njrat | 21bd72f49e3a9bd1778fa174fdd0cde88a11ad8bf3cba985fe1367c7154a7abb

Analysis

max time kernel
131s
max time network
130s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23-05-2024 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lol.exe
Size

4.1MB
MD5

967d3eaa117f7ff867a91febcc8d2928
SHA1

638872b00b1a3eed215e60e78c93b8b5599a5898
SHA256

21bd72f49e3a9bd1778fa174fdd0cde88a11ad8bf3cba985fe1367c7154a7abb
SHA512

f45a2bf03a9b83f9a1201eeac1f03b8610969a361ff7e38e4b37f93e80d18a1f33452677caf8546775ac08e1b493fa86ecc859c3cf75d3af1199470b39d0ef35
SSDEEP

49152:toInYnAv1vYjUbQgvdkMgl2Zu7jfWL2ntzMqS1M+etxQnVIqwlwHnEOGc:toIcAv1vYjWSMy7PlnVw1+6q1ONB

Score

10^/10

njrat umbral discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000001ac51-521.dat	family_umbral

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hpbxrrwufi.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hpbxrrwufi.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	hpbxrrwufi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	hpbxrrwufi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	hpbxrrwufi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	hpbxrrwufi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	hpbxrrwufi.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hpbxrrwufi.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 10 IoCs

pid	Process
1720	loader.exe
4048	ac3.exe
2640	jaffa.exe
3336	jkka.exe
4244	hpbxrrwufi.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
3704	eadxtpnatuglo.exe
3972	hdiakkmj.exe
5196	packer.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3684	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	hpbxrrwufi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	hpbxrrwufi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	hpbxrrwufi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	hpbxrrwufi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	hpbxrrwufi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	hpbxrrwufi.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vmvvdxik = "ofvjxpjtrvopbow.exe"	ofvjxpjtrvopbow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "eadxtpnatuglo.exe"	ofvjxpjtrvopbow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dalcozhc = "hpbxrrwufi.exe"	ofvjxpjtrvopbow.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	hdiakkmj.exe
File opened (read-only)	\??\q:	hdiakkmj.exe
File opened (read-only)	\??\s:	hdiakkmj.exe
File opened (read-only)	\??\x:	hdiakkmj.exe
File opened (read-only)	\??\q:	hdiakkmj.exe
File opened (read-only)	\??\h:	hpbxrrwufi.exe
File opened (read-only)	\??\y:	hpbxrrwufi.exe
File opened (read-only)	\??\z:	hpbxrrwufi.exe
File opened (read-only)	\??\a:	hpbxrrwufi.exe
File opened (read-only)	\??\u:	hdiakkmj.exe
File opened (read-only)	\??\w:	hpbxrrwufi.exe
File opened (read-only)	\??\i:	hdiakkmj.exe
File opened (read-only)	\??\k:	hdiakkmj.exe
File opened (read-only)	\??\z:	hdiakkmj.exe
File opened (read-only)	\??\n:	hpbxrrwufi.exe
File opened (read-only)	\??\s:	hpbxrrwufi.exe
File opened (read-only)	\??\u:	hpbxrrwufi.exe
File opened (read-only)	\??\u:	hdiakkmj.exe
File opened (read-only)	\??\a:	hdiakkmj.exe
File opened (read-only)	\??\e:	hpbxrrwufi.exe
File opened (read-only)	\??\r:	hpbxrrwufi.exe
File opened (read-only)	\??\e:	hdiakkmj.exe
File opened (read-only)	\??\j:	hdiakkmj.exe
File opened (read-only)	\??\s:	hdiakkmj.exe
File opened (read-only)	\??\k:	hpbxrrwufi.exe
File opened (read-only)	\??\m:	hpbxrrwufi.exe
File opened (read-only)	\??\b:	hdiakkmj.exe
File opened (read-only)	\??\h:	hdiakkmj.exe
File opened (read-only)	\??\o:	hdiakkmj.exe
File opened (read-only)	\??\v:	hdiakkmj.exe
File opened (read-only)	\??\h:	hdiakkmj.exe
File opened (read-only)	\??\j:	hdiakkmj.exe
File opened (read-only)	\??\l:	hdiakkmj.exe
File opened (read-only)	\??\x:	hdiakkmj.exe
File opened (read-only)	\??\y:	hdiakkmj.exe
File opened (read-only)	\??\j:	hpbxrrwufi.exe
File opened (read-only)	\??\p:	hdiakkmj.exe
File opened (read-only)	\??\g:	hdiakkmj.exe
File opened (read-only)	\??\o:	hdiakkmj.exe
File opened (read-only)	\??\k:	hdiakkmj.exe
File opened (read-only)	\??\m:	hdiakkmj.exe
File opened (read-only)	\??\i:	hpbxrrwufi.exe
File opened (read-only)	\??\l:	hpbxrrwufi.exe
File opened (read-only)	\??\x:	hpbxrrwufi.exe
File opened (read-only)	\??\z:	hdiakkmj.exe
File opened (read-only)	\??\e:	hdiakkmj.exe
File opened (read-only)	\??\w:	hdiakkmj.exe
File opened (read-only)	\??\v:	hpbxrrwufi.exe
File opened (read-only)	\??\a:	hdiakkmj.exe
File opened (read-only)	\??\r:	hdiakkmj.exe
