Resubmissions
21-09-2024 16:31
240921-t1qvhasdmk 612-08-2024 10:22
240812-mebp5awhkn 625-07-2024 11:21
240725-nge11ayeqg 713-07-2024 10:18
240713-mcdfyaxajp 911-07-2024 20:03
240711-ysrjaa1hnj 708-06-2024 18:41
240608-xb31baee6w 325-05-2024 19:34
240525-yaastaff2v 823-05-2024 17:58
240523-wj9mdsbb2y 9Analysis
-
max time kernel
1166s -
max time network
1168s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:17
Static task
static1
General
-
Target
AutoIt-Extractor-net40-x64.exe
-
Size
1.2MB
-
MD5
205792ce0da5273baffa6aa5b87d3a88
-
SHA1
50439afe5c2bd328f68206d06d6c31190b3946c6
-
SHA256
d82d49e9ad153ef84670c1d0bde5f36b540d32fa037cca6127ce9e4e366b7403
-
SHA512
186f2fac650ee02683c689b0c04867a30330a5475475b106a2aaaedc5e2fa3c9325cf07a2c5321044f5aed1502d729d1d9537ac57bf7733cc228c44ceaba7821
-
SSDEEP
24576:pcdWeAKpCklFpaQ3vGvW68WxOFxT6YP7KPU48YNL8SsbJDeAKpCZG:QFAcdFpa068WxOFxT6YP7KPU48YNVsbu
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
taskhost_c0ee72427b96da2279623bb76c850762.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ taskhost_c0ee72427b96da2279623bb76c850762.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
taskhost_c0ee72427b96da2279623bb76c850762.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion taskhost_c0ee72427b96da2279623bb76c850762.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion taskhost_c0ee72427b96da2279623bb76c850762.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AutoIt-Extractor-net40-x64.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation AutoIt-Extractor-net40-x64.exe -
Executes dropped EXE 2 IoCs
Processes:
taskhost_c0ee72427b96da2279623bb76c850762.exeaut57196.exepid process 2360 taskhost_c0ee72427b96da2279623bb76c850762.exe 4716 aut57196.exe -
Loads dropped DLL 26 IoCs
Processes:
unlicense.exetaskhost_c0ee72427b96da2279623bb76c850762.exepid process 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2568 unlicense.exe 2360 taskhost_c0ee72427b96da2279623bb76c850762.exe -
Processes:
resource yara_rule C:\Users\Admin\Downloads\Unconfirmed 477267.crdownload themida behavioral1/memory/2360-738-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp themida behavioral1/memory/2360-739-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp themida behavioral1/memory/2360-740-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp themida behavioral1/memory/2360-742-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp themida behavioral1/memory/2360-741-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp themida behavioral1/memory/2360-745-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp themida behavioral1/memory/2360-744-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp themida behavioral1/memory/2360-743-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp themida behavioral1/memory/2360-884-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\tmp70avqzqo\unlicense.tmp2 themida C:\Users\Admin\AppData\Local\Temp\tmp20es5b1y\unlicense.tmp themida behavioral1/memory/2360-1232-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp themida -
Processes:
taskhost_c0ee72427b96da2279623bb76c850762.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost_c0ee72427b96da2279623bb76c850762.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 137 camo.githubusercontent.com 132 raw.githubusercontent.com 133 camo.githubusercontent.com 135 raw.githubusercontent.com 136 camo.githubusercontent.com -
