00007FF6CB2A0000-0x00007FF6CB3B4000-memory.dmp

Filesize
1.1MB

Download
memory/3132-1987-0x00007FF6CB2A0000-0x00007FF6CB3B4000-memory.dmp

Filesize
1.1MB

Download
memory/3540-2015-0x00007FF6CB2A0000-0x00007FF6CB3B4000-memory.dmp

Filesize
1.1MB

Download
memory/5804-1989-0x00007FFE49B00000-0x00007FFE4A041000-memory.dmp

Filesize
5.3MB

Download
memory/5804-1992-0x00007FF6CB2A0000-0x00007FF6CB3B4000-memory.dmp

Filesize
1.1MB

Download
memory/5804-1991-0x000001AF98FA0000-0x000001AF98FB0000-memory.dmp

Filesize
64KB

Download
memory/5804-1990-0x00007FFE4D560000-0x00007FFE4F13E000-memory.dmp

Filesize
27.9MB

Download
memory/5804-1988-0x00007FFE54290000-0x00007FFE543D7000-memory.dmp

Filesize
1.3MB

Download
memory/5804-1985-0x00007FF6CB2A0000-0x00007FF6CB3B4000-memory.dmp

Filesize
1.1MB

Download