File opened (read-only)	\??\b:	hpbxrrwufi.exe
File opened (read-only)	\??\p:	hpbxrrwufi.exe
File opened (read-only)	\??\v:	hdiakkmj.exe
File opened (read-only)	\??\t:	hdiakkmj.exe
File opened (read-only)	\??\n:	hdiakkmj.exe
File opened (read-only)	\??\r:	hdiakkmj.exe
File opened (read-only)	\??\q:	hpbxrrwufi.exe
File opened (read-only)	\??\l:	hdiakkmj.exe
File opened (read-only)	\??\y:	hdiakkmj.exe
File opened (read-only)	\??\p:	hdiakkmj.exe
File opened (read-only)	\??\t:	hdiakkmj.exe
File opened (read-only)	\??\g:	hdiakkmj.exe
File opened (read-only)	\??\n:	hdiakkmj.exe
File opened (read-only)	\??\i:	hdiakkmj.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	hpbxrrwufi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	hpbxrrwufi.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000700000001ac48-77.dat	autoit_exe
behavioral1/files/0x000700000001ac4a-86.dat	autoit_exe
behavioral1/memory/2640-88-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
behavioral1/files/0x000800000001ac19-124.dat	autoit_exe
behavioral1/files/0x000800000001ac18-121.dat	autoit_exe
behavioral1/files/0x000800000001ac1a-132.dat	autoit_exe
behavioral1/files/0x000800000001ac17-116.dat	autoit_exe
behavioral1/files/0x000700000001ac79-344.dat	autoit_exe
behavioral1/files/0x000700000001ac7a-347.dat	autoit_exe
behavioral1/files/0x000700000001ac7d-446.dat	autoit_exe
behavioral1/files/0x000800000001ab97-492.dat	autoit_exe
behavioral1/files/0x000800000001ab97-532.dat	autoit_exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\hdiakkmj.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\ofvjxpjtrvopbow.exe	jaffa.exe
File created	C:\Windows\SysWOW64\ofvjxpjtrvopbow.exe	jaffa.exe
File created	C:\Windows\SysWOW64\hdiakkmj.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\eadxtpnatuglo.exe	jaffa.exe
File created	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	hdiakkmj.exe
File created	C:\Windows\SysWOW64\hpbxrrwufi.exe	jaffa.exe
File created	C:\Windows\SysWOW64\eadxtpnatuglo.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	hpbxrrwufi.exe
File opened for modification	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	hdiakkmj.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	hdiakkmj.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	hdiakkmj.exe
File opened for modification	C:\Windows\SysWOW64\hpbxrrwufi.exe	jaffa.exe
File opened for modification	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	hdiakkmj.exe
File created	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	hdiakkmj.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	hdiakkmj.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	hdiakkmj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	hdiakkmj.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	hdiakkmj.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	hdiakkmj.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	hdiakkmj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal	hdiakkmj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal	hdiakkmj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	hdiakkmj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	hdiakkmj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal	hdiakkmj.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	hdiakkmj.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	hdiakkmj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	hdiakkmj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal	hdiakkmj.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.15063.0_none_2933b3c562ac3149\MsoIrmProtector.doc.exe	hdiakkmj.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.15063.0_none_2933b3c562ac3149\MsoIrmProtector.doc.exe	hdiakkmj.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\mydoc.rtf	jaffa.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.15063.0_none_2933b3c562ac3149\MsoIrmProtector.doc.exe	hdiakkmj.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.15063.0_none_2933b3c562ac3149\MsoIrmProtector.doc.exe	hdiakkmj.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.15063.0_none_1edf09732e4b6f4e\MsoIrmProtector.doc.exe	hdiakkmj.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.15063.0_none_1edf09732e4b6f4e\MsoIrmProtector.doc.exe	hdiakkmj.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.15063.0_none_1edf09732e4b6f4e\MsoIrmProtector.doc.exe	hdiakkmj.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.15063.0_none_1edf09732e4b6f4e\MsoIrmProtector.doc.exe	hdiakkmj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5428	5196	WerFault.exe	110

