netsupport | hxxps://138[.]124[.]180[.]85/

Analysis

max time kernel
221s
max time network
297s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-04-2024 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://138.124.180.85/

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Blocklisted process makes network request 2 IoCs

flow	pid	Process
76	1492	powershell.exe
86	3844	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1456	client32.exe

Loads dropped DLL 6 IoCs

pid	Process
1456	client32.exe
1456	client32.exe
1456	client32.exe
1456	client32.exe
1456	client32.exe
1456	client32.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.ipify.org
18	api.ipify.org
23	api.ipify.org

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000005ce8c7a9ae559bd5ae1924c3a1a9b09ae465061a22edc2965b2344cab11ccc24a45c811fd5182a143070c63c53ab2d65e584f72da640a8ce5160	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\AskToCloseAllTabs = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = de9a60a51697da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "420855733"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ef1f8cab1697da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{1E91F95E-9016-4CE9-97FC-ABF9878AA8FC} = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9b252fab1697da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\AdvancedIPScanner.zip.wf5juci.partial:Zone.Identifier	browser_broker.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2944	notepad.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
752	powershell.exe
752	powershell.exe
752	powershell.exe
824	powershell.exe
824	powershell.exe
824	powershell.exe
1492	powershell.exe
1492	powershell.exe
1492	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2972	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2972	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2972	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4844	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4844	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3764	MicrosoftEdge.exe
Token: SeDebugPrivilege	3764	MicrosoftEdge.exe
Token: SeRestorePrivilege	3832	7zG.exe
Token: 35	3832	7zG.exe
Token: SeSecurityPrivilege	3832	7zG.exe
Token: SeSecurityPrivilege	3832	7zG.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeIncreaseQuotaPrivilege	1492	powershell.exe
Token: SeSecurityPrivilege	1492	powershell.exe
Token: SeTakeOwnershipPrivilege	1492	powershell.exe
Token: SeLoadDriverPrivilege	1492	powershell.exe
Token: SeSystemProfilePrivilege	1492	powershell.exe
Token: SeSystemtimePrivilege	1492	powershell.exe
Token: SeProfSingleProcessPrivilege	1492	powershell.exe
Token: SeIncBasePriorityPrivilege	1492	powershell.exe
Token: SeCreatePagefilePrivilege	1492	powershell.exe
Token: SeBackupPrivilege	1492	powershell.exe
Token: SeRestorePrivilege	1492	powershell.exe
Token: SeShutdownPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeSystemEnvironmentPrivilege	1492	powershell.exe
Token: SeRemoteShutdownPrivilege	1492	powershell.exe
Token: SeUndockPrivilege	1492	powershell.exe
Token: SeManageVolumePrivilege	1492	powershell.exe
Token: 33	1492	powershell.exe
Token: 34	1492	powershell.exe
Token: 35	1492	powershell.exe
Token: 36	1492	powershell.exe
Token: SeIncreaseQuotaPrivilege	1492	powershell.exe
Token: SeSecurityPrivilege	1492	powershell.exe
Token: SeTakeOwnershipPrivilege	1492	powershell.exe
Token: SeLoadDriverPrivilege	1492	powershell.exe
Token: SeSystemProfilePrivilege	1492	powershell.exe
Token: SeSystemtimePrivilege	1492	powershell.exe
Token: SeProfSingleProcessPrivilege	1492	powershell.exe
Token: SeIncBasePriorityPrivilege	1492	powershell.exe
Token: SeCreatePagefilePrivilege	1492	powershell.exe
Token: SeBackupPrivilege	1492	powershell.exe
Token: SeRestorePrivilege	1492	powershell.exe
Token: SeShutdownPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeSystemEnvironmentPrivilege	1492	powershell.exe
Token: SeRemoteShutdownPrivilege	1492	powershell.exe
Token: SeUndockPrivilege	1492	powershell.exe
Token: SeManageVolumePrivilege	1492	powershell.exe
Token: 33	1492	powershell.exe
Token: 34	1492	powershell.exe
Token: 35	1492	powershell.exe
Token: 36	1492	powershell.exe
Token: SeSecurityPrivilege	1456	client32.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3832	7zG.exe
1456	client32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3764	MicrosoftEdge.exe
1292	MicrosoftEdgeCP.exe
2972	MicrosoftEdgeCP.exe
1292	MicrosoftEdgeCP.exe
4656	OpenWith.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 4824	1292	MicrosoftEdgeCP.exe	77
PID 1292 wrote to memory of 4824	1292	MicrosoftEdgeCP.exe	77
PID 1292 wrote to memory of 4824	1292	MicrosoftEdgeCP.exe	77
PID 1292 wrote to memory of 4824	1292	MicrosoftEdgeCP.exe	77
PID 1292 wrote to memory of 4824	1292	MicrosoftEdgeCP.exe	77
PID 1292 wrote to memory of 4824	1292	MicrosoftEdgeCP.exe	77
PID 1292 wrote to memory of 4824	1292	MicrosoftEdgeCP.exe	77
PID 1292 wrote to memory of 4824	1292	MicrosoftEdgeCP.exe	77
PID 1292 wrote to memory of 4824	1292	MicrosoftEdgeCP.exe	77
PID 1292 wrote to memory of 4824	1292	MicrosoftEdgeCP.exe	77
PID 824 wrote to memory of 1492	824	powershell.exe	93
PID 824 wrote to memory of 1492	824	powershell.exe	93
PID 1492 wrote to memory of 1456	1492	powershell.exe	96
PID 1492 wrote to memory of 1456	1492	powershell.exe	96
PID 1492 wrote to memory of 1456	1492	powershell.exe	96
PID 3380 wrote to memory of 3844	3380	powershell.exe	99
PID 3380 wrote to memory of 3844	3380	powershell.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://138.124.180.85/"
1⤵
PID:1608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3764

