176b2fbe38f0d14ee68c65c56e2731646473c0f51e92d3affd2048959fab6bd8

Resubmissions

25-04-2024 10:28

240425-mhrwhshh5t 8

25-04-2024 07:41

240425-jjfm4agh47 9

Analysis

max time kernel
405s
max time network
403s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
25-04-2024 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fixer (2).exe
Size

180KB
MD5

db1841bfa15492d1f6a4b46e921068a4
SHA1

9526c45f7a9d59e0a5dda1b57ddbaf8425716e9e
SHA256

176b2fbe38f0d14ee68c65c56e2731646473c0f51e92d3affd2048959fab6bd8
SHA512

22110b41d057696ed5604c84fb40c881024cc8bb045135e258e6f7b0c5baac29d40b7b2b4cb1c4a3391ab2944b43c6b293ec628901abf6447124404111e41b18
SSDEEP

3072:jh+8/+IVkJZ5UkcGkKLv/YiJlNZ9pshMniWGkJAPXsPzljLD3rv8Gz:jh95UZ5L8KL3YirfbshMiWFusPzljLDV

Score

8^/10

bootkit evasion persistence ransomware upx

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

Sigma.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Sigma.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

uwudaddy.exeCovid22-Joke.exeCLWCP.exeCoronaPopup.exeMouseDraw.exeIconSpam.exeinv.exeClutterScreen.exe

pid process

3536 uwudaddy.exe
2504 Covid22-Joke.exe
1216 CLWCP.exe
4856 CoronaPopup.exe
1996 MouseDraw.exe
104 IconSpam.exe
4912 inv.exe
5068 ClutterScreen.exe

pid	process
3536	uwudaddy.exe
2504	Covid22-Joke.exe
1216	CLWCP.exe
4856	CoronaPopup.exe
1996	MouseDraw.exe
104	IconSpam.exe
4912	inv.exe
5068	ClutterScreen.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 592266.crdownload	upx
behavioral1/memory/2504-677-0x0000000000400000-0x0000000000589000-memory.dmp	upx
behavioral1/memory/2504-698-0x0000000000400000-0x0000000000589000-memory.dmp	upx
behavioral1/memory/2504-812-0x0000000000400000-0x0000000000589000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

59 raw.githubusercontent.com
65 raw.githubusercontent.com
70 raw.githubusercontent.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

Sigma.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Sigma.exe

flow	ioc
59	raw.githubusercontent.com
65	raw.githubusercontent.com
70	raw.githubusercontent.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Sigma.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

CLWCP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\clwcp.bmp"	CLWCP.exe

Drops file in Windows directory 1 IoCs

Processes:

CLWCP.exe

description ioc process

File created C:\Windows\clwcp.bmp CLWCP.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2596 2960 WerFault.exe Sigma.exe

description	ioc	process
File created	C:\Windows\clwcp.bmp	CLWCP.exe

pid	pid_target	process	target process
2596	2960	WerFault.exe	Sigma.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4632 schtasks.exe
Delays execution with timeout.exe 5 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

3332 timeout.exe
3740 timeout.exe
2076 timeout.exe
3324 timeout.exe
1212 timeout.exe

pid	process
4632	schtasks.exe

pid	process
3332	timeout.exe
3740	timeout.exe
2076	timeout.exe
3324	timeout.exe
1212	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "138223844"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31102788"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 6 IoCs

Processes:

explorer.exemsedge.exeMiniSearchHost.execmd.exemsedge.execalc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-801765966-3955847401-2235691403-1000\{37F50EE9-0F92-4909-9A21-5C8682AC4632}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings	calc.exe

NTFS ADS 5 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 120641.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\xbox 360 hax 2008.bat:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 592266.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Covid22-Joke.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Sigma.zip:Zone.Identifier	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1660 PING.EXE
Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid process