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2944	taskkill.exe
1588	taskkill.exe
4704	taskkill.exe
1752	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40529f006354bf01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E09078D-190F-11EF-8A80-DAB43BA6EC3F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502698006354bf01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e930d7bb99aee14c8df5b595461b0cfa00000000020000000000106600000001000020000000d456eb5764b0918acebeb1ac5cc42050349503ab3f7f75eebe1aa777797f834a000000000e8000000002000020000000f80ab27bd45356a32603b98e699ee2179dd66555c22820f5609bc447b76e157520000000a76d3450a418c435f0fa4d9ddb85d75b50027e2d0244ef751def83156aec9fe8400000009a87b0fa048e59cd0ed64acf6c288a9356f7cfd8061f817257563580d132a5872515298a7987aacd0de3a49c155a495d142b48a181986d4debe1be68d3d3b667	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e930d7bb99aee14c8df5b595461b0cfa00000000020000000000106600000001000020000000d3116e647e33e6571170c1f34f40895bc95da0570daff56343e6764559b618f2000000000e8000000002000020000000575377b9e72c37d66c68cdc319efa82743ed4d385ac89b42849132aa0023a0c420000000229544be853caabfeb249642bbe58ea4c1fb20543ae19c15870feaf60679bdc64000000056915d4785a17eb00084066e1af5ef071386163b147188704c6e58ffbd86662514881bdcbd9d58c54f43ac3321f912e93f6bfe423a1f50a26b2b93785fea1748	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609439630351897"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF4FFF9485F8219903CD65C7DE2BD97E636584267406332D79B"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	hpbxrrwufi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	hpbxrrwufi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	hpbxrrwufi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC3B12E47E739E353C5BAA03298D7CC"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F56BB4FE6821DBD27FD1A48A0E9110"	jaffa.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABAFAC9FE6BF19384783A4186EA3E95B38D038B43670239E1CC42EF09D4"	jaffa.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	jaffa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f75274f01badda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 347d3df01badda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	hpbxrrwufi.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	control.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{88E6248F-3348-4792-B483-0C9FCC056375} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193DC67C14E4DBC4B8C07F95ED9734BB"	jaffa.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000426502d2fcf6ca5cd4ed57b85f05adfba2caa912d056ef41511edbd1d78392194a1fec29e7e88f981ab8022bf7a40a397d55cc575514c4d12bfb	MicrosoftEdge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4040	WINWORD.EXE
4040	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4768	ofvjxpjtrvopbow.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
4580	hdiakkmj.exe
4768	ofvjxpjtrvopbow.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
4580	hdiakkmj.exe
4768	ofvjxpjtrvopbow.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
4580	hdiakkmj.exe
4768	ofvjxpjtrvopbow.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
4580	hdiakkmj.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
4768	ofvjxpjtrvopbow.exe
4768	ofvjxpjtrvopbow.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2440	MicrosoftEdgeCP.exe
2440	MicrosoftEdgeCP.exe
2440	MicrosoftEdgeCP.exe
2440	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	1588	taskkill.exe
Token: SeDebugPrivilege	4704	taskkill.exe
Token: SeSystemtimePrivilege	2996	cmd.exe
Token: SeSystemtimePrivilege	2996	cmd.exe
Token: SeDebugPrivilege	4844	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4844	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4844	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4844	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	220	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	220	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	220	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3288	MicrosoftEdge.exe
Token: SeDebugPrivilege	3288	MicrosoftEdge.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	1120	control.exe
Token: SeCreatePagefilePrivilege	1120	control.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeSystemtimePrivilege	5444	rundll32.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe
Token: SeShutdownPrivilege	5764	chrome.exe
Token: SeCreatePagefilePrivilege	5764	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3192	iexplore.exe
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2640	jaffa.exe
2640	jaffa.exe
2640	jaffa.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4244	hpbxrrwufi.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
4768	ofvjxpjtrvopbow.exe
4580	hdiakkmj.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3704	eadxtpnatuglo.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe
3972	hdiakkmj.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
5764	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3288	MicrosoftEdge.exe
2440	MicrosoftEdgeCP.exe
3192	iexplore.exe
3192	iexplore.exe
844	IEXPLORE.EXE
844	IEXPLORE.EXE
4844	MicrosoftEdgeCP.exe
2440	MicrosoftEdgeCP.exe
4040	WINWORD.EXE
4040	WINWORD.EXE
4040	WINWORD.EXE
4040	WINWORD.EXE
4040	WINWORD.EXE
4040	WINWORD.EXE
4040	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 1720	3608	lol.exe	74
PID 3608 wrote to memory of 1720	3608	lol.exe	74
PID 1720 wrote to memory of 4196	1720	loader.exe	76
PID 1720 wrote to memory of 4196	1720	loader.exe	76
PID 4196 wrote to memory of 2996	4196	cmd.exe	78
PID 4196 wrote to memory of 2996	4196	cmd.exe	78
PID 2996 wrote to memory of 1752	2996	cmd.exe	80
PID 2996 wrote to memory of 1752	2996	cmd.exe	80
PID 2996 wrote to memory of 3640	2996	cmd.exe	84
PID 2996 wrote to memory of 3640	2996	cmd.exe	84
PID 2996 wrote to memory of 3192	2996	cmd.exe	87
PID 2996 wrote to memory of 3192	2996	cmd.exe	87
PID 2996 wrote to memory of 2944	2996	cmd.exe	89
PID 2996 wrote to memory of 2944	2996	cmd.exe	89
PID 3192 wrote to memory of 844	3192	iexplore.exe	90
PID 3192 wrote to memory of 844	3192	iexplore.exe	90
PID 3192 wrote to memory of 844	3192	iexplore.exe	90
PID 2996 wrote to memory of 1588	2996	cmd.exe	91
PID 2996 wrote to memory of 1588	2996	cmd.exe	91
PID 2996 wrote to memory of 4048	2996	cmd.exe	93
PID 2996 wrote to memory of 4048	2996	cmd.exe	93
PID 2996 wrote to memory of 4048	2996	cmd.exe	93
PID 2996 wrote to memory of 4704	2996	cmd.exe	94
PID 2996 wrote to memory of 4704	2996	cmd.exe	94
PID 2996 wrote to memory of 3684	2996	cmd.exe	96
PID 2996 wrote to memory of 3684	2996	cmd.exe	96
PID 2996 wrote to memory of 2640	2996	cmd.exe	97
PID 2996 wrote to memory of 2640	2996	cmd.exe	97
PID 2996 wrote to memory of 2640	2996	cmd.exe	97
PID 2996 wrote to memory of 620	2996	cmd.exe	98
PID 2996 wrote to memory of 620	2996	cmd.exe	98
PID 2996 wrote to memory of 3336	2996	cmd.exe	99
PID 2996 wrote to memory of 3336	2996	cmd.exe	99
PID 2996 wrote to memory of 3336	2996	cmd.exe	99
PID 2640 wrote to memory of 4244	2640	jaffa.exe	100
PID 2640 wrote to memory of 4244	2640	jaffa.exe	100
PID 2640 wrote to memory of 4244	2640	jaffa.exe	100
PID 2640 wrote to memory of 4768	2640	jaffa.exe	101
PID 2640 wrote to memory of 4768	2640	jaffa.exe	101
PID 2640 wrote to memory of 4768	2640	jaffa.exe	101
PID 2640 wrote to memory of 4580	2640	jaffa.exe	102
PID 2640 wrote to memory of 4580	2640	jaffa.exe	102
PID 2640 wrote to memory of 4580	2640	jaffa.exe	102
PID 2640 wrote to memory of 3704	2640	jaffa.exe	103
PID 2640 wrote to memory of 3704	2640	jaffa.exe	103
PID 2640 wrote to memory of 3704	2640	jaffa.exe	103
PID 2640 wrote to memory of 4040	2640	jaffa.exe	104
PID 2640 wrote to memory of 4040	2640	jaffa.exe	104
PID 4244 wrote to memory of 3972	4244	hpbxrrwufi.exe	105
PID 4244 wrote to memory of 3972	4244	hpbxrrwufi.exe	105
PID 4244 wrote to memory of 3972	4244	hpbxrrwufi.exe	105
PID 2440 wrote to memory of 220	2440	MicrosoftEdgeCP.exe	95
PID 2440 wrote to memory of 220	2440	MicrosoftEdgeCP.exe	95
PID 2440 wrote to memory of 220	2440	MicrosoftEdgeCP.exe	95
PID 2440 wrote to memory of 220	2440	MicrosoftEdgeCP.exe	95
PID 3608 wrote to memory of 5196	3608	lol.exe	110
PID 3608 wrote to memory of 5196	3608	lol.exe	110
PID 3608 wrote to memory of 5196	3608	lol.exe	110
PID 5764 wrote to memory of 5756	5764	chrome.exe	116
PID 5764 wrote to memory of 5756	5764	chrome.exe	116
PID 5764 wrote to memory of 5932	5764	chrome.exe	117
PID 5764 wrote to memory of 5932	5764	chrome.exe	117
PID 5764 wrote to memory of 5932	5764	chrome.exe	117
PID 5764 wrote to memory of 5932	5764	chrome.exe	117