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2360-740-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp autoit_exe behavioral1/memory/2360-742-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp autoit_exe behavioral1/memory/2360-741-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp autoit_exe behavioral1/memory/2360-745-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp autoit_exe behavioral1/memory/2360-744-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp autoit_exe behavioral1/memory/2360-743-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp autoit_exe behavioral1/memory/2360-884-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp autoit_exe C:\Users\Admin\AppData\Local\Temp\tmp70avqzqo\unlicense.tmp2 autoit_exe C:\Users\Admin\AppData\Local\Temp\tmp20es5b1y\unlicense.tmp autoit_exe behavioral1/memory/2360-1232-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
taskhost_c0ee72427b96da2279623bb76c850762.exepid process 2360 taskhost_c0ee72427b96da2279623bb76c850762.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 64 IoCs
Processes:
AutoIt-Extractor-net40-x64.exemsedge.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU msedge.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9 msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents" AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3" AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193" msedge.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\0\0\NodeSlot = "8" AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000c348773bd697da01fe99ed4d8facda01fe99ed4d8facda0114000000 AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\0 = 78003100000000009a5871641100557365727300640009000400efbe874f7748b6583cab2e000000c70500000000010000000000000000003a00000000005f472b0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 AutoIt-Extractor-net40-x64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff msedge.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\NodeSlot = "6" AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff msedge.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 msedge.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" msedge.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" AutoIt-Extractor-net40-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" AutoIt-Extractor-net40-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202 AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff AutoIt-Extractor-net40-x64.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg AutoIt-Extractor-net40-x64.exe -
NTFS ADS 1 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 477267.crdownload:SmartScreen msedge.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2728 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exeunlicense.exemsedge.exepid process 956 msedge.exe 956 msedge.exe 2776 msedge.exe 2776 msedge.exe 4424 identity_helper.exe 4424 identity_helper.exe 2984 msedge.exe 2984 msedge.exe 1852 msedge.exe 1852 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 3116 msedge.exe 3116 msedge.exe 2568 unlicense.exe 2568 unlicense.exe 2440 msedge.exe 2440 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
AutoIt-Extractor-net40-x64.exemsedge.exepid process 3052 AutoIt-Extractor-net40-x64.exe 2440 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs
Processes:
msedge.exepid process 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
unlicense.exedescription pid process Token: SeDebugPrivilege 2568 unlicense.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exepid process 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe -
Suspicious use of SendNotifyMessage 34 IoCs
Processes:
msedge.exeAutoIt-Extractor-net40-x64.exepid process 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 3052 AutoIt-Extractor-net40-x64.exe 3052 AutoIt-Extractor-net40-x64.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe 2776 msedge.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
