hxxp://Google[.]com

Analysis

max time kernel
267s
max time network
269s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://Google.com

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET8A1A.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET8A1A.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET8B34.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxUSBMon.sys	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETA350.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxNetAdp6.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxNetLwf.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxSup.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET8B34.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETA350.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\SETABEC.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETABEC.tmp	MsiExec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
2596	VirtualBox-7.0.18-162988-Win.exe
4236	VirtualBox-7.0.18-162988-Win.exe
5764	VirtualBox.exe
5964	VBoxSVC.exe
5996	VBoxSDS.exe

Loads dropped DLL 42 IoCs

pid	Process
4556	MsiExec.exe
4556	MsiExec.exe
4556	MsiExec.exe
4556	MsiExec.exe
4556	MsiExec.exe
4556	MsiExec.exe
4748	MsiExec.exe
4748	MsiExec.exe
4748	MsiExec.exe
4748	MsiExec.exe
3320	MsiExec.exe
4748	MsiExec.exe
4748	MsiExec.exe
1732	MsiExec.exe
1732	MsiExec.exe
1732	MsiExec.exe
1732	MsiExec.exe
1732	MsiExec.exe
1732	MsiExec.exe
1732	MsiExec.exe
1732	MsiExec.exe
1732	MsiExec.exe
4748	MsiExec.exe
4748	MsiExec.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5764	VirtualBox.exe
5964	VBoxSVC.exe
5964	VBoxSVC.exe
5996	VBoxSDS.exe
5996	VBoxSDS.exe
5964	VBoxSVC.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\P:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\R:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\N:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\V:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\X:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\Z:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\G:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\W:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\U:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\S:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\T:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\J:	VirtualBox-7.0.18-162988-Win.exe
File opened (read-only)	\??\O:	VirtualBox-7.0.18-162988-Win.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\SET8BE1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\SETA219.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\netpacer.PNF	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxSup_C1568B0197F11F03068219F1FC3418496EA5F1E1\VBoxSup.cat	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\SET8BE0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\VBoxUSB.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\SET8BE2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\VBoxUSB.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\VBoxNetAdp6.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_c7737e90db5729fb\vboxnetlwf.PNF	MsiExec.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\VirtualBox\VBoxSDS.log	VBoxSDS.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\SETA218.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_108aa80dcbfa6952\VBoxNetAdp6.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\VBoxNetLwf.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_c7737e90db5729fb\VBoxNetLwf.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\c_netservice.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_c50c384d0cbfb450\VBoxUSB.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\SETA96A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\VBoxUSB.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_c50c384d0cbfb450\VBoxUSB.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\SETA96B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\VBoxNetAdp6.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\SETA96A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_c7737e90db5729fb\VBoxNetLwf.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxSup_C1568B0197F11F03068219F1FC3418496EA5F1E1\VBoxSup.inf	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxUSBMon_76C300885A3BEF8EB122594DD2B3D02A309D39C3\VBoxUSBMon.inf	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\SET8BE2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\VBoxNetAdp6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\VBoxNetLwf.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\netserv.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\SET8BE1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\VBoxNetLwf.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\SETA96B.tmp	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxUSBMon_76C300885A3BEF8EB122594DD2B3D02A309D39C3\VBoxUSBMon.sys	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_c50c384d0cbfb450\VBoxUSB.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\SETA1F8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\SETA218.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\SETA219.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRVSTORE\VBoxSup_C1568B0197F11F03068219F1FC3418496EA5F1E1\VBoxSup.inf	MsiExec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\SETA97C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ndiscap.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\SET8BE0.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRVSTORE	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vboxusb.inf_amd64_c50c384d0cbfb450\VBoxUSB.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_108aa80dcbfa6952\VBoxNetAdp6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetlwf.inf_amd64_c7737e90db5729fb\VBoxNetLwf.inf	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\VBoxUSBMon_76C300885A3BEF8EB122594DD2B3D02A309D39C3\VBoxUSBMon.cat	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxnetadp6.inf_amd64_108aa80dcbfa6952\VBoxNetAdp6.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\SETA97C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\netvwififlt.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\netrass.PNF	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxSup_C1568B0197F11F03068219F1FC3418496EA5F1E1\VBoxSup.sys	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxHeadless.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ka.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox_150px.png	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_bg.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_da.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuth.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxHostChannel.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_lt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol9_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UserManual.qhc	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDD.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ca.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel4_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\doc\UserManual.pdf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_eu.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxVMM.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fa.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ka.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_postinstall.cmd	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5SqlVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_CN.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qminimal.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_da.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAutostartSvc.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxTestOGL.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\os2_cid_install.cmd	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxC.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\fedora_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_fa.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\os2_util.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll	msiexec.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File created	C:\Windows\INF\oem5.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI7AFC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7431991E-0534-4E1E-89C8-2AF6968C017C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7CE2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8428.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1C6.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIA8DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A50.tmp	msiexec.exe