C:\Users\Admin\AppData\Local\Temp\lol.exe
"C:\Users\Admin\AppData\Local\Temp\lol.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\loader.exe
  "C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\temp.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K main.cmd
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im WindowsDefender.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\helper.vbs"
        5⤵
        
        PID:3640
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\spinner.gif
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3192
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3192 CREDAT:82945 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:844
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
    - - C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\ac3.exe
        
        ac3.exe
        5⤵
        Executes dropped EXE
        
        PID:4048
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im fontdrvhost
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
    - - C:\Windows\system32\icacls.exe
        
        icacls c:\Windows\explorer.exe /grant Admin:(F,M)
        5⤵
        Modifies file permissions
        
        PID:3684
    - - C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\jaffa.exe
        
        jaffa.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2640
      - C:\Windows\SysWOW64\hpbxrrwufi.exe
        
        hpbxrrwufi.exe
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        Windows security bypass
        Disables RegEdit via registry modification
        Executes dropped EXE
        Windows security modification
        Enumerates connected drives
        Modifies WinLogon
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\hdiakkmj.exe
        
        C:\Windows\system32\hdiakkmj.exe
        7⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3972
      - C:\Windows\SysWOW64\ofvjxpjtrvopbow.exe
        
        ofvjxpjtrvopbow.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4768
      - C:\Windows\SysWOW64\hdiakkmj.exe
        
        hdiakkmj.exe
        6⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4580
      - C:\Windows\SysWOW64\eadxtpnatuglo.exe
        
        eadxtpnatuglo.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3704
      - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
        6⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:4040
    - - C:\Windows\system32\iexpress.exe
        
        IEXPRESS.exe
        5⤵
        
        PID:620
    - - C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\jkka.exe
        
        jkka.exe
        5⤵
        Executes dropped EXE
        
        PID:3336
- C:\Users\Admin\AppData\Local\Temp\b845cc35-1a0e-48f9-8fa2-01c6459855b1\packer.exe
  "C:\Users\Admin\AppData\Local\Temp\b845cc35-1a0e-48f9-8fa2-01c6459855b1\packer.exe" "C:\Users\Admin\AppData\Local\Temp\b845cc35-1a0e-48f9-8fa2-01c6459855b1\unpacker.exe" "C:\Users\Admin\AppData\Local\Temp\lol.exe" "loader.exe" "C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e" "" True True False 1 -repack
  2⤵
  - Executes dropped EXE
  PID:5196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 1272
    3⤵
    - Program crash
    PID:5428

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3288

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4844

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ff8cabb9758,0x7ff8cabb9768,0x7ff8cabb9778
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:2
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4380 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3876 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:1
  2⤵
  PID:344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3860 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:1
  2⤵
  PID:192
- C:\Windows\system32\control.exe
  "C:\Windows\system32\control.exe" /name Microsoft.DateAndTime
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\timedate.cpl
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3216 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5172 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:1
  2⤵
  PID:5244
- C:\Windows\system32\control.exe
  "C:\Windows\system32\control.exe" /name Microsoft.DateAndTime
  2⤵
  - Modifies registry class
  PID:844
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\timedate.cpl
    3⤵
    PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2288 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2292 --field-trial-handle=1860,i,506672960692891766,7417808325466530164,131072 /prefetch:1
  2⤵
  PID:5156

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2720

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:5328

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:5600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8cabb9758,0x7ff8cabb9768,0x7ff8cabb9778
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1596 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2000 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2872 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:8
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4704 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4980 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:5704
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff6c68f7688,0x7ff6c68f7698,0x7ff6c68f76a8
    3⤵
    PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5320 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5236 --field-trial-handle=1860,i,2864850426201316323,15997127686685365148,131072 /prefetch:1
  2⤵
  PID:5736

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

Filesize
512KB

MD5
e0fea735192e767125440efecba0bcd2

SHA1
82ec54ada21eca1ae6ae01ff6458cdf97c2dfce2

SHA256
2f42181046f10b76919ffc769a61596249176110f1ede34794f417d7b711657d

SHA512
322bbfc7e65592ea3b320aa4bf0726d2445887105fbaa80700b894d9a095d296b6139b668a528b37b1d9236c05bfb305bc0be63769e836fb952a005f64cc23a0

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

Filesize
512KB

MD5
0295b5e91292bb260830ec049f188c10

SHA1
b6d999a3f82e9b0f7833d690724519d31e7ddb78

SHA256
aed071784c9b7b6ba6983dea3081467fe8f42ea7d7ae8eff27aebd2f96fd1340

SHA512
4682e17891ff1add0259c175dcc04448c1b36b37bcc556d49b7145a9b9196ac7f180cf215b1c55b15c91a7feca06b6611e20c1fd524bf5a41660f56b924f9c27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
d9a49a7d6d5ca840cf0f0e937007e278

SHA1
90197e483cc1bf8970cb6012997b1968f43d8e78

SHA256
183acf4a52e283da352ac2e3d51d43dbdd1534325f4585b6763a4ef38151b876

SHA512
142acbf150500db5f703b3e56c42895cb4374927f6e26adb02f090cf18e9797b8f4e34b7e621de6daf03093cc0a7df73cb4328525ac7a1a4f36e2b61dfde0642

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
acdad9483d3f27ed7e86c7f0116d8ad9

SHA1
dd2cfd176ad33d12ba7e6d260e1069b1dd4490c4

SHA256
bff5b4fff4b34ed3ea2754985b5ba1a8d6921517b0fa370f71f37ee0845552ba

SHA512
6e3ab4b6cfa73a7ad3c36fa621b1d2817b26e8e3613b78a40df6691d65e1486e6c2281efa0f8d3f30d2c6647b7ba3430a8be77df770f1cc575e8db76be6836a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
be7972a3e36655b7074bfdb4351194a0

SHA1
3107fadeb8ba689d6a37a7443a1230d28a1f6173

SHA256
3e169bbc539bfd80ef1193cfe607d12dd9219f42738a90e3145e3f952a5b2bea

SHA512
0ed550ca0f17c00244c5930a875333aab8f895b62c24f9e5ad412a285df0440360974a270d217bc2e41b6e0f96d797c1bcdada63c6a2bd00945953e31cedda11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e832e72bf956098a061f535b53e2e412

SHA1
53a8cf6d630ae12201460d5ec223ed1e69bfd820

SHA256
068c87141f4ed2d90a54355922e1ae590d53386f13d30e5fc97c1db64fec7bab

SHA512
566477bbb500928d21944213d7ccb8248f74582f7fa18e94633a919c41645d678ab3ea3ef42aeb68b28d14c1b90d3c3814e62df3a3eecbd778c6d08d7c063b58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
ce8bc756a4d334cae1a069828c1246fc

SHA1
f092e19f43cc02ac41a948d81fe883429335a879

SHA256
dcccf7836fbc5ac9e14e6b395ddf91d76169995c35f2e49d05716e30ea946cdb

SHA512
309b2996b31cfc9ec25787394b406ecb7045c436c4f14b9505f6c60b52ee77c4d81c893ff2b96041660b333aff5087e3f567de7e4ec8aaa08854e4fd65178031