664 regedit.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4844 EXCEL.EXE

pid	process
1660	PING.EXE

pid	process
664	regedit.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

fixer (2).exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
3836	fixer (2).exe
1448	msedge.exe
1448	msedge.exe
3528	msedge.exe
3528	msedge.exe
1316	identity_helper.exe
1316	identity_helper.exe
4992	msedge.exe
4992	msedge.exe
1988	msedge.exe
1988	msedge.exe
1888	msedge.exe
1888	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
1028	msedge.exe
1028	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

msedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

fixer (2).exeuwudaddy.exeAUDIODG.EXEauditpol.exe

description	pid	process
Token: SeDebugPrivilege	3836	fixer (2).exe
Token: SeDebugPrivilege	3536	uwudaddy.exe
Token: 33	2488	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2488	AUDIODG.EXE
Token: SeSecurityPrivilege	132	auditpol.exe

Suspicious use of FindShellTrayWindow 54 IoCs

Processes:

msedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

EXCEL.EXEOpenWith.exeMiniSearchHost.exeCoronaPopup.exe

pid	process
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
4844	EXCEL.EXE
1356	OpenWith.exe
4144	MiniSearchHost.exe
4856	CoronaPopup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

fixer (2).execmd.execmd.exemsedge.exe

description	pid	process	target process
PID 3836 wrote to memory of 1952	3836	fixer (2).exe	cmd.exe
PID 3836 wrote to memory of 1952	3836	fixer (2).exe	cmd.exe
PID 3836 wrote to memory of 4628	3836	fixer (2).exe	cmd.exe
PID 3836 wrote to memory of 4628	3836	fixer (2).exe	cmd.exe
PID 1952 wrote to memory of 4632	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 4632	1952	cmd.exe	schtasks.exe
PID 4628 wrote to memory of 3332	4628	cmd.exe	timeout.exe
PID 4628 wrote to memory of 3332	4628	cmd.exe	timeout.exe
PID 4628 wrote to memory of 3536	4628	cmd.exe	uwudaddy.exe
PID 4628 wrote to memory of 3536	4628	cmd.exe	uwudaddy.exe
PID 3528 wrote to memory of 3040	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 3040	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4108	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1448	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1448	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1644	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1644	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1644	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1644	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1644	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1644	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1644	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1644	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1644	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1644	3528	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2564 attrib.exe

pid	process
2564	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fixer (2).exe
"C:\Users\Admin\AppData\Local\Temp\fixer (2).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "uwudaddy" /tr '"C:\Users\Admin\AppData\Roaming\uwudaddy.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "uwudaddy" /tr '"C:\Users\Admin\AppData\Roaming\uwudaddy.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4CA9.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3332
- - C:\Users\Admin\AppData\Roaming\uwudaddy.exe
    "C:\Users\Admin\AppData\Roaming\uwudaddy.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2448

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Documents\DismountRemove.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4844

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
PID:4868

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff896953cb8,0x7ff896953cc8,0x7ff896953cd8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1664 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1244 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\xbox 360 hax 2008.bat" "
  2⤵
  PID:1064
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Runs ping.exe
    PID:1660
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    - Modifies registry class
    PID:1172
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2036
- - C:\Windows\explorer.exe
    explorer
    3⤵
    - Modifies registry class
    PID:4664
- - C:\Windows\regedit.exe
    regedit
    3⤵
    - Runs regedit.exe
    PID:664
- - C:\Windows\system32\tree.com
    tree
    3⤵
    PID:4660
- C:\Users\Admin\Downloads\Covid22-Joke.exe
  "C:\Users\Admin\Downloads\Covid22-Joke.exe"
  2⤵
  - Executes dropped EXE
  PID:2504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\Covid22-Joke.cmd""
    3⤵
    - Modifies registry class
    PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\CLWCP.exe
      clwcp c:\c22joke\covid.jpg
      4⤵
      Executes dropped EXE
      Sets desktop wallpaper using registry
      Drops file in Windows directory
      PID:1216
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\lole.vbs"
      4⤵
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\CoronaPopup.exe
      CoronaPopup.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\MouseDraw.exe
      MouseDraw.exe
      4⤵
      Executes dropped EXE
      PID:1996
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\IconSpam.exe
      IconSpam.exe
      4⤵
      Executes dropped EXE
      PID:104
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\inv.exe
      Inv.exe
      4⤵
      Executes dropped EXE
      PID:4912
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\ClutterScreen.exe
      ClutterScreen.exe
      4⤵
      Executes dropped EXE
      PID:5068
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,9955327785960462799,15809110869220668620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1356