File created	C:\Windows\INF\oem2.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI8998.tmp	msiexec.exe
File created	C:\Windows\INF\oem3.PNF	MsiExec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\{7431991E-0534-4E1E-89C8-2AF6968C017C}\IconVirtualBox	msiexec.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIAC87.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78C5.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\{7431991E-0534-4E1E-89C8-2AF6968C017C}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5873b4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79D1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A20.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D60.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B10.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B6F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\Installer\e5873b4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIADA2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA8BD.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\e5873b6.msi	msiexec.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIADD1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83E9.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003f3ccc8c3b3921e10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003f3ccc8c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003f3ccc8c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3f3ccc8c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003f3ccc8c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	MsiExec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28935887-782B-4C94-8410-CE557B9CFE44}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67099191-32E7-4F6C-85EE-422304C71B90}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{755E6BDF-1640-41F9-BD74-3EF5FD653250}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81314D14-FD1C-411A-95C5-E9BB1414E632}\NumMethods\ = "23"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1BCC6D5-7966-481D-AB0B-D0ED73E28135}\ = "IVirtualBoxErrorInfo"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E4B301A9-5F86-4D65-AD1B-87CA284FB1C8}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{431685DA-3618-4EBC-B038-833BA829B4B2}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9DB3A9E6-7F29-4AAE-A627-5A282C83092C}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF5BEFC3-4BA3-7903-2AA4-43988BA11554}\NumMethods\ = "23"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E8F79A21-1207-4179-94CF-CA250036308F}\NumMethods	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81314d14-fd1c-411a-95c5-e9bb1414e632}	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21637B0E-34B8-42D3-ACFB-7E96DAF77C22}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{92ED7B1A-0D96-40ED-AE46-A564D484325E}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E2E0C3-332C-4D72-B822-2DB16E2CB31B}\TypeLib	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{081FC833-C6FA-430E-6020-6A505D086387}\ = "IFsObjInfo"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{6DC83C2C-81A9-4005-9D52-FC45A78BF3F5}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{67C50AFE-3E78-11E9-B25E-7768F80C0E07}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A338ED20-58D9-43AE-8B03-C1FD7088EF15}\NumMethods	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{431685DA-3618-4EBC-B038-833BA829B4B2}\NumMethods\ = "33"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{cc830458-4974-a19c-4dc6-cc98c2269626}	VirtualBox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A338ED20-58D9-43AE-8B03-C1FD7088EF15}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D947ADF5-4022-DC80-5535-6FB116815604}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FF5BEFC3-4BA3-7903-2AA4-43988BA11554}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14C2DB8A-3EE4-11E9-B872-CB9447AAD965}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5587D0F6-A227-4F23-8278-2F675EEA1BB2}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B55CF856-1F8B-4692-ABB4-462429FAE5E9}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{CAC21692-7997-4595-A731-3A509DB604E5}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8E3496E-735F-4FDE-8A54-427D49409B5F}\ProxyStubClsid32	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5BFD8965-B81B-469F-8649-F717CE97A5D5}\NumMethods\ = "12"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6AC83D89-6EE7-4E33-8AE6-B257B2E81BE8}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{883DD18B-0721-4CDE-867C-1A82ABAF914C}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A85BBA40-1B93-47BB-B125-DEC708C30FC0}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7569351-1750-46F0-936E-BD127D5BC264}\1.3	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA05E40C-CB31-423B-B3B7-A5B19300F40C}\NumMethods	VirtualBox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{081FC833-C6FA-430E-6020-6A505D086387}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{726EACA9-091E-41B4-BCA6-355EFE864107}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2514881B-23D0-430A-A7FF-7ED7F05534BC}\NumMethods\ = "22"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{46735DE7-F4C4-4020-A185-0D2881BCFA8B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D23A9CA3-42DA-C94B-8AEC-21968E08355D}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F05D7E60-1BCF-4218-9807-04E036CC70F1}\TypeLib	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\TypeLib	VirtualBox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{01ADB2D6-AEDF-461C-BE2C-99E91BDAD8A1}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{2405F0E5-6588-40A3-9B0A-68C05BA52C4B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ABEF51AE-1493-49F4-AA03-EFAF106BF086}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{07541941-8079-447A-A33E-47A69C7980DB}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92F21DC0-44DE-1653-B717-2EBF0CA9B664}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ABE94809-2E88-4436-83D7-50F3E64D0503}\ = "IMachineDataChangedEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2DB178A-7485-11EC-AEC4-2FBF90681A84}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D803B4-9B2D-4377-BFE6-9702E881516B}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{00892186-A4AF-4627-B21F-FC561CE4473C}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{22363CFC-07DA-41EC-AC4A-3DD99DB35594}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F7B8A22-C71F-4A36-8E5F-A77D01D76090}\TypeLib	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45587218-4289-EF4E-8E6A-E5B07816B631}\NumMethods	VirtualBox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{714A3EEF-799A-4489-86CD-FE8E45B2FF8E}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B14290AD-CD54-400C-B858-797BCB82570E}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7c5e945f-2354-4267-883f-2f417d216519}	VirtualBox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{AAC6C7CB-A371-4C58-AB51-0616896B2F2C}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0CA2ADBA-8F30-401B-A8CD-FE31DBE839C0}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B0A0904D-2F05-4D28-855F-488F96BAD2B2}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B55CF856-1F8B-4692-ABB4-462429FAE5E9}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E28E227A-F231-11EA-9641-9B500C6D5365}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70401EEF-C8E9-466B-9660-45CB3E9979E4}\TypeLib	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{890ED3DC-CC19-43FA-8EBF-BAECB6B9EC87}\ProxyStubClsid32	VirtualBox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9128800F-762E-4120-871C-A2014234A607}\ProxyStubClsid32	VirtualBox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 972915.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5764	VirtualBox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
3212	msedge.exe
3212	msedge.exe
1668	identity_helper.exe
1668	identity_helper.exe
3920	msedge.exe
3920	msedge.exe
2480	msedge.exe
2480	msedge.exe
468	msiexec.exe