AutoIt-Extractor-net40-x64.exeaut57196.exemsedge.exepid process 3052 AutoIt-Extractor-net40-x64.exe 3052 AutoIt-Extractor-net40-x64.exe 4716 aut57196.exe 3052 AutoIt-Extractor-net40-x64.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2776 wrote to memory of 5092 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 5092 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 4876 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 956 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 956 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe PID 2776 wrote to memory of 904 2776 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoIt-Extractor-net40-x64.exe"C:\Users\Admin\AppData\Local\Temp\AutoIt-Extractor-net40-x64.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\aut57196.exe"C:\Users\Admin\AppData\Local\Temp\aut57196.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4716
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd991746f8,0x7ffd99174708,0x7ffd991747182⤵PID:5092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:4876
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:956 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:4584
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:12⤵PID:3836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:12⤵PID:728
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵PID:2316
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3596 /prefetch:82⤵PID:4080
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3596 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4424 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:12⤵PID:2028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:4340
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵PID:2520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:12⤵PID:2516
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:4140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:12⤵PID:4548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:3948
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:12⤵PID:4972
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:12⤵PID:4884
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6064 /prefetch:82⤵PID:3404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5648 /prefetch:82⤵PID:1500
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:12⤵PID:3104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:12⤵PID:3452
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:12⤵PID:1808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5796 /prefetch:82⤵PID:3664
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:12⤵PID:644
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:12⤵PID:1072
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:12⤵PID:1652
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:3260
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1852 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6356 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3116 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:12⤵PID:3152
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:12⤵PID:2972
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:12⤵PID:3156
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:2360
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:12⤵PID:1272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1868 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:12⤵PID:4512