C:\Users\Admin\AppData\Local\Temp\Temp1_Sigma.zip\Sigma.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Sigma.zip\Sigma.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
PID:2960
- C:\Windows\SysWOW64\appidtel.exe
  "C:\Windows\System32\appidtel.exe"
  2⤵
  PID:2852
- C:\Windows\SysWOW64\ARP.EXE
  "C:\Windows\System32\ARP.EXE"
  2⤵
  PID:1340
- C:\Windows\SysWOW64\at.exe
  "C:\Windows\System32\at.exe"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\AtBroker.exe
  "C:\Windows\System32\AtBroker.exe"
  2⤵
  PID:3988
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe"
  2⤵
  - Views/modifies file attributes
  PID:2564
- C:\Windows\SysWOW64\auditpol.exe
  "C:\Windows\System32\auditpol.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:132
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\System32\autochk.exe"
  2⤵
  PID:812
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\System32\backgroundTaskHost.exe"
  2⤵
  PID:3460
- C:\Windows\SysWOW64\BackgroundTransferHost.exe
  "C:\Windows\System32\BackgroundTransferHost.exe"
  2⤵
  PID:3316
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe"
  2⤵
  PID:4540
- C:\Windows\SysWOW64\bthudtask.exe
  "C:\Windows\System32\bthudtask.exe"
  2⤵
  PID:200
- C:\Windows\SysWOW64\ByteCodeGenerator.exe
  "C:\Windows\System32\ByteCodeGenerator.exe"
  2⤵
  PID:3556
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe"
  2⤵
  PID:240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 1188
  2⤵
  - Program crash
  PID:2596

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4144

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2960 -ip 2960
1⤵
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54caf18c2cda579e0dad6a9fc5179562

SHA1
357d25de14903392900d034e37f5918b522e17c9

SHA256
28d77529de92eb605d8afee0e133a7d08e13d4386e5e38d63e2da34623eaad6b

SHA512
88da5a33df9d82408afb8344ec7dbaf7686435fdb55eccfb85d5560f39861e84cef5d71949d5efe7a191778e6be755a8448f3fc3d7043007037f9f5227e10210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
696ffba7b83ecf008523e96918f200d9

SHA1
970d90e22c8b3674fc33cdd1913c51ef28514255

SHA256
dc6dacd725d7385b2e4db1f488d93f2840d2289efdaaf3737849304d1ab9ba34

SHA512
f8528683b70b58376f3eba3338fa6b462c9e9248c72524573005cff6397a0556bdcc2fdc2ebb020ba8218bc8174ba552002f223a245dfe3d3688826d24d63237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f4766ba5d58752f08d02bb5c0a21b14f

SHA1
8bc933f3f6ab728f575dfd68d54bddee4c8187df

SHA256
b9067d5d9b1d13280e23a2590745298b24bb710a4ad64b21b8bb8e3823a140d8

SHA512
c717720957ac597966d8c67f3144c53f5ca76e6bb0399086206a41bed6dbfb059dc99c282b3010f173c29bfae78d6515b638ae4ff5b1b7785de7d3967b88a1eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
33beb39d59158ac0ca5a15722d31fa9f

SHA1
4fb55e4105fb59974caa4303bcb46b6f7121e618

SHA256
47c1bab9e1015832947600dd931ef3be4c6795014d094859733b6ed2b3029061

SHA512
ea85ca6a5692831caa1925e21a1e1eeb9b7c0be8a6f2cf51022bf4d1f153fa830ec01137abcef4e4e177b3fee44b89a11dfcf82016c45c39b01656c4914d5d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1019B

MD5
f33228aedee0cf82decc6921ae6cc9e3

SHA1
f59c8e6002c33bf34a828fcfbc0ba6714eddd08d

SHA256
23021ff5f27350528ce2a0ee0a68d5313c0620ebbe4667bb062d862487f8eb31

SHA512
99595c188662d7dd1c9ea5df5d215ecfedd1f6f93faa4c5e3552401c678ca445e06dd6edf1b14146606a491eaedcc02656a77d2715df81c92a02ed1279a39af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
936B