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- NTFS ADS
PID:240

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2972

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4824

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2736

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4656

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\AdvancedIPScanne\" -spe -an -ai#7zMap18571:92:7zEvent26297
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3832

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\AdvancedIPScanne\StartingScriptWrapper.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:2944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Desktop\AdvancedIPScanne\StartingScriptWrapper.ps1'"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Desktop\AdvancedIPScanne\yxAEqSbV.ps1'"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\ProgramData\netsupport\client\client32.exe
    "C:\ProgramData\netsupport\client\client32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Desktop\AdvancedIPScanne\yxAEqSbV.ps1'"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\netsupport\client\HTCTL32.DLL

Filesize
320KB

MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
C:\ProgramData\netsupport\client\NSM.LIC

Filesize
259B

MD5
1dc87146379e5e3f85fd23b25889ae2a

SHA1
b750c56c757ad430c9421803649acf9acd15a860

SHA256
f7d80e323e7d0ed1e3ddd9b5df08af23dcecb47a3e289314134d4b76b3adcaf2

SHA512
7861abe50eefdf4452e4baacc4b788895610196b387b70ddeab7bc70735391ed0a015f47eada94a368b82f8e5cedb5a2096e624f4a881ff067937ad159e3562c

Download Submit
C:\ProgramData\netsupport\client\PCICL32.dll

Filesize
3.5MB

MD5
ad51946b1659ed61b76ff4e599e36683

SHA1
dfe2439424886e8acf9fa3ffde6caaf7bfdd583e

SHA256
07a191254362664b3993479a277199f7ea5ee723b6c25803914eedb50250acf4

SHA512
6c30e7793f69508f6d9aa6edcec6930ba361628ef597e32c218e15d80586f5a86d89fcbee63a35eab7b1e0ae26277512f4c1a03df7912f9b7ff9a9a858cf3962

Download Submit
C:\ProgramData\netsupport\client\client32.exe

Filesize
54KB

MD5
9497aece91e1ccc495ca26ae284600b9

SHA1
a005d8ce0c1ea8901c1b4ea86c40f4925bd2c6da

SHA256
1b63f83f06dbd9125a6983a36e0dbd64026bb4f535e97c5df67c1563d91eff89

SHA512
4c892e5029a707bcf73b85ac110d8078cb273632b68637e9b296a7474ab0202320ff24cf6206de04af08abf087654b0d80cbecfae824c06616c47ce93f0929c9

Download Submit
C:\ProgramData\netsupport\client\client32.ini

Filesize
631B

MD5
adffa0c2fedb1506087178c51efbd377

SHA1
a3218fa2fbefaa5447b970481a575fcdea0bd2f7

SHA256
6b115c0c710bb0dfb234d297b0e8a862d8aff972ce9915b3fdfbc4d12a698d6f

SHA512
2284360ed332d66856c8a78698d1a4ad4d9919f3d1e08e5c6a648391c529ebef66b1af081ec88efbe9bcd68375b2243d76bf5532cda5f831642fef4b1ca57f07