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
732ca50bc9d731687a7660dc08d79844

SHA1
0bbe72460c92dbf68d1d4f6a9bd2426e74859a82

SHA256
18a523710b1f3a760ede9e61cd11057773ec0cedeedd6673098eb62f3e0152a0

SHA512
f73ef4e5d136ea0ebf54ad25774f4fbbd5088fb90301ba49883b2230f4b24346291e1e61bc12f2dc1f5f05f2c8b1940d5e33c51beb907dcf50880ef2f87db0a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
efee82ec2a68cd54c68b284864b6482d

SHA1
1b4a85cf4c77d502d912c41bc5ce028e3b569a09

SHA256
8099e50e532c36bd95baf9ddada8ec3c92e3f7661bf740e4ab18e0c916e157e0

SHA512
c16c993b677673ee72bceec3339377786d8c36c3515b8cfebc2c390fce7ba4acf8d8adcf0155bc6a19557a5d1557551ccbe3b3392c204a688269a2d6b84117f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a7cf630ce92fbe9c2e504946d47e4e66

SHA1
7a0c2c51226bd0d75803a4e27d19a219c989e7d2

SHA256
3b24bfa5bc047e85ea1e666a32d39fcceb02ac42892b8aed19a3603942197b5c

SHA512
2ceda10fe75dc08806605fa1d7dbf48adac708c4dfacdb7afa2c4a208e243616e02f583982d0941a9b902ff79b40e04b588b2d1aeb9d5249d5551e1e28b181c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
62488271f8c8e5d28ca3b1bba907afff

SHA1
67da92bfb5f016a5e4a8d218f4d9b505f0e34005

SHA256
e6ed697c16077c8575d4e86926b6915ac5c4d468665cd1c35d20b96f387acc5d

SHA512
f8deb17a715de4f5550bda5dd7401a6e4daefc3b71cd223d9eb1db0f5b6672458283df39769e0bce01f24430c54d697c60fbdf4489a518b38bd1003de79c1cb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b87d36feeb203b9f7bfc7590b37bd80c

SHA1
11135306d4988ec0c7b58db352c6a7f9a1ab7ec7

SHA256
32126eb9f15bcc37d449d558b1bb8ea9409d666c1ce194241502d5662b2488b9

SHA512
f7b9eb8d2e9184561c4829ad2953914582e7ddfdfe5617462497d8f1adfe9803a6534e5e5da43544ef426e87327718ad1e25321c0b707193fea50d53f83da4cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
067a74f4ced9239b25cb50a9eebc14bd

SHA1
718ee49bf15939b756e444bff5f9a2fc7e353c1b

SHA256
910e08f2c4b70b251cbee56a707f730ed6e7a0dae992d103802c7c6f7f082988

SHA512
0ca557748f2951a123565778e7cd5480e9a6cf008e476a8bf7db9cb44e842ad1386f5fac102006775dfde484fd81f85b3dc1346817556cbe398613231df423c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
d42e64e02504f79ce7647bd579692a70

SHA1
be767e8e73d2023f38efa3fe65317c14a827e5e0

SHA256
beb6793f758e001718770508daddd64ec69bd91a99b9df3cb17bae448ed1df4f

SHA512
8c35197d7684d0fc4e83ec63f6329d6e6e1c92f40bceb9ef096b2c7119d1471a7588c3e21bda7527c717c4af4b0659d48fd7e7ef0d735510ecfb71f38a52f9ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
319KB

MD5
8d70ea677d68ead75a0b6c3065ba49c5

SHA1
cd82cec40649655d297c2c5e6729814935f2d78d

SHA256
a3352384bf67048060606195a0a39bf58e878f6b25f89daa703440608949400a

SHA512
6676468539d606dbedd876ee0d62270cfa46dc1650fad46e14e0c8bd294b720057abf0c92bebd98845a20e68ffd739d8ece3fcd377ace6cec9eca86243eb80ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
178KB

MD5
d03220a8884e2b17244998de471538d3

SHA1
c40dafa715a717fb6bcb7fd61830a808e39fe922

SHA256
4c4e65342e9c0d4ce07d2b2653226745a6d91fe16e0aa9f998d4a9e4b309d333

SHA512
8482504c779f99bc9bc8bda4ac129dcebd16d9a5d6f3c7541a1b9ae62e984f35a2fc076fd6eacd02a3b467d42c88e169d104ffe676278172e356a9b6ad830ad8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
ac5e82fe22176b84cfb1473e48f3dfbb

SHA1
881851fde10218cfee17b120703fecde4b133ec2

SHA256
a628c487bc58dff3b0003269436b08ad15ac7c3f53dd2667c2f372df3dec8206

SHA512
83a1955a557d9f10683fb385cf2e93dcea7714e5a3d9d1f30e853aad3b956d24af8ec9f435002e2cc9fb003751b642ce5ee5951a337c09af224a115adf25f7c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
168KB

MD5
2e2eac6764ed56aba69651281bcb39b3

SHA1
1b567d00cfb420a3604ce2a37e367fe8e2d7dc4c

SHA256
240e2b531cff2c42ae5c1a507043f97a9123a30484255853be92d957ee1abe71

SHA512
5797a8327e8332af0408bcc708da7b7634f2b96f8486d63122ae70e3439a77ad88830396acd1684d0f30f87ff6f5590ec488c4e181e2d8033e847b73fff273ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
0a677809359a0d55edc73049e477c4b3

SHA1
7938ab884acd282d6f15f8470444834a600eac21

SHA256
bb9117c9965c69fd4cfdd741a564608652e8e9f33a52d733da20634229a12cc4

SHA512
659a43f82e07667c5d1a2ad6e3007760304ca4b25d2bcf7549cdddb0730af5be50373d525aa0539995cf7f65e7116ab3eb47ad6466c4e2550db4b6f905c86e39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
902e341998bc05f8f755ba1d2dcad5b9

SHA1
4ba9ac9382555da1e8b1800a8f4208cd30664acf

SHA256
7f74e7e90bef2611d1e85340a142cb5d684793bf296b30bce20587846550af38

SHA512
a801de7ac5dc2f6da3a0f5391e631e47aed11041a5e50dddacb92d512ce65fbc211332d11ef6c1ac23094897fadf3202cc9ccab2e28cc5e9a92fe6a357913464