MD5
59d5df4284bed2e48bbcad2c8c6004ee

SHA1
0f1c5e875646c454a2e1343cbdbb6ff6896c3299

SHA256
5355b2d5991557687c0be2749463b91c6a79bf5b664508cf24ea82b58a54f5c2

SHA512
1aed368379fb644b637dd0b244eae29795ec846fa46bae622127994b8ad96de8ccaccc96a8d1439224fe146e6a82cdf381cf8eaaed4c6c85e8813b8c550aed87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9eafca7c28f0e8130865ffe68907aebd

SHA1
9c264f7abbed432159042e69508c8154f59eb25b

SHA256
f1e8068c1b025bb853f18910892f9c90e9a8b6c17974c1ac615b5a0f7bf57113

SHA512
4147a8608d2f98772becad5870382a6998fe979764c819b11348e19d297ad928fc3a7595fe91faeb494566aa70af63af527e1b768afd79ba085cb1c4d64b6b52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8462643365f768c75aeb32db40b9cf9b

SHA1
0ed3bf60369496d12462eb809f48e65795c6cc5c

SHA256
981939a86e6f6a2a23f0f24dc38fd918004d0cef99c5cc7400af7e6353194736

SHA512
2354b387dc59c44663b29cacff9227558f08095add6d68808780b7862ca0aaaa485caa8e95e8503dbcc734f8e3f5ac6c088a545d9df6f6989672b7407371a642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
375e4bedf856ca752b471cf8ddd5617d

SHA1
0caf0b4493d7d5cb1435dba2419966b139a48f26

SHA256
1b9d3c544f99be59fb7d9ae3543736baa0c10c3466d0d39be000d4fb7e3859ec

SHA512
18ebe90f99a40704b83350f692c23ce18f054fd7bcfffadb6565760cf6a45abc83ae58c58eb46aed5c2feeba79d7cfd16a50e71312fc23be4ce70e561253b31b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
51db93cb74bbfaf9710cd21a00e3a48b

SHA1
2f8a6a43ad4c73fee1209b76a3ad2bf6a87ea8df

SHA256
c17b76ac9a4bd9c199f7b73e7817bcad236bc145d4d49df6ac96d5c38c59a189

SHA512
9baf5fddeb8e95c051fcd620e79924bc53191527de3409bbd48948cc471abc659cf30944962c51f0022320e3dc256c9f101d62f68d1477200bae4a72885a1ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
44b772da697ff7f7462160e1f9ab555b

SHA1
fd41c08c8f1dc640ccb9977ba818183f2e99265e

SHA256
1b5784f66d1ec0395d804533658cb873ebff5e67572f98409655354004ee85b3

SHA512
b41b7a36b966850722934017dbb09bd2a6c972c590fd84882df0e9de8bc39e6a0efb8872e5b34bcb4c6a06156d6589b554886a32c37ce8b6c949f2fee4fa0e00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4a259d85b3b41d59190ed7b03e94ff5e

SHA1
adc9f23ce83f90d5669fb78550ea1689a4af77f1

SHA256
bd243364a2c2859c0a48e933b2171601166828c7373fa88ed86cd89f792a8953

SHA512
f995a4b146d7234ee8f95581aec915887ce28a9d49f5873915e2fe4ff262d2fa2701ecf8ad5992290351d5092a7a25a5c46d775e150e722481af20489a8890d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e75e84dd5144b3a6e0ad39620fffa68b

SHA1
2d6d6e0f6054d09623724a72f82edc3cd732898c

SHA256
fd3e7bed4d12ed0a7a3cbd4e06cedaa58732657eded9f0c22604b53e5f48a975

SHA512
14c27ea8218c2cd22d6b1bbd16ff2a860775a4215183c3b0bcdbeb84c85fdc7a76dab5f49be7cce68a7c1ec10e786b0a5c41e1972392266bba98997684bfab0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
592ff04b55c528c4742c94c26b57a70f