Download Submit
C:\ProgramData\netsupport\client\pcicapi.dll

Filesize
32KB

MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
2b4dd12d002c7a7f82b8250e398b6449

SHA1
9dbc9e208d624c3f4dd44bd76ea0a220a89b6026

SHA256
424d4861bc6f0abedd40555d9b61ad41ffa87f621b70d3532307a8037fd454e9

SHA512
e338f0fd296d5cfaf4b89f37bc228c1b01d18906b80d78164f15c343e404873d4715de34ac43865bdde6e3a590a8a77fa928e433f9eedd94ec6f418a17ab80d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B4U56X23\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
2KB

MD5
fd3e9daaded37ee5cf8f0c5e960e6dca

SHA1
1ef346342dfbfc2aa3411f28b891e2a119a6c00f

SHA256
2565a36ae81b7f472ea9512be287e4e3e906428c976a337aaa334af5794a1307

SHA512
7011ac9a209ae81e4407b474096b073abc4f0c76738648500670b9d9c611ad82c71fdd6911ddb8b0d85b1a60f84d98bff49396e077d286a516cf454adbbae0be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4af0024de532f482c68488499e950979

SHA1
6954f2ffa8424a355067ca462d5ada04de1df0e0

SHA256
3ff1996474c48804ce0e1f5e611d7071e170bdc94d57a979ccc74058866c8012

SHA512
cbc69053b2dc2a028a56f9e057af1cd221a27d8dcaa0b92627842bab1b2e7961ecb2f8b8ed0f90cea3c0af619657976ff5d72e6ccf6313b510f101a63ae1d5ba

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\9UJK9646\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF31C79F3F3B756CAB.TMP

Filesize
24KB

MD5
d3cdb7663712ddb6ef5056c72fe69e86

SHA1
f08bf69934fb2b9ca0aba287c96abe145a69366c

SHA256
3e8c2095986b262ac8fccfabda2d021fc0d3504275e83cffe1f0a333f9efbe15

SHA512
c0acd65db7098a55dae0730eb1dcd8aa94e95a71f39dd40b087be0b06afc5d1bb310f555781853b5a78a8803dba0fb44df44bd2bb14baeca29c7c7410dffc812

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\VPH5IKN1\AdvancedIPScanner[1].zip

Filesize
31KB

MD5
32322845be8e7d86f275b97827ff4ce6

SHA1
7954f11381d55eb4d7bb31c1287f81e6c61c7f6f

SHA256
e0195d2822ba2ac979cadda2f8c2ce4330cc8b0d2c66765788c87132182bcc61

SHA512
99dbcab2bb55a7457c7d5597ea60756267dc23b4ea0b4b44f69e1bf7c68885df33a9b040bce074a139913d06086bb506e917859863246de63880c9f506c74bb4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\383E29B8BA38488CDB75F6414C75867C

Filesize
503B

MD5
b52345beb66692e4ecab9892f1d3fb77

SHA1
0870223a68fad068af1af57618ca6b708232e7ae

SHA256
ec873f96ee84270945289b08fb6033e3e56da9725a60e7ff96205c6bc2d2e081

SHA512
2fcd71491c195aa40e01f3db46424bc6228cd037457f92e227782f91e3a3c12625afe778327c9638212a6748e7a33dcbff0265556ef4503890560b0c6595a25c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
1da1471bc0ed5051e25458560c3019d0

SHA1
bf856580fefbe3837845f5d359c2224dacfa7d22

SHA256
a0cba9a1e5b7468ea93d7bfc341b443a716185fdaa922f291fc00878ad5bc442

SHA512
37356e573baa3e3eaa2b2095f466a0389a9aaa3c08fc8e7223418ae13b9552ff426376003083957399910f8963ba3ad87ca7bed74543c7d53259c31f22e7665e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\383E29B8BA38488CDB75F6414C75867C