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:12⤵PID:1600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7028786984603023880,6700795322836925376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:12⤵PID:3272
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4484
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4420
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2500
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:4396
-
C:\Users\Admin\Desktop\unlicense.exeC:\Users\Admin\Desktop\unlicense.exe C:\Users\Admin\Desktop\taskhost_c0ee72427b96da2279623bb76c850762.exe2⤵PID:4324
-
C:\Users\Admin\Desktop\unlicense.exeC:\Users\Admin\Desktop\unlicense.exe C:\Users\Admin\Desktop\taskhost_c0ee72427b96da2279623bb76c850762.exe3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵PID:4924
-
C:\Users\Admin\Desktop\taskhost_c0ee72427b96da2279623bb76c850762.exe"C:\Users\Admin\Desktop\taskhost_c0ee72427b96da2279623bb76c850762.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2360
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\johnv4.txt1⤵
- Opens file in notepad (likely ransom note)
PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001Filesize
36KB
MD56e0dfe11e95944da94e70a99c169c81e
SHA1f8cd534a059869e65a5e800ed4ff693539c7bd65
SHA25672863be7491063b6198044605fae19e03c2bf5ca0f3282dcba49e0adff86b900
SHA512f51ddb326f3fd0b898f29b0759b0f40d1490af0e374b50a323523ddbbb8336c08e832992274a45610bc09361f2883f8f95c67c29d5a9bc7b4a77d18e100913d4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-indexFilesize
4KB
MD5865b74c9e023d26edd7b1104b2e45c6a
SHA1a1dec0ff972d8b9ef7671581dad95564f18b5ff0
SHA25664f96f4d54ba1b858e223921085ee40af049a9de03395fc6c2054287465204ea
SHA5129f66c556ab4c3cd5c4d998b534255578723b266977695bf3a80fa4de80beecf2b31a48bfaaea34235a8af5748a2d1d63a4ddd01dc1247a9d1b03e87315942a82
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
4KB
MD5e1db734ee78138576c1a7c4424c6fdcd
SHA18ec93c3bc8ac670c38074c7c3a182987464b8a0f
SHA256d50b611c645f890af57f3b9179c077688be751310ff06cb5c5cfef12e471fc40
SHA51223511076d9adc267c4938a034b705f474b37eae3f04e53390bfd9a46de57faf7ea44ce23cd808553102b51ed56c0a009cc8825a60143624846ce0bbeebb503fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
288B
MD56d662f23dd111323ce74a87ebb7d91dc
SHA195a8509e23f839b017e9a85fab73016371dafed1
SHA256d1fb93368766744af5cec1826b58c64b46ab6c9a6d0b5cdf94687c70031fdea1
SHA512da9ebabf33919c54bc1dc2050677de2d0d45542318b77fd18b13d6fe404fefd8f9190839f7c6caa14921dac7157a8c62aaddc31a1f4b572d592e8fd76e1cb176
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD592a428959145000f99a01be2b7760fcc
SHA1277dc2478cc28db40536ed2eaf26ab2316201e76
SHA25636cbf6d07785c6ee377f3c851c1a84dd17a5e0f2bda88258855baecf8912283e
SHA512e18082a49eb94ef67c1dfb5b48fcb5e9fe1d79c3242a9fe60da74ed0c52e8c3d5062d59eaa95606bac254c431600cd1d7185d913c63c75f4628ca69534174679
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD531d91e1ebe034117c6ac25c5272e9d32
SHA1ab75874e0a3e7f1a003e08fa4f78a93e11b93364
SHA2569207bafe26143c3d0c46cffdf5409e08220d9a72cf731d0339325768540207e2
SHA512dc914a8876b96979079cf5b97abd2dc451f4d7070d487b22c10b7519e3343cbfe71daad41d4b03c2c5b4ac1a04b4de53a99679961d5ceabf5b5752b3ccd64f2c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD573864b5a0672d3b60ad8bce1a222b4f3
SHA14edebef4c557f4e61efefdf646420ba14b1c9476
SHA2562b0b3bc002991827a8b10ab670b2da30b980cc6a88be756b87f63697c7aa9a2d
SHA512b6723140c29e9b16c7b0a0762b85f053e4bb86ac5d9e618ff8acfda98c98566f81b9ba2bd119c550abc2a6635787b95fafdc8897a6a0b06dcaa842a30318666b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD505ef6f9d230141ab2e9e3db27b544f66
SHA18a2e4b3dd1abab768cfb1ec275261502325cd4e4