SHA1
e3f1e5faa41b5eb5c3b488d5b53a43fa236820c8

SHA256
4ece777af388bf99214443a1ecd8894f86dc228794001d643815fc59a89d4ff9

SHA512
6bf44cba4d95167e5f6dfe1c87303b6db82d0c3d68ec0c8106ba6d8a0444c0fd1b1536af120ddc52d24a1e1538eb108d90ce7c5336484d0426e830d818eed778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8f18d477069a43209f1d3f3aa2a18772

SHA1
05fe321d3514ced3f416789b48fc6393f55ec015

SHA256
1d43b8d192c02fb05abdc508b3363a346e894e724b78f131f172b080b294e9f4

SHA512
e2486b4fcd8df59aa087eb9567b9cdfc52bd5ef1635eee371e02a116008e09666235d1ba4a67e95f892e2a25338660d8de85d17853d116f651deb74ea9aef03b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594982.TMP

Filesize
1KB

MD5
d493010e3c70aaecb5d919c2b60c01c9

SHA1
9b72704893361270362c40119d6c278246f8d15a

SHA256
3c9a02aefcab256658a0fb0ea99abd6c2d6d49bed9c1aca4b6dc3248244ff8ec

SHA512
e126375befef63b52ba85848283d938458553c3f48efa2ec78315beeda24d3d3c75b8d6bea5f33966661957153065f0d6c67b7f4f6f3b3d64203f8ba1b0db9ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8f786a882012f513050e20d703681c7

SHA1
6332bc180d2d485a8b8dd5a10582983d95ad8c05

SHA256
01b8c258a44a2c0e5f96d55c78eed7814596a8517c566204bd49a3983f46500d

SHA512
34fde4ffa96b5979ce0a694393d474ec0dcc8d5ba11a4b694f196855a266a389ba758e74d203f2ef35c2cdbf5267c52689d8da873774dfdab53a4bfb4bfc0447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2e6efc9cadb6b9f44d65057c7dab296b

SHA1
dad442c8ef5d0b7ee31742d8f28e998cc5b71e9a

SHA256
d2518e48bcc634ab31bf594c7652d6acb66a71ddd22178f4af049268284d6d38

SHA512
1b98f2ac4a21fff6af9862205acba196b1e75991e9dc17b0993d79b16b8dfea3b5d1b9cf82a4a2a185447b79f56e5e2fafca0519a7b56a74ad7a1108a27b9d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
36dfcf6dced224a8c02c8aa77579eb05

SHA1
1a3babe2a4b8b09e249c49f193d67e219147dbca

SHA256
591e2a38b6166b6ee105b3f71b1ea10cda363cd009112c2efe6f36770afd9f87

SHA512
17e264364c97b50e0659822071cea067da4273d22f1c707023053025ed6c26bd8a2600d96e0c3969268cb5b5e5529bdce84691816481b7e163d2300a9555cf15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
61fd1121c3461fcff981f05380ba59da

SHA1
2e15f30dd44d73f0c3fb41c43ff9b0e3f4433075

SHA256
490b25009f43c07703fde67a55324fc6c0ddf5317557630d221c6b1c16b5157e

SHA512
9798acbc522fffc5295b2546b500eb493d23e0da78705bd7a553d88de5cc244d87a2511b02a2fc6cac108cb77daab256189471b953b0b1aeb4dbf52ac064fded

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
56e3fb6b86eed4f6cfde301038fa951d

SHA1
ec8fef6dd06c6c660542f68bfb85f2ec0bed4bca

SHA256
4fcfe3cc282c5bd1a352f09c60d562dafa87e7b36de965467ff170c4d6e910fc

SHA512
86e843da42072bcc88f70449dd52c8fc6a00f7c4ec7dc38eb85f0a655c8b9e95c881584d6b72cf51b2c1aa0ccd60b0cf6c738a40b21e0b934a25efa2d3d5fd5f

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
e23e7738a77157383b36aac373c94c3d

SHA1
3267e2189c3c333359cfa01fa683c1660020f8e3

SHA256
7792fd4bed6991f5096eefe2c6931e987a660a4739cd88fdcee38b2d4874d034

SHA512
c3eeb483ab01b2bb3614c0294dc8a0324ed82ffd46edd8da4f6e5e522b974c2b0b4da30326e9b614cc32c039a137ea90501278ba8186a96f98e569bc6e4e5b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\CLWCP.exe