468	msiexec.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5764	VirtualBox.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 56 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeIncreaseQuotaPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSecurityPrivilege	468	msiexec.exe
Token: SeCreateTokenPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeAssignPrimaryTokenPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeLockMemoryPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeIncreaseQuotaPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeMachineAccountPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeTcbPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSecurityPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeTakeOwnershipPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeLoadDriverPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSystemProfilePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSystemtimePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeProfSingleProcessPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeIncBasePriorityPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeCreatePagefilePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeCreatePermanentPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeBackupPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeRestorePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeShutdownPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeDebugPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeAuditPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSystemEnvironmentPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeChangeNotifyPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeRemoteShutdownPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeUndockPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSyncAgentPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeEnableDelegationPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeManageVolumePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeImpersonatePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeCreateGlobalPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeCreateTokenPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeAssignPrimaryTokenPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeLockMemoryPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeIncreaseQuotaPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeMachineAccountPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeTcbPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSecurityPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeTakeOwnershipPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeLoadDriverPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSystemProfilePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSystemtimePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeProfSingleProcessPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeIncBasePriorityPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeCreatePagefilePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeCreatePermanentPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeBackupPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeRestorePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeShutdownPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeDebugPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeAuditPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSystemEnvironmentPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeChangeNotifyPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeRemoteShutdownPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeUndockPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeSyncAgentPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeEnableDelegationPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeManageVolumePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeImpersonatePrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeCreateGlobalPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeCreateTokenPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeAssignPrimaryTokenPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe
Token: SeLockMemoryPrivilege	2596	VirtualBox-7.0.18-162988-Win.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
2596	VirtualBox-7.0.18-162988-Win.exe
2596	VirtualBox-7.0.18-162988-Win.exe
5764	VirtualBox.exe
2596	VirtualBox-7.0.18-162988-Win.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5764	VirtualBox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3568	3212	msedge.exe	80
PID 3212 wrote to memory of 3568	3212	msedge.exe	80
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 2044	3212	msedge.exe	81
PID 3212 wrote to memory of 4136	3212	msedge.exe	82
PID 3212 wrote to memory of 4136	3212	msedge.exe	82
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83
PID 3212 wrote to memory of 2232	3212	msedge.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Google.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4048 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Users\Admin\Downloads\VirtualBox-7.0.18-162988-Win.exe
  "C:\Users\Admin\Downloads\VirtualBox-7.0.18-162988-Win.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2596
- - C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
    "C:\Program Files\Oracle\VirtualBox\VirtualBox.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5764
- C:\Users\Admin\Downloads\VirtualBox-7.0.18-162988-Win.exe
  "C:\Users\Admin\Downloads\VirtualBox-7.0.18-162988-Win.exe"
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8560 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9080 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8984 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9444 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9532 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9744 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10112 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10012 /prefetch:1
  2⤵
  PID:6424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9808 /prefetch:1
  2⤵
  PID:6432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8796 /prefetch:1
  2⤵
  PID:6776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11116 /prefetch:1
  2⤵
  PID:6228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11088 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10720 /prefetch:1
  2⤵
  PID:6580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11116 /prefetch:1
  2⤵
  PID:6424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8788 /prefetch:1
  2⤵
  PID:6648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9908 /prefetch:1
  2⤵
  PID:6664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9324 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11340 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11516 /prefetch:1
  2⤵
  PID:7024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11592 /prefetch:1
  2⤵
  PID:7120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10452 /prefetch:1
  2⤵
  PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3100059848345494643,14699700216811554142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11256 /prefetch:1
  2⤵
  PID:6992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 47CD3C2C12E743B4886E83DCCA267F38 C
  2⤵
  - Loads dropped DLL
  PID:4556
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1756
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 089B2105E1E8D8CBD12D282128235E6E
  2⤵
  - Loads dropped DLL
  PID:4748
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E110FA6565CBAA2EB91A9168D5E4864F
  2⤵
  - Loads dropped DLL
  PID:3320
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 69BE0BE9DBA10A659C8C45F255F0B717 E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7C56EA230725D5187E346801D08CFDFA M Global\MSI0000
  2⤵
  - Modifies registry class
  PID:3904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2724
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.inf" "9" "48f6bcb47" "0000000000000144" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2384
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf" "9" "473b17b7b" "0000000000000160" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4628
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf" "9" "431e52bcb" "0000000000000158" "WinSta0\Default" "0000000000000184" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3668