SHA256085b4ebc261b400c92ea3d7d15918a5c5f394055d5810cbbaf01fbc1bab04dd9
SHA51275ff5fb1007d3a6a549461e6551da9c5c72f0603cc66548f9eb8fb77fc2d33dbcc859e46339d239ed4ed99ceaf26ceda2ff70bad5bac717e02101fb54dc66f23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD529179437afb68deab881fbe8b0fcf8c5
SHA1aec30c54fd7b595d25f123044111e5ad936357cb
SHA25699da512546b69d4d2c13bde21040fdc3ae3104a6add74db079f80284e82a2d8a
SHA512cd59c10d080ce07d7f80d9e0c3662befe50a903a6356d464a43a962a62439e0c2243f6b326015e7d3d084e38373f29fbb0e40c58a8288d3f23db7d2640eeab45
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD50328eab106bedc94ecef60b0fd95941f
SHA13945fe4b79ec03a56dc38fda87d5dd10c8809285
SHA256a58662b4fbda98358a7034bd88fff3bc6030f7df24b42e2b6e4aa9266d25ebd2
SHA512c90e711946d8ba1c140d8a9c1fe8d5d86f541bc92103ebac5842f94cc1e4727353c64fa0ec1ba61d3dace791cddecc9de201d8320de3df241533317f45e4d2b8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5004f833f38d8f480ef3bb5a5fd0ef54a
SHA117ba23847795451d38f8b76693545a0f9367c290
SHA256fde27266668d82ecc22067d81f591a6e5c56469a6acd0ceeb8884a28498efe7a
SHA51204df6ad1cbde22f6fcd14386dfc0967d9dae30bbf55128a35792b50182450d8652b851dc13cc2d958de61acce6d3dbe960e6d13c273c1ef0e4843a17c1f65996
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD52e9a33e1c855ab96eb0ada490681ece0
SHA177a04fb50cf62e57c8c3b1177355a437ae456a33
SHA256f596edf1d423b8a31979fbc45ab74bd87e8247dbffd9005ad1c2aafc79e4efeb
SHA512aef5f82f9c526fe5f128388de3e0b787d80105cbc4200d6daacc70b8231e1d09fc92b2c1918edea43e0a924b10a669324f4cbe322982f04952b5ad5fd84b7c08
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5056029e252271702bd3c64150c962930
SHA141f167ec4bdeec549297e092fdff211a4493c38f
SHA256320e4a4c83e3f482cf133abe7ca50ec27ace4772b8102bbd27736c046b39add6
SHA512a4c72211a6ead21e12b79091dcb3f354974336e152f4b73515555a08bdb01947c02545ecbc88f1e6620b3f3774eb5151c73167ab103cccfd28c71bdfb6c82496
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD527c2f72ac898fbf461280ee3a914674c
SHA1e0d9ad5144cefef3de459deb1d7b4730de8d7959
SHA2567ebb5aace395f44bf56813ba1e5a73235bdedd36df7162ffc403e2b6c2afcbea
SHA512284918516f5ecd311eafb9432beda5bae8f4e33734c54daedc8b9fd1bed805547c119987f6abc0417fd2485afe637df089893e29347a4f3c46e3829273da2e2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD58fbb62de1bdcba4751d96d8db98cd30f
SHA162e4712b2a01eefa054e8301cb8a688e3a09d551
SHA2568464731a13fcf2abd9e1a3f818c10c8e2842cf4e3676fce50b7dbffa50504407
SHA51209e1b2f5f88a77b8f8f96bc514d0d5f77f6c2edcff10896dc28acadec64bd9d9035431731ca47e4d868d9ac28d348749eb375a5f61f83b04134c141ce6e44035
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5945b33a6ea8e4c3faf58c5d60ad8de59
SHA17000c072c6d35af39585b47a5007d8d03d6d1efd
SHA2567eb3107209a345d41c971b7ec8b6d3219d17ae464060219c9367903c9d95c9f0
SHA5126155a57cd62f2249838cf8ca1cb3b755b1413e2fa7ad8f808a64907ada3cc7bd85617c76c7b3ae29fd43b454de1cfc57ce13de3c4d1d0117bbc756aeb90a75b4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
370B
MD59f582f101d03678b03a28b861929bd3d
SHA134cb0d5ed578298158277611bdc1a0cd82018155
SHA2567ece46b8720e04d3ac8af6c961a8cc79ce17181a7d65351e4dd064d025d8f57e
SHA512e185c0a400fccef18499616fe40ff5507cf7a11d31feee710fef6834d246ba2030c53531e3c8efb52f5b3166c080200ec3be2630f6d886ac9a71cc14f06441da
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5d0754349e47ef3152a9d58614a8e7b05
SHA1406c3fcf0b244d33841b256b884575e50ad30026
SHA25635029b70d8f980d28fefbc358da48cc6a09fbd453092e40fd10d957dda6095d1
SHA51256f00cf9ae36eb5a5f3458939dfa8792767380107ca162dc024ebbe8c04653e9ecee726f94c12e2a47fd51a66b6002adeb2f7b59ac4c3eef21da7e5411bdb460
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5d77be4ac5b0b39f1571a77c1f041ed59