Filesize
505KB

MD5
e62ee6f1efc85cb36d62ab779db6e4ec

SHA1
da07ec94cf2cb2b430e15bd0c5084996a47ee649

SHA256
13b4ec59785a1b367efb691a3d5c86eb5aaf1ca0062521c4782e1baac6633f8a

SHA512
8142086979ec1ca9675418e94326a40078400aff8587fc613e17164e034badd828e9615589e6cb8b9339da7cdc9bcb8c48e0890c5f288068f4b86ff659670a69

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\ClutterScreen.exe

Filesize
103KB

MD5
c98352c75dee0ad8e634e195a971fbea

SHA1
aff31d252f032e8dfd5e8b6cb88a5d31ae6e6db7

SHA256
0e169de41a9d076d3841caab3f910abb7502b3b82cbd841f2a520dc5c263270b

SHA512
e74d03171bc68a0dea48ef129d8a7a99423557a3ea5c9de6981fc5863fb9c804578f1e443ea71dc80b510e8e3bc9cbab32a26f723b59b985e4f089c2bf12a73e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\CoronaPopup.exe

Filesize
92KB

MD5
3489f87d693635bfcedfda6d671beec0

SHA1
2778fca0ee805b6635df0bbb5994ee02b0ae548b

SHA256
65e98b5ef9f0682c90b53065849f099f49ba0f9f8db78d459a67186d56125fa3

SHA512
fc4f521b8fd86d8a086a1f39ec5d821042dba3e774e04d23e44838cfeaa2793097189ccae7b645277125fc616744fa746aca02d94b8457ff6397fd9a696695f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\Covid22-Joke.cmd

Filesize
611B

MD5
e340e3afb82818304bdfa325cd4c8569

SHA1
4edd42c1f2e7637ecdbdb7fa19a316f4972bbaed

SHA256
7660c9fe4b1fdb9d838ab71f34365e11be07f5f8e939d57f524f8723085a6a1a

SHA512
c76c9df086c75cbf947ee7e0d458386122e43ea4ee6af324a89363b79486191f1abb021097c46ca8e88d006f21fb46758e05c77039d21d4d76e7f59f8dad01d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\IconSpam.exe

Filesize
105KB

MD5
1bc8017c551d4512355277de7991835f

SHA1
1ad768f8c0d64eac62ef9b18bd0af6643820ed95

SHA256
f1887e9abe277bcbd1370ef55bdf20982de2591443b7c6f78f3cad03776033cd

SHA512
4c05ed7e486728b6279ac49f0b36cd29b401bf21ebc39eb8d4da0ed2b41960f1633d2639e335abae1e6a7cf5efecaff2a622edbad854dc131efdb1ede0a2d6db

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\MouseDraw.exe

Filesize
103KB

MD5
1e8bc7dd872b57b3e925bbfca560b720

SHA1
0595c7126a6ae66f2dc69d4a65095d9e013f4503

SHA256
b39f3a1a536fb4a9fb2bfc95d5b851bd28f6253888c9778d89fdecf77ead661c

SHA512
16a7d33f221db9bfdeb356efc683105608acb873fb891a1c7797d8a1bae3b01657a0615850f178e5806cff02f266e21e63d93634b4d1583ed73a872556c5fe67

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\covid.jpg

Filesize
39KB

MD5
6698ca85bad6bfbfff718517e5670c1f

SHA1
c7975f87fab1b18931fba501cac15c8c85c3b57f

SHA256
5509eee9f17b3a1ea7bb1ccfb5ff2ab82978b17f59c0194ead5042fb671068dc

SHA512
dd2dcbcfbb9ab33e2e83b2181d83bb7684255cbcc7e6efa31580e772bf141a16673cad6d8c50b9b838f5fb7117c32b5effa286c10660fcbd5d950792f2c31f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\inv.exe

Filesize
103KB

MD5
2289a499791fe3dc19993abc322ff074

SHA1
ce978bd8c123ba67eb2e0453522e407220650e2b

SHA256
598887f61f1d5af70c337d4f9f7da5ca0a0d934722dbf76cd6fd95160df02e21

SHA512
add454b286056c7f3c3a92f7a45948a9e18b1ab68fbfef8b858305b940273a8984f681a72f7da0d116dbb6098c0c603440371f09f20dc942e2e2a84cb80655c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F4C.tmp\lole.vbs