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFEDD9D472D5CD9661.TMP

Filesize
16KB

MD5
c7bd1aead0ee1fe688a1aa7435b42c19

SHA1
30ac6129ec80baaf6e0f7c159b1f996bd95e1591

SHA256
2042c59ff2e792a111eb86af55b64895eadedce963ce21d4936d7fa779ffc8b4

SHA512
589e080dfea75a92a2a30fed5c782250fc6a6c0e9ab108e8aab639ed46718b753550493e35a5fe93abe9dd5c77c4160be43e81feac382fd8dc9e9a97a856a275

Download Submit
C:\Users\Admin\AppData\Local\Temp\b845cc35-1a0e-48f9-8fa2-01c6459855b1\ProgressBarSplash.exe

Filesize
87KB

MD5
ed001288c24f331c9733acf3ca3520b0

SHA1
1e935afba79825470c54afaec238402d068ddefa

SHA256
6c20ba0c24e2cf169fd9b0623e4a1abe3718824ff48085250dae8c019cc6cb06

SHA512
e6ba29aa9a8c61e8fd2823cf96343fa7c3c41e8f698a6be428b13923ed3f103ea7a7d613b8808a6447f37e54516b49f61976391a551ec4fa184cc7abe38b2444

Download Submit
C:\Users\Admin\AppData\Local\Temp\b845cc35-1a0e-48f9-8fa2-01c6459855b1\packer.exe

Filesize
50KB

MD5
dfda8e40e4c0b4830b211530d5c4fefd

SHA1
994aca829c6adbb4ca567e06119f0320c15d5dba

SHA256
131fc2c07992321f9ba4045aba20339e122bab73609d41dd7114f105f77f572e

SHA512
104e64d6dd2fd549c22cd36a4be83ccb2e0c85f5cc6d88ba2729b3c7e5d5f50cd244053c8cb3bdd5e294d1a4a1964825f3a7b7df83ee855615019dfc2b49f43f

Download Submit
C:\Users\Admin\AppData\Local\Temp\b845cc35-1a0e-48f9-8fa2-01c6459855b1\unpacker.exe

Filesize
531KB

MD5
54c72f781ac4c2780371c5cc877754a7

SHA1
bb17dedf8eb82bd6a467e6d642aac20081e59779

SHA256
eb48c90f5cde797fbd475d80d3e08c857b3497a17996d9584b921faa54f6bb4b

SHA512
a9f014b54254aa666fa031e6475c1923f9410efc60f04fdd5297e82c9dc361201649d7c079d88be08234b261dda6beed70df22b57e255c420bdb2d8efb59d1db

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
243B

MD5
fc3c3eb301931edc101755bdbd07832e

SHA1
7de988750dc0c87064dfb06409a8963aa960f30c

SHA256
7659d0f61d6acf42bf9265037ee127e8a1baede4912244bdfefdd3adb2191894

SHA512
481006f15b1af0efeaf3820ab2c87cd4777749f3df91a5bac94c8f7606b2b0904a9e7b71ec371e24614b46eca84f9ed8a0863aa73411e2fba7667759a258c24d

Download Submit
C:\Users\Admin\Desktop\DismountSet.doc.exe

Filesize
512KB

MD5
c61c3954f923657448770ee19607bec3

SHA1
39b42c8ea441de1b4231fc5ae1b4dcdf302370fb

SHA256
5a1b7bf04e2e21c4c36c51adff871452e0c0ccdd8008577e1ef14ae0578010c5

SHA512
80386928edeedad7fb9806d18db517bc0458039772bf485c0ed343ca79c02904f5d187b2acbf0cd7e496508536d6e0498d9f0ade78984d4f62983a860f9eae0f

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\ACLib\playback.ico

Filesize
4KB

MD5
a20254ea7f9ef810c1681fa314edaa28

SHA1
fdd3040411043fa1d93efd4298db8668458b6fb8

SHA256
5375290e66a20bff81fb4d80346756f2d442184789681297cd1b84446a3fe80d

SHA512
4c52a7f77930e6f1bfaa1fee7e39133f74675a8666902c71be752758a29d8d167157e34f89f729ab29855990bc41757a11031adc7560c4d6b9cd77000bbcf87c

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\ACLib\record.ico

Filesize
4KB

MD5
1111e06679f96ff28c1e229b06ce7b41

SHA1
9fe5a6c6014b561060a640d0db02a303a35b8832

SHA256
59d5e9106e907fa61a560294a51c14abcde024fdd690e41a7f4d6c88db7287a6

SHA512
077aff77bbf827b9920cf53dff38427475e590c07ab8901fc34ce7b7fb9e9409207e53aff06fa7d1e3984bcf127507d0fc19284d8e7203c76d67c9b98c1c8f37

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\ACLib\stop.ico

Filesize
4KB

MD5
7824cefad2522be614ae5b7bdbf88339

SHA1
a0de5c71ac3cd42ca19ee2e4658d95b3f9082c60

SHA256
9e869f60ea0a0de06c7d562ff56d1ac53c534849c919e4b12344e73513649483

SHA512
6d377731bbda34f1875cd14e8ee896c9b8cb0aeb4133a5bc5ff460138b8b3a1b6647d3869b14a9f6949601fa37694bc38c764bf660fd877033296d9ccb0b6342

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\MEMZ.exe

Filesize
16KB

MD5
1d5ad9c8d3fee874d0feb8bfac220a11

SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595

SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\SolaraBootstraper.exe

Filesize
290KB

MD5
288a089f6b8fe4c0983259c6daf093eb

SHA1
8eafbc8e6264167bc73c159bea34b1cfdb30d34f

SHA256
3536c40290b9e7e9c3c47a96ab10fe3b737f334dd6779eaf70e35e91e10a677b

SHA512
c04bf3530cd471d589efb8f7e6bdddb39422fc4284afc7f2d3645a646ebbee170d57dc57eff30cee05ef091c64c6a98586c5a887d25fe53e49531c137d285448

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\ac3.exe

Filesize
844KB

MD5
7ecfc8cd7455dd9998f7dad88f2a8a9d

SHA1
1751d9389adb1e7187afa4938a3559e58739dce6

SHA256
2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

SHA512
cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\helper.vbs

Filesize
26B

MD5
7a97744bc621cf22890e2aebd10fd5c8

SHA1
1147c8df448fe73da6aa6c396c5c53457df87620

SHA256
153fed1733e81de7f9d221a1584a78999baa93bc8697500d8923550c774ed709

SHA512
89c73b73d4b52cf8e940fa2f1580fdc89f902b1eeb4b2abc17f09229a6130532a08cdb91205b9813a65cb7cd31ca020fe728b03d9a0fabb71131864c2966f967