SHA108f934b2f7999058ac373141b93142d4c4eecf64
SHA256cdf251ae98cb014e4ebe13ed766556997ddbd95b2b08192c9bd59f359d645657
SHA5121fcd3afee171a00e9bdd91951b544bf088d5a8049f854f8dd3ade799632836f44753bca95e11519ab9f5734da0bfc03cb81ac6e9fc8c25286f4eb1316aee64c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5aeb6b.TMPFilesize
370B
MD5b2302e1d19a2d24b849632919dbbd268
SHA1011bb9cfa8750f331a639210a03702e7246de8a7
SHA256a728de0ef9e653704c23880f221f97dc7502f3ab4020f352b8a9cea6a4fd0635
SHA512f058f809dd90ac2ff8efa509307cb96d965cdf3644313e27acf357c267e5a16596c3716c03361060f0f8aa997da3b4044e18d25494f094a80205d296febc4216
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD53bdc76a50894c54c9f85bd8a627e09b2
SHA18ff666118c79d237f510dcec35c08174f2bbed52
SHA256d23456b0c172320f885fd328b474153696749ac25d07fee531f351fdce0ae97d
SHA512987aff963990b494dd24c4f813626095b4f58d3cf1cfcb85ed4201bd66e79d868eb03c978e0375c0538a87ae5cf491be15ea00dce761ce7975668e7b1483457b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD50ef5345816fe98546eff84f90c5b3110
SHA1e07d7ac8163217fb356664ba519beba71d4b0120
SHA2567dc24656f115b215d2b1cffc4f2f2bd693f515fd1e6642d45704e9385e958b25
SHA512d59fe0e3aae4216ed69069589a9095fb9b07ce3864d89723d9524c74b3a077f212c8cacbc0622b7bec419a74efc962ac16181c04fd0731712f53521150baeb5d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD510e43c0dcfa33228d746524631e05774
SHA1cc6782110dd07af57b7ad1f3af57bc6772623064
SHA2565b7de4bb8c42982c6a3d91933419e42e624d204fcdcbfcb1e5e51bbb0c929f1a
SHA512090860f74c1fe65645ec715311c9a7367aaed65d61a33d368e69b40031c0bf4c42a6a1ae2a808a5b224cbb953e3ff9c5088068fb641a3daa7cb5fe5cf4d40f2e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD549dea3ac096766314a1036b56a61dc31
SHA1a5dbcadcafab57a6139ac5b1667f6b81c33c0ef3
SHA25694f8dc5a7cc1aa47c52a4e6d213fe5254607a792af2fe12616b916f1448fce5c
SHA512d741c448fc480a3d3c99497551665f0122338f58263044a217fff48581a12d02c50dfaa80f2338de6338821250a8fb667e3d0ab532f862caf317a88342e9d451
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbFilesize
28KB
MD518dee46411b735132dcc6d3922ecd341
SHA1e3f52526959afc92fb777c768371d8d83d064718
SHA2566bbc9290b1d1c5bc53efe0f10967d91b937f5a6b869b7b44bd80b43eb7ef9958
SHA512bb23777df835e2cd83a25a60cfc65f800f4adea6b7b2d35cbffff12b668dae771cd27678e35ac4c47dd6219791c7cc4a24635e6e48df4390a42ed3c1d96f5a0e
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\VCRUNTIME140.dllFilesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\_asyncio.pydFilesize
63KB
MD579f71c92c850b2d0f5e39128a59054f1
SHA1a773e62fa5df1373f08feaa1fb8fa1b6d5246252
SHA2560237739399db629fdd94de209f19ac3c8cd74d48bebe40ad8ea6ac7556a51980
SHA5123fdef4c04e7d89d923182e3e48d4f3d866204e878abcaacff657256f054aeafafdd352b5a55ea3864a090d01169ec67b52c7f944e02247592417d78532cc5171
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\_bz2.pydFilesize
82KB
MD53859239ced9a45399b967ebce5a6ba23
SHA16f8ff3df90ac833c1eb69208db462cda8ca3f8d6
SHA256a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a
SHA512030e5ce81e36bd55f69d55cbb8385820eb7c1f95342c1a32058f49abeabb485b1c4a30877c07a56c9d909228e45a4196872e14ded4f87adaa8b6ad97463e5c69
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\_ctypes.pydFilesize
120KB
MD5bd36f7d64660d120c6fb98c8f536d369
SHA16829c9ce6091cb2b085eb3d5469337ac4782f927
SHA256ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902
SHA512bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\_lzma.pydFilesize
155KB
MD5e5abc3a72996f8fde0bcf709e6577d9d
SHA115770bdcd06e171f0b868c803b8cf33a8581edd3
SHA2561796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb
SHA512b347474dc071f2857e1e16965b43db6518e35915b8168bdeff1ead4dff710a1cc9f04ca0ced23a6de40d717eea375eedb0bf3714daf35de6a77f071db33dfae6
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\_queue.pydFilesize
31KB
MD5f00133f7758627a15f2d98c034cf1657
SHA12f5f54eda4634052f5be24c560154af6647eee05
SHA25635609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659
SHA5121c77dd811d2184beedf3c553c3f4da2144b75c6518543f98c630c59cd597fcbf6fd22cfbb0a7b9ea2fdb7983ff69d0d99e8201f4e84a0629bc5733aa09ffc201
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\_socket.pydFilesize
77KB
MD51eea9568d6fdef29b9963783827f5867
SHA1a17760365094966220661ad87e57efe09cd85b84
SHA25674181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117
SHA512d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\_ssl.pydFilesize
157KB
MD5208b0108172e59542260934a2e7cfa85
SHA11d7ffb1b1754b97448eb41e686c0c79194d2ab3a
SHA2565160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69
SHA51241abf6deab0f6c048967ca6060c337067f9f8125529925971be86681ec0d3592c72b9cc85dd8bdee5dd3e4e69e3bb629710d2d641078d5618b4f55b8a60cc69d
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\base_library.zipFilesize
1.8MB
MD55327287d65cc9ab041ce96e93d3a6d53
SHA1a57aa09afecf580c301f1a7702dbbb07327cf8a9
SHA25673cdfcec488b39e14993fb32a233de4bc841a394092fcac1deb6ee41e24720ea
SHA51268fc996b4809a762b8d44323a5d023ba8a39580039c748bc310da9878c94fe1685709ab959365ecb26a5ee1a82e65f2eb19344f1f03d4dff48eb87a403a57c20
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\libcrypto-1_1.dllFilesize
3.3MB
MD5e94733523bcd9a1fb6ac47e10a267287
SHA194033b405386d04c75ffe6a424b9814b75c608ac
SHA256f20eb4efd8647b5273fdaafceb8ccb2b8ba5329665878e01986cbfc1e6832c44
SHA51207dd0eb86498497e693da0f9dd08de5b7b09052a2d6754cfbc2aa260e7f56790e6c0a968875f7803cb735609b1e9b9c91a91b84913059c561bffed5ab2cbb29f
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\libffi-8.dllFilesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\libssl-1_1.dllFilesize
688KB
MD525bde25d332383d1228b2e66a4cb9f3e
SHA1cd5b9c3dd6aab470d445e3956708a324e93a9160
SHA256c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13
SHA512ca2f2139bb456799c9f98ef8d89fd7c09d1972fa5dd8fc01b14b7af00bf8d2c2175fb2c0c41e49a6daf540e67943aad338e33c1556fd6040ef06e0f25bfa88fa
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\pyexpat.pydFilesize
194KB
MD59c21a5540fc572f75901820cf97245ec
SHA109296f032a50de7b398018f28ee8086da915aebd
SHA2562ff8cd82e7cc255e219e7734498d2dea0c65a5ab29dc8581240d40eb81246045
SHA5124217268db87eec2f0a14b5881edb3fdb8efe7ea27d6dcbee7602ca4997416c1130420f11167dac7e781553f3611409fa37650b7c2b2d09f19dc190b17b410ba5
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\python3.dllFilesize
65KB
MD5b711598fc3ed0fe4cf2c7f3e0877979e
SHA1299c799e5d697834aa2447d8a313588ab5c5e433
SHA256520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a
SHA512b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\python311.dllFilesize
5.5MB
MD55a5dd7cad8028097842b0afef45bfbcf
SHA1e247a2e460687c607253949c52ae2801ff35dc4a
SHA256a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\select.pydFilesize
29KB
MD5c97a587e19227d03a85e90a04d7937f6
SHA1463703cf1cac4e2297b442654fc6169b70cfb9bf
SHA256c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf
SHA51297784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12
-
C:\Users\Admin\AppData\Local\Temp\_MEI43242\ucrtbase.dllFilesize
987KB
MD56169dac91a2ab01314395d972fc48642
SHA1a8d9df6020668e57b97c01c8fd155a65218018af
SHA256293e867204c66f6ea557da9dfba34501c1b49fde6ba8ca36e8af064508707b4e
SHA5125f42f268426069314c7e9a90ce9ca33e9cd8c1512dcd5cc38d33442aa24dd5c40fa806cc8a2f1c1189acae6a2e680b6e12fb8e79a3c73e38ae21a154be975199