Filesize
61B

MD5
2a8eb91004a950bdf368a275a4fdac3d

SHA1
85ebe04691b676abfc3735adb27448277b71ed34

SHA256
df4df97c494510129b00eb00a45bb08e2507271ddda11e12787a1896dcc69eb0

SHA512
65fc15ecd1d2c6d9eacc07f621c8517ffce1745cca953badfa32a47fcf8b45a52934d13fafe20dc19cd10650e22f1719133facc0fa50874e740209576263116a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4CA9.tmp.bat

Filesize
152B

MD5
6bd34f0dc81cdd3f61df79aca6351148

SHA1
66206dcf2da2b7f4480272bc43c6b59f12a1053d

SHA256
58ba6bd3c48180da5a283c98c23f7025c72302a1212cfb2dcc438631a0145afc

SHA512
85004b06cde3af4c686e46c2b68902c606c4831515941b1d68f5503bcc58b5dfb02665d8da2e08e3b4598cca54940f2b6e25043f4ed042256463be1957283301

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
261B

MD5
68069033890e02a8ca23ae9f274b44ef

SHA1
fac56cb4689f78a9e3cf68dfe4c24f1d3405c677

SHA256
815ce104668c226e037bf1b7ab678c4f9863644b7badb30c5a4c63ad729b087f

SHA512
0f35e9f33f79dfe47396a56ce57dcc1bd4abb3e7f83797579a82b09b40b9545e3de42889056a5f5185b96105c534c773b013bb1e2a78c9af1a1f4fec86d24078

Download Submit
C:\Users\Admin\AppData\Roaming\uwudaddy.exe

Filesize
180KB

MD5
db1841bfa15492d1f6a4b46e921068a4

SHA1
9526c45f7a9d59e0a5dda1b57ddbaf8425716e9e

SHA256
176b2fbe38f0d14ee68c65c56e2731646473c0f51e92d3affd2048959fab6bd8

SHA512
22110b41d057696ed5604c84fb40c881024cc8bb045135e258e6f7b0c5baac29d40b7b2b4cb1c4a3391ab2944b43c6b293ec628901abf6447124404111e41b18

Download Submit
C:\Users\Admin\Downloads\Covid22-Joke.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Sigma.zip

Filesize
58KB

MD5
0ba2d3a3cb7185c7111c565e039e9b52

SHA1
9381f3598acdc21136141674fbb7e05c9498dfb8

SHA256
8366f11f3df2673f21db892e6199c38055f7895dcc43f46ec3a03ed4ab94127c

SHA512
25252283281019fb75df4266ed9b9a669f678200856a0369580b4108bbb4cd220d22857f111b56393f49023b864333dd70a2309caa3049b6e9ed6dcf480e1b92

Download Submit
C:\Users\Admin\Downloads\Sigma.zip:Zone.Identifier

Filesize
224B

MD5
b1a28ae22847910d10f1587a4fbcbc0e

SHA1
2e996f8eef4d92aeab3c86978f69c2fb616b659f

SHA256
de5ba4816cc00611f2aca981c1d07f6e9c78644ef225d22002075b62e12ecd78

SHA512
2726070d6eeb821aa14dd5afa69288ab93b12e3e4f5c67a32412df00dde3814b0669ecdddf03d312e7e9d79b86f1eea04230dedc1c72e3d366f27a47d126d0ee

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 120641.crdownload

Filesize
177B

MD5
e20f32fc0db8a384680e0402c19c545c

SHA1
d08216a14a17f534eb5329ecc0ff61e572623f30

SHA256
ffa90a06de053b8078c38ea81566035044880ac9c19464fdb4e3dd4d65da0b84

SHA512
ebd568f00d6c2722b3bb8744614f27a88302ba33cb30c86fa85b27321bb997d9c51923e249b4d541de1b1de2b42a0e1202b51e17613608d19eb4a7ad9df6138d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 592266.crdownload