Filesize
552B

MD5
c993c01b60c5d04abb3ea6b13165c89e

SHA1
d8f31a33e189065d57a10dcd233a3df751f9b114

SHA256
135da40b56704f33d33e9e988d3d821302f900cb9ee386db4bcc4ef7b34e207a

SHA512
c551ecf08abe7cca92fc451eb96ee7fad10d36895afc040eeb8955f6d95f112361da6c682c2418b3fcf6a67c1fe9496cd3d2148edcce64ab4e64dc4c6c4183df

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g0hgljlo.khj.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
18bd0a2b0ff5b87cac6cdec6cb34d6d4

SHA1
84ff3d31b940e3078a800f8905751c2905880179

SHA256
a0cd058a882910850164d805a2a2c15de46b2742706f6e129f963916c6362fa4

SHA512
6df874cb36b3283cd1038bf3c85bbf247b00ac0fb29937c076fb7dad07597488e4be079606d9de6d747f0f20cadf323deceda1e87993e25b57fe1f52b4d9b90a

Download Submit
C:\Users\Admin\Desktop\AdvancedIPScanne\StartingScriptWrapper.ps1

Filesize
14KB

MD5
da5bf3010154020db9db4cf8832b42ea

SHA1
15ba3dc3bbcb16a26839862d79b3519e74a5e03a

SHA256
7778c658411a2f1649ced14cdfe8a92145c1c7fa53b1ce5b14920000fe99bd98

SHA512
d70c6df571a069797f5eb1ac9a3e30293914b8f1378714e97ae0b881ee5a833f0944ee7246e2768ed74747637deade85306e837a25b1757a1bc3abb7d6eaa9e2

Download Submit
C:\Users\Admin\Desktop\AdvancedIPScanne\yxAEqSbV.ps1

Filesize
5KB

MD5
6cc7d2135dbe7c41c59e58cb3d19b342

SHA1
9723dcc9509566d742034d57e28e6f562514f520

SHA256
9c5a2f3a82a50c726e7dfacf8b046ad6602ecf194203c567cf560e352b94d2d9

SHA512
fcad8717e149a6c09de16f484c671ce4c8ebc0a0941b911448816f9fc3603bedc7ed08a607f96fbe39561381bdda2da7cd56211005a0ef397ff6cf333e9572b2

Download Submit
C:\Users\Admin\Downloads\AdvancedIPScanner.zip.wf5juci.partial

Filesize
25.6MB

MD5
c79834aec56238560ad7f9fb7e96bc85

SHA1
ece7856c45f9fb7f3e90713cb66daad77e1aecda

SHA256
5146ad24aba859794d182b66cc6ce8e3544f2e36d64bb682d7cf1ee1a78a90f2

SHA512
c59d858f585410ddcd6dfaf430ad94254ba05ecbf6f138ab0d80db2d0851384b4d28232989586493da1a72d51130acbca440c53c0d113b48974221dfb145b8b0

Download Submit
\ProgramData\netsupport\client\PCICHEK.DLL

Filesize
18KB

MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
\ProgramData\netsupport\client\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
memory/752-626-0x0000027C490F0000-0x0000027C49112000-memory.dmp