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\jaffa.exe

Filesize
512KB

MD5
6b1b6c081780047b333e1e9fb8e473b6

SHA1
8c31629bd4a4ee29b7ec1e1487fed087f5e4b1de

SHA256
e649b6e4284404bfa04639b8bf06367777c48201ef27dcdc256fe59167935fac

SHA512
022d40c1801fa495c9298d896221c8eefbad342d41922df8d014f2f49c3fe7fa91d603e0ee0de6be6f2143f9e0c4a6756b19260166ebd62ec3e1c64ad22bc447

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\jkka.exe

Filesize
1002KB

MD5
42e4b26357361615b96afde69a5f0cc3

SHA1
35346fe0787f14236296b469bf2fed5c24a1a53d

SHA256
e58a07965ef711fc60ab82ac805cfc3926e105460356dbbea532ba3d9f2080eb

SHA512
fb8a2f4a9f280c0e3c0bb979016c11ea217bae9cebd06f7f2b5ef7b8973b98128ebc2e5cf76b824d71b889fca4510111a79b177dab592f332131f0d6789673a5

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\loader.bat

Filesize
51B

MD5
e67249c010d7541925320d0e6b94a435

SHA1
66aa61cc4f66d5315e7c988988b319e0ab5f01f2

SHA256
4fc3cb68df5fc781354dcc462bf953b746584b304a84e2d21b340f62e4e330fc

SHA512
681698eb0aab92c2209cc06c7d32a34cbc209cc4e63d653c797d06ebf4d9342e4f882b3ab74c294eb345f62af454f5f3a721fe3dbc094ddbe9694e40c953df96

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\loader.exe

Filesize
5KB

MD5
3a66b8c04d1437b4c4da631053a76bb5

SHA1
bcf8f381932d376f3f8e53c82b2b13ff31ee097b

SHA256
c3aa0c8ff9e3c7e10bcd3829f3e63b4cf9c59eb4964a7576f3ef5fca50c77cdc

SHA512
b24f3fb34aa293293d4f7bef247ca746608cb9ae54d214492276e7ef0fe0032944ea082f2bbf42f200359d38ed2af69f51ef5f3cb969a0ffb7176b27e0279fcf

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\main.cmd

Filesize
603B

MD5
f20bbd2cb4a807085053c6d2c321d5eb

SHA1
82396334e140eb8ac6b28dcacff868d6301409b1

SHA256
e71c1857197e115f513c0578ce97675fe8b90725356fff63296821547933c101

SHA512
5f534619a30a2fc6d7225e234e4ed230912dbb3fa17c3568ffe6f866e2cfcba93b9c6121ea580b5f9fb5a0add4fa81d32574d539c35bc01eb150286487660e82

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\selfaware.exe

Filesize
797KB

MD5
5cb9ba5071d1e96c85c7f79254e54908

SHA1
3470b95d97fb7f1720be55e033d479d6623aede2

SHA256
53b21dcfad586cdcb2bb08d0cfe62f0302662ebe48d3663d591800cf3e8469a5

SHA512
70d4f6c62492209d497848cf0e0204b463406c5d4edf7d5842a8aa2e7d4edb2090f2d27862841a217786e6813198d35ea29b055e0118b73af516edf0c79dcfad

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\spinner.gif

Filesize
44KB

MD5
324f8384507560259aaa182eb0c7f94a

SHA1
3b86304767e541ddb32fdda2e9996d8dbeca16ed

SHA256
f48c4f9c5fc87e8d7679948439544a97f1539b423860e7c7470bd9b563aceab5

SHA512
cc1b61df496cfb7c51d268139c6853d05bace6f733bc13c757c87cd64a11933c3a673b97fba778e515a9ff5f8c4ea52e7091f3beda1d8452bc3f6b59382f300d

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\temp.bat

Filesize
16B

MD5
683678b879bd775b775240fcb1cd495e

SHA1
10bc596b3d03e1ba328068305c8acee2745c731c

SHA256
64f28aef02c7fafbc9d80735a8b1d607c3996a2ddf9ba260d4c433c002efeaba

SHA512
3b2b9d231643a826183732a79489c6d2f4749ce25314c444364062c781627af59b572c082d811ae57a839cae94de77cf03eb81d99e1063e2191e884ccbaa0963

Download Submit
C:\Users\Admin\Desktop\lol_5cc7c04c-94f2-4372-81fa-09fb1d98e75e\web.htm

Filesize
176B

MD5
1fab717c517da1c27e82a93edddf9390

SHA1
24b6cfda27c15c1d01ba5718106c18687ed77397

SHA256
bd035700f060a35c394600cabf0cf04c031927786c97cf41c55d78dddeffa11c

SHA512
5452938fa310396ecacae8eab64bdae624f617e19c0d742e10e088befb686c205b8db9ccec7d9de1c9360f341db8a701d5b8c6c4eb20aaa1c2deb831ab09fab5

Download Submit
C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

Filesize
512KB

MD5
2cf0ecce92b0d62cb538c092ef604707

SHA1
c3984e38c819b083ecade98b85a78b0cdb753b5d

SHA256
c94699b41f7a74dea01a34c3eb635e4a3b796483748b7b640dcd70b8d47c3a35

SHA512
810cdd9f5dbaf03beb6047451482d5eecd740fcc675c2c8220d219b5695765b480d813bcf0355c71957636190043e0c3b5808631952acc79d57e9dede99f1c61

Download Submit
C:\Windows\SysWOW64\eadxtpnatuglo.exe

Filesize
512KB

MD5
3af8e6290c86f6815050df476d5c9eb8

SHA1
7c9838a25ca3a42045a04f3862665ef7d4755f6f

SHA256
fc02c4be0c82d0a044399856db85cac15ae8c622b500d00f4a54b1df25f03381

SHA512
07f8a7059cc6510f8a290a7f6c8394182d8ed5f2b6bfdf622c30138c699a83775080984e1ff05ef6261bb5c14fc607dedafc8fe0c8c8ed2e58fdaa0b4b7a0e06