-
C:\Users\Admin\AppData\Local\Temp\aut57196.exeFilesize
155KB
MD5313947a4af64125b533cdc5cf9c41f89
SHA11eafc7bf6962b95885be280ea67de206459b0347
SHA256d3b037a707032d9f4a347ba0e3add9e490250b3a28454655bc7060441f620db6
SHA512147dfe350464f263bd1b7b6e616686586f86bd33bbac443be770d1981496c52da87fa3af764b4923ea4503134e846b5bffad80cbdfe6f10080d6b02673cd751b
-
C:\Users\Admin\AppData\Local\Temp\tmp20es5b1y\unlicense.tmpFilesize
32.7MB
MD574dd6a9aeb5de9f3060186a3b202d85d
SHA14b452e3190c1a41bba8b7072ec8c329602584033
SHA25638812baa9fa6e184b9a9974d9109a3651ea01ea4bfd083c5ad8001fb6e8981cc
SHA5129458c6841af0720cc69cd11e709fe6c5f81a8eaa2fa2ab2811d4f85dbefbe81654218656e9948b34556d3d54ab82eb482ab37d374b1a76ccc3a776e07320949a
-
C:\Users\Admin\AppData\Local\Temp\tmp70avqzqo\unlicense.tmp2Filesize
32.7MB
MD51fe3edf0ac362dca39b8476af0e389f8
SHA1c3dea989eb8daf09d6b6e7c0f9bfced24a827852
SHA2567558b0460b3fa4c3dc29b84209cf0c6d52df6a4251f8b66c1d5ccf81526d6e3c
SHA512ca3ad7b0e373882abeec8e8f45ea4de1e5118e34aa15f023bac9c6285bba4dccccc646b6f81ebeb5e71c3a44362e6a7ba332e207df108477ac881553d5eaf858
-
C:\Users\Admin\Downloads\Unconfirmed 477267.crdownloadFilesize
22.6MB
MD5c0ee72427b96da2279623bb76c850762
SHA1ee38cf091f1c79ff17041f004292d32fe39b16df
SHA256458b5d89fb9794fe351b86b02c8f8906470cca2679e2e2b3c2b4c9ad63d9c916
SHA512111ce08c4118a10bd0d541640af343c0a133cd32a77accfb6bdbb4127a0d7586a1c5d6b0d23bac91f580da936bb5568cbe3b548f1dee2b119241d9fcb6c3be18
-
C:\Users\Admin\Downloads\unlicense-py3.11-x64.zipFilesize
46.8MB
MD52f769fc19beb081a1f94f0013f96e2fb
SHA186a55959ab6ac2ba4abe5e7aced9d3dbc9a23f68
SHA25609d2b526d7a9f76dc11546b3af85e67cd187108f060af6286d7a533831949d16
SHA512d50e924a844fbcb5baf8b2ec5badaf5611d764a9f7e42e6afc2927956b2e3a90f9f3eface705884aed778e0231855abd1db5c1c75c65d75805f26adbea450068
-
\??\pipe\LOCAL\crashpad_2776_FGEJTBPRTTAOUVIQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2360-742-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmpFilesize
32.7MB
-
memory/2360-739-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmpFilesize
32.7MB
-
memory/2360-744-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmpFilesize
32.7MB
-
memory/2360-743-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmpFilesize
32.7MB
-
memory/2360-884-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmpFilesize
32.7MB
-
memory/2360-741-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmpFilesize
32.7MB
-
memory/2360-740-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmpFilesize
32.7MB
-
memory/2360-1232-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmpFilesize
32.7MB
-
memory/2360-736-0x000001C94A470000-0x000001C94A471000-memory.dmpFilesize
4KB
-
memory/2360-745-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmpFilesize
32.7MB
-
memory/2360-737-0x000001C94C390000-0x000001C94C3A0000-memory.dmpFilesize
64KB
-
memory/2360-738-0x00007FF779EB0000-0x00007FF77BF61000-memory.dmpFilesize
32.7MB
-
memory/3052-1326-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmpFilesize
10.8MB
-
memory/3052-1316-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmpFilesize
10.8MB
-
memory/3052-1300-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmpFilesize
10.8MB
-
memory/3052-0-0x00007FFD9E693000-0x00007FFD9E695000-memory.dmpFilesize
8KB
-
memory/3052-4-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmpFilesize
10.8MB
-
memory/3052-3-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmpFilesize
10.8MB
-
memory/3052-2-0x00007FFD9E690000-0x00007FFD9F151000-memory.dmpFilesize
10.8MB
-
memory/3052-1-0x00000000002A0000-0x00000000003DC000-memory.dmpFilesize
1.2MB