Filesize
621KB

MD5
da130e858f9bc8b2b2b55946cbe272cf

SHA1
89cf3bcaf0adc366e695b8ddf32165634f8a8241

SHA256
dc59bcf3f7a36a41cc460f3aa3ef60b92e111d0656f7840a34682dc519b890a8

SHA512
b8632a6f57052b2f2cc7000ab7b9be62b5326fabd2bee678735aad11a87c21edcefdd18080e48f831c142328f2417a8b5001ab2e2072ac70b5d83f3f4f90896d

Download Submit
C:\Users\Admin\Downloads\xbox 360 hax 2008.bat:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/104-814-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1216-786-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1216-783-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1996-813-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1996-817-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1996-821-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1996-824-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1996-840-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2504-677-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/2504-812-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/2504-698-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/3536-19-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/3536-17-0x00007FF8AB670000-0x00007FF8AC132000-memory.dmp

Filesize
10.8MB

Download
memory/3536-21-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/3536-20-0x00007FF8AB670000-0x00007FF8AC132000-memory.dmp

Filesize
10.8MB

Download
memory/3536-18-0x000000001B920000-0x000000001B930000-memory.dmp

Filesize
64KB

Download
memory/3836-12-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/3836-1-0x0000000000A10000-0x0000000000A16000-memory.dmp

Filesize
24KB

Download
memory/3836-3-0x000000001AF90000-0x000000001AFA0000-memory.dmp

Filesize
64KB

Download
memory/3836-11-0x00007FF8AB670000-0x00007FF8AC132000-memory.dmp

Filesize
10.8MB

Download
memory/3836-6-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/3836-0-0x00000000002C0000-0x00000000002F6000-memory.dmp

Filesize
216KB

Download
memory/3836-5-0x0000000000A20000-0x0000000000A26000-memory.dmp

Filesize
24KB

Download
memory/3836-4-0x0000000000C40000-0x0000000000C70000-memory.dmp

Filesize
192KB

Download
memory/3836-2-0x00007FF8AB670000-0x00007FF8AC132000-memory.dmp

Filesize
10.8MB

Download
memory/4844-42-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-25-0x00007FF87AEF0000-0x00007FF87AF00000-memory.dmp

Filesize
64KB

Download
memory/4844-37-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-35-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-34-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-33-0x00007FF8785B0000-0x00007FF8785C0000-memory.dmp

Filesize
64KB

Download
memory/4844-40-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-32-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-39-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-31-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-30-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-22-0x00007FF87AEF0000-0x00007FF87AF00000-memory.dmp

Filesize
64KB

Download
memory/4844-29-0x00007FF87AEF0000-0x00007FF87AF00000-memory.dmp

Filesize
64KB

Download
memory/4844-27-0x00007FF87AEF0000-0x00007FF87AF00000-memory.dmp

Filesize
64KB

Download
memory/4844-28-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-23-0x00007FF87AEF0000-0x00007FF87AF00000-memory.dmp

Filesize
64KB

Download
memory/4844-26-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-38-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-24-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-41-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-36-0x00007FF8785B0000-0x00007FF8785C0000-memory.dmp

Filesize
64KB

Download
memory/4844-85-0x00007FF8BA830000-0x00007FF8BA8ED000-memory.dmp

Filesize
756KB

Download
memory/4844-44-0x00007FF8BA830000-0x00007FF8BA8ED000-memory.dmp

Filesize
756KB

Download
memory/4844-43-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-45-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-64-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-65-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-66-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-84-0x00007FF8BAE60000-0x00007FF8BB069000-memory.dmp

Filesize
2.0MB

Download
memory/4844-83-0x00007FF87AEF0000-0x00007FF87AF00000-memory.dmp

Filesize
64KB

Download
memory/4844-80-0x00007FF87AEF0000-0x00007FF87AF00000-memory.dmp

Filesize
64KB

Download
memory/4844-81-0x00007FF87AEF0000-0x00007FF87AF00000-memory.dmp

Filesize
64KB

Download
memory/4844-82-0x00007FF87AEF0000-0x00007FF87AF00000-memory.dmp

Filesize
64KB

Download
memory/4912-815-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5068-816-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download