Download Submit
C:\Windows\SysWOW64\hdiakkmj.exe

Filesize
512KB

MD5
1eb99e206739554890362505360347a7

SHA1
cb1df651270a8fa43cc5d6a4324d1478edd928e1

SHA256
c49f7299a09c37de85f3553259a32413657231aebd5c202c75886595e78083cf

SHA512
f21a53f8f797fac3ef687c37ea4b3e7433ef95af24987542000d837d3b38e1ffb87bfe2dc7a20f3c7e4bb70579818d164774ab0857c27da9dd71b910040b2cbe

Download Submit
C:\Windows\SysWOW64\hpbxrrwufi.exe

Filesize
512KB

MD5
8d2e584ac111296099b50a7ca51b10e2

SHA1
4b2bc6b72012e7fb246893f0c34e396095a8c2e4

SHA256
a2161c07a65c57283c99bea37f35c33ceaba642f99cbfe10d98d5dc076f9c563

SHA512
750277902d9f3b391ad4de536ca22ef81b0ac49a299d00ce5b3ed6051b4a751379521b216215c63e08336325a4df88244fd0fb11850c74780848337d5ca7dba0

Download Submit
C:\Windows\SysWOW64\ofvjxpjtrvopbow.exe

Filesize
512KB

MD5
ea6029702a954292a49b30f18c9fd427

SHA1
563098700302cbfef23c2b80cc299c48ea04d832

SHA256
6b5fc1a1e1627d22c38ee593a46602efdfdd4b95e113f766dc8e4cb9a9656ca3

SHA512
426e1e0da83d9b7b7983dd04c009ffcd691da91b8894da0790f627b5e23c638ba581093b2b5f6de74fa8446eaf58beb76e7161f2e9af97e3da3840f570d37df1

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

Filesize
512KB

MD5
6fea53ca24733e4697e6c70ecaf7de83

SHA1
b4aec844b79b081c092c5d2b14ef736d5babe4b5

SHA256
2765d085cc5f9046d1aeb3a0fb9483686ab9ab11fc96d666cc361c02b3b74514

SHA512
cc02928e08a0ba0ac7b9b4cf89054621533593c2bf5c870a6f7e92be3305a8aaab8c91b22822140f78e101040fb653a332279688b2259680afdb90c8b60d0df8

Download Submit
memory/220-163-0x00000270E8B40000-0x00000270E8B42000-memory.dmp

Filesize
8KB

Download
memory/220-167-0x00000270E8B80000-0x00000270E8B82000-memory.dmp

Filesize
8KB

Download
memory/220-165-0x00000270E8B60000-0x00000270E8B62000-memory.dmp

Filesize
8KB

Download
memory/220-161-0x00000270E8B20000-0x00000270E8B22000-memory.dmp

Filesize
8KB

Download
memory/1720-28-0x00007FF8BC5B0000-0x00007FF8BCF50000-memory.dmp

Filesize
9.6MB

Download
memory/1720-495-0x00007FF8BC5B0000-0x00007FF8BCF50000-memory.dmp

Filesize
9.6MB

Download
memory/1720-23-0x00007FF8BC865000-0x00007FF8BC866000-memory.dmp

Filesize
4KB

Download
memory/1720-24-0x00007FF8BC5B0000-0x00007FF8BCF50000-memory.dmp

Filesize
9.6MB

Download
memory/2640-88-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/3288-50-0x0000024D74D30000-0x0000024D74D40000-memory.dmp

Filesize
64KB

Download
memory/3288-482-0x0000024D73DF0000-0x0000024D73DF1000-memory.dmp

Filesize
4KB

Download
memory/3288-486-0x0000024D721D0000-0x0000024D721D1000-memory.dmp

Filesize
4KB

Download
memory/3288-479-0x0000024D79120000-0x0000024D79122000-memory.dmp

Filesize
8KB

Download
memory/3288-68-0x0000024D721E0000-0x0000024D721E2000-memory.dmp

Filesize
8KB

Download
memory/3288-33-0x0000024D74C20000-0x0000024D74C30000-memory.dmp

Filesize
64KB

Download
memory/3336-97-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/3608-490-0x000000007343E000-0x000000007343F000-memory.dmp

Filesize
4KB

Download
memory/3608-503-0x0000000073430000-0x0000000073B1E000-memory.dmp

Filesize
6.9MB

Download
memory/3608-3-0x0000000073430000-0x0000000073B1E000-memory.dmp

Filesize
6.9MB

Download
memory/3608-4-0x0000000005880000-0x0000000005D7E000-memory.dmp

Filesize
5.0MB

Download
memory/3608-1-0x00000000009D0000-0x0000000000A5C000-memory.dmp

Filesize
560KB

Download
memory/3608-0-0x000000007343E000-0x000000007343F000-memory.dmp

Filesize
4KB

Download
memory/3608-2-0x00000000051A0000-0x00000000051C4000-memory.dmp

Filesize
144KB

Download
memory/4040-461-0x00007FF8982B0000-0x00007FF8982C0000-memory.dmp

Filesize
64KB

Download
memory/4040-156-0x00007FF895760000-0x00007FF895770000-memory.dmp

Filesize
64KB

Download
memory/4040-138-0x00007FF8982B0000-0x00007FF8982C0000-memory.dmp

Filesize
64KB

Download
memory/4040-460-0x00007FF8982B0000-0x00007FF8982C0000-memory.dmp

Filesize
64KB

Download
memory/4040-137-0x00007FF8982B0000-0x00007FF8982C0000-memory.dmp

Filesize
64KB

Download
memory/4040-140-0x00007FF8982B0000-0x00007FF8982C0000-memory.dmp

Filesize
64KB

Download
memory/4040-152-0x00007FF895760000-0x00007FF895770000-memory.dmp

Filesize
64KB

Download
memory/4040-139-0x00007FF8982B0000-0x00007FF8982C0000-memory.dmp

Filesize
64KB

Download
memory/4040-459-0x00007FF8982B0000-0x00007FF8982C0000-memory.dmp

Filesize
64KB

Download
memory/4040-462-0x00007FF8982B0000-0x00007FF8982C0000-memory.dmp

Filesize
64KB

Download
memory/4844-90-0x0000025A1A780000-0x0000025A1A880000-memory.dmp

Filesize
1024KB

Download
memory/5196-507-0x0000000005C90000-0x0000000005CCE000-memory.dmp

Filesize
248KB

Download
memory/5196-506-0x0000000005C30000-0x0000000005C42000-memory.dmp

Filesize
72KB

Download
memory/5196-502-0x0000000001770000-0x0000000001794000-memory.dmp

Filesize
144KB

Download
memory/5196-501-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Filesize
72KB

Download