C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe
"C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5964

C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe
"C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:5996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5873b5.rbs

Filesize
2.6MB

MD5
3df8a93931a5d83b9455ae723262ff02

SHA1
792420bd2fea40524a36ed80cd58a4bed1406dcd

SHA256
86a01719d3b207c1795dc2911453677da11762accf065d7d728d940861023578

SHA512
5433a04ffd16ce030241fa08c98827d2f5db2c9759b401d2ac383d4cff09f4f56ccfe59377891e04dad23a239b68dc6f52fd1b38794cc9a43153e55a0daebe4e

Download Submit
C:\Program Files\Oracle\VirtualBox\VirtualBox.exe

Filesize
2.5MB

MD5
798dda25ae933ec87d20974df6b998c7

SHA1
28f97c07cb49b679ca71d415067987f339097631

SHA256
6c7420e68eb52e3d998b953b1c004496878bf151a147dc66e2211c8ec29599b5

SHA512
e8ba3d3db8f19be0417057294cbc4526d5af064171c0ffd9fde5b9ab2c81af830101a9753c18a3ead4939daf4c0c91ad2af635d8582c26c276fadb6d36e244f6

Download Submit
C:\Users\Admin\.VirtualBox\VirtualBox.xml

Filesize
1KB

MD5
d9d28bd2ef7192fb0efb99607d7a0807

SHA1
7fb6f32f1c0f227118613dd7779e1bf0a6e2ce4a

SHA256
dad710b076d96b3de34a58363a3241935bfe205b7240ce57f9d85bf2058e6dd5

SHA512
e058987d5fd8ea6cd3c3081c7ac45ce1e3719c4a38b46390133b19539fad35a0d8ad699023a3d934d18e3356cb6def62bd197b5a32ad496b620469c55d9efb13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
9820b546dc5bb8871f19c5dcbf11cecd

SHA1
b810b7e13868a4d07059b44b4817cd73b4c4a393

SHA256
0a6e8358018025d175400edff7a4bf7d38a01d904d44cd1aab9a6240307acb65

SHA512
a8e2cb0b8993899ea549d1770476aa315e771b2ac87b5485a90fd100f8c62f59411b76f1298a0d2d3b77c7d6ab7ed9c162fe2ba6001394b5f39b16e9a79c0713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD

Filesize
727B

MD5
400ce184da2a24f4d02dbdcad98d89ea

SHA1
d84725c896d40a8b74a32766ff0911037ebb8fa4

SHA256
6aa076a131c7451c4ead3906806c22846b61be8cb1bdeca5274d3e22593c2dd4

SHA512
b16982fb4da9c57057a555a880248b9f81ff73b6413839f9f2d55a4d3afaf35cac658595d3ffac491e9214b534f93ca2e9b24156e41e1252b8168671abd4de7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
3b097086fbe6e4f148ff1d9682b03927

SHA1
d25232295e85346cadfa5de6845e118055573f36

SHA256
a6cfc81d9cfab767ee16a0e57de7b750285d6c1e7b5cbfd0c2a0d3c7587abdc7

SHA512
4f3d7ccdfc4e783887732ded17610138a25918ffa7299bb892c3a3c858bd92d9af3daf7ffcee33c6bad696a475fbf8441499652c828360c7a0091d57207bbf52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
b37d1ec4efef1f1d6d0913d898394c64

SHA1
02d05259a004707e0f678509673e5aee73bd07a0

SHA256
4c4a88a95a90689ba2659a69c3ba63fb31373b427b0e4d468be1e8732e209f0a

SHA512
42820d91ee7f405558a72594f51e683c8d805c4c3c906425da26dc12318dcd18cb90bb66bf2f5fc4f53ccc5d3bc2d83a784436a505ced22f4f26c9f870fdd161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD

Filesize
412B

MD5
e83b91bffd12d7a973e94fd47650ed0b

SHA1
81fa772695977bb3165ff0b28f4b748744b3ebde

SHA256
7787ab3f861d81ec23f20caf22382cdb3afac6420f9557f2fa73bceafd1c5f98

SHA512
498e8051609915284c74dbd3bfab48fae26dbbd9cee4a94c9e66e1effa1effebb8a9bdfef1459d74d2ff747b584f03af1a265e29048c951faac19284cd400c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
31dacdb01daa31c580a71c3baf924a07

SHA1
d9e068b526c9be1aef21bd63b4b9e0b1600a9cac

SHA256
b5c1b7323d1c2705431a44b3f6c13c6af47bdebe84e2fdc7c092fa657f905939

SHA512
f44fec964e8ef1d79670eeec1be961c2c08be74edb476aef22e48f317d563409e6e100c37a54ef20ebafc3940d4499d1915823c1f0f1d5fc306f303b999ab50a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
41KB

MD5
b15016a51bd29539b8dcbb0ce3c70a1b

SHA1
4eab6d31dea4a783aae6cabe29babe070bd6f6f0

SHA256
e72c68736ce86ec9e3785a89f0d547b4993d5a2522a33104eeb7954eff7f488a

SHA512
1c74e4d2895651b9ab86158396bcce27a04acfb5655a32a28c37ee0ebd66cd044c3c895db7e14acc41a93db55463310425c188a7c503f0308ce894cf93df219f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
67KB

MD5
9e3f75f0eac6a6d237054f7b98301754

SHA1
80a6cb454163c3c11449e3988ad04d6ad6d2b432

SHA256
33a84dec02c65acb6918a1ae82afa05664ee27ad2f07760e8b008636510fd5bf

SHA512
5cea53f27a4fdbd32355235c90ce3d9b39f550a1b070574cbc4ea892e9901ab0acace0f8eeb5814515ca6ff2970bc3cc0559a0c87075ac4bb3251bc8eaee6236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
1.2MB

MD5
874b361adbc012383cb85dec3b1eec7f

SHA1
d2369916a35e5560153057934ab928ed37d60b20

SHA256
2a3e989c7a1b8eb9050f30eedfe0f099768aef2396306a221bab2ea4dc680e6b

SHA512
f724c8416960f616ed616ac814d146f68affc09d903ee3fad0c48af2749efebf22d2963196fd72f587b9afe985e2275f2dbab83e1c5ce35d7d6e80a8ce96140f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
33KB

MD5
d2c299586fe5d9ba67694f9721a4d1cf

SHA1
72d4d8c3f08034c3c14a4bf04b51854b38ae970d

SHA256
a245918f09af8647f24313833134d3ddbfe2a282aaf34a06216b49f6faa73873

SHA512
47315588220ec8ca7d10ac83c7e2eac41f5788b49299e8bd06549b21641e1c8333f2f1c19a17722987ebd563d2abd1a82985184b00aee283b3b75d4bc38210e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
261KB

MD5
f52acfd2430b4cedd65f99b8f21b1676

SHA1
64f019049e45aac47706cc33d90b9058154512ff

SHA256
7eaf4f599cd97991a9e108bfa9abd1536ce11b8a31c4a056590d359966956a64

SHA512
03ef4223b349ff52fc162fe024da0a0c25db8fe0e31c37a79ceb1f7ea0ad252c0c90bf2f971060d2686f61a00c495a4a96fbe44cf6c7c2f8596b71c959c93bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000072

Filesize
250KB

MD5
9a23e02c51224896115a872ee5f62800

SHA1
447ac79a43947ca2519a6a9e4d63333c81156c06

SHA256
f6acbc67934394aa13122f6cb281e96a0765dca464725108b63b046da126831b

SHA512
9d1e4546a4ced1959212bd1c0f0f8f8a09e6d69b85db5d9cd0172c614745c46143b269ac9a47253fadccfd5834f2db03d35398db16419607b4e749fbd8938321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e98c4c1271cf5686_0

Filesize
38KB

MD5
3c3a31e906c4236339d81b4abd408847

SHA1
cee418a6ceac3db13e675667c965766ae6bd55c0

SHA256
8209b51b9db42a902f4c5d5fabd90f20e2717cc3ed1174cc80f9d015c2432675

SHA512
75b572f335829c3a697c4f91f2408f7d18f26ce17c5a0c973bf78fd753ac6a2c0747757f24151876ed4324fc048defba7e527c92de46d89a4a046d94fcdb386d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
34130768a98cf7da94bed5e348532e99

SHA1
9a50ec7608fc17415867fa6a7d09829af92c3e99

SHA256
413edfa62eea9b66c3ccdb31a71c986046b81dbdafee45f773b08a57fdc5ba9c

SHA512
bc6330a6dcc64cd14a8cdccb64b368653c7acf441f925f42b90e6130f3de5101e5af0d7fcf5178f1b5de41b20a24f2b037739e02e02e2d59c24efb543312b991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
c39b5e7f4c7ff085aca923edf5c20b3e

SHA1
fcfbb7cafe635942f972d46d53923b636b32b43a

SHA256
98634c180b6c580011b14add3b299116b1197a49a09155906b80274dc630bf5f

SHA512
1900f030e36b961e13cb3d58912a7badd267261be14abc6eecb32d10e7a7e040890aa4c489b07784d71d1d7ecb6be10357193add5f1111144be5ce70dbc2c44b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
812a42b1f7f7d2840ee85c419a1bf894

SHA1
23341424f743a33b4918250dbf0acfca27628f19

SHA256
ed7d0089bba915e77fd7e70f4f509df177baf04141e423dca23527f96dea5002

SHA512
013cf9c692b0db8363e5dba36cbb35630718fc2acec64b4a503f5bf04abd87a02e1712474356c1e0e730fb3b404fc507e3615c175d258a01ac5ea41be2954911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
2a5555a661d492ebfa62e09fb09bbfd4

SHA1
2bb98895f58ce0e7c875d9087deb3330a03f95db

SHA256
abae06cc2fea55309e04017668a8b910879a0249dde227d8b6b9ec45611e1ad4

SHA512
acd24e21f75bac6432fb98c1504469be2ab760ad3c91fe44845a0a6303aa9534950b3ac79c2b6945affd68546250d3e928c1b799a1ea4e0551c1d9bcfbb2c9c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4a99f0c24f003561fc922416194ba632

SHA1
f09dc75710ac8f5963b0e2e28cfc43994e25be91

SHA256
368c8df3db2ad02635f4fff389a30ee0ac7