Filesize
136KB

Download
memory/752-628-0x0000027C48EE0000-0x0000027C48EF0000-memory.dmp

Filesize
64KB

Download
memory/752-627-0x00007FF831AA0000-0x00007FF83248C000-memory.dmp

Filesize
9.9MB

Download
memory/752-631-0x0000027C613F0000-0x0000027C61466000-memory.dmp

Filesize
472KB

Download
memory/752-718-0x00007FF831AA0000-0x00007FF83248C000-memory.dmp

Filesize
9.9MB

Download
memory/824-673-0x0000023DE3410000-0x0000023DE3420000-memory.dmp

Filesize
64KB

Download
memory/824-698-0x0000023DFBD90000-0x0000023DFBF06000-memory.dmp

Filesize
1.5MB

Download
memory/824-1031-0x00007FF831AA0000-0x00007FF83248C000-memory.dmp

Filesize
9.9MB

Download
memory/824-674-0x0000023DE3410000-0x0000023DE3420000-memory.dmp

Filesize
64KB

Download
memory/824-669-0x00007FF831AA0000-0x00007FF83248C000-memory.dmp

Filesize
9.9MB

Download
memory/824-699-0x0000023DFC120000-0x0000023DFC328000-memory.dmp

Filesize
2.0MB

Download
memory/824-697-0x0000023DE3410000-0x0000023DE3420000-memory.dmp

Filesize
64KB

Download
memory/1492-959-0x0000025EBCC30000-0x0000025EBCC42000-memory.dmp

Filesize
72KB

Download
memory/1492-972-0x0000025EBCC20000-0x0000025EBCC2A000-memory.dmp

Filesize
40KB

Download
memory/1492-716-0x00007FF831AA0000-0x00007FF83248C000-memory.dmp

Filesize
9.9MB

Download
memory/1492-717-0x0000025EBC460000-0x0000025EBC470000-memory.dmp

Filesize
64KB

Download
memory/1492-1021-0x00007FF831AA0000-0x00007FF83248C000-memory.dmp

Filesize
9.9MB

Download
memory/1492-719-0x0000025EBC460000-0x0000025EBC470000-memory.dmp

Filesize
64KB

Download
memory/1492-914-0x0000025EBCC40000-0x0000025EBCC6A000-memory.dmp

Filesize
168KB

Download
memory/1492-933-0x0000025EBCC40000-0x0000025EBCC62000-memory.dmp

Filesize
136KB

Download
memory/1492-942-0x0000025EBC460000-0x0000025EBC470000-memory.dmp

Filesize
64KB

Download
memory/3380-1067-0x00000166D6B80000-0x00000166D6B90000-memory.dmp

Filesize
64KB

Download
memory/3380-1097-0x00007FF831CF0000-0x00007FF8326DC000-memory.dmp

Filesize
9.9MB

Download
memory/3380-1045-0x00000166D6B80000-0x00000166D6B90000-memory.dmp

Filesize
64KB

Download
memory/3380-1137-0x00000166D6B80000-0x00000166D6B90000-memory.dmp

Filesize
64KB

Download
memory/3380-1042-0x00007FF831CF0000-0x00007FF8326DC000-memory.dmp

Filesize
9.9MB

Download
memory/3380-1138-0x00007FF831CF0000-0x00007FF8326DC000-memory.dmp

Filesize
9.9MB

Download
memory/3764-159-0x0000024CF9BD0000-0x0000024CF9BD1000-memory.dmp

Filesize
4KB

Download
memory/3764-160-0x0000024CF9BE0000-0x0000024CF9BE1000-memory.dmp

Filesize
4KB

Download
memory/3764-0-0x0000024CF1420000-0x0000024CF1430000-memory.dmp

Filesize
64KB

Download
memory/3764-203-0x0000024CF19A0000-0x0000024CF19A2000-memory.dmp

Filesize
8KB

Download
memory/3764-206-0x0000024CF1910000-0x0000024CF1911000-memory.dmp

Filesize
4KB

Download
memory/3764-210-0x0000024CF05F0000-0x0000024CF05F1000-memory.dmp

Filesize
4KB

Download
memory/3764-35-0x0000024CF15E0000-0x0000024CF15E2000-memory.dmp

Filesize
8KB

Download
memory/3764-16-0x0000024CF1800000-0x0000024CF1810000-memory.dmp

Filesize
64KB

Download
memory/3844-1086-0x000001C112CD0000-0x000001C112CE0000-memory.dmp

Filesize
64KB

Download
memory/3844-1083-0x00007FF831CF0000-0x00007FF8326DC000-memory.dmp

Filesize
9.9MB

Download
memory/3844-1085-0x000001C112CD0000-0x000001C112CE0000-memory.dmp

Filesize
64KB

Download
memory/3844-1134-0x00007FF831CF0000-0x00007FF8326DC000-memory.dmp

Filesize
9.9MB

Download
memory/4824-73-0x000002BD5F4D0000-0x000002BD5F4D2000-memory.dmp

Filesize
8KB

Download
memory/4824-71-0x000002BD5F4B0000-0x000002BD5F4B2000-memory.dmp

Filesize
8KB

Download
memory/4824-69-0x000002BD5F2F0000-0x000002BD5F2F2000-memory.dmp

Filesize
8KB

Download
memory/4824-63-0x000002BD5F290000-0x000002BD5F292000-memory.dmp

Filesize
8KB

Download
memory/4824-65-0x000002BD5F2B0000-0x000002BD5F2B2000-memory.dmp

Filesize
8KB

Download
memory/4824-67-0x000002BD5F2D0000-0x000002BD5F2D2000-memory.dmp

Filesize
8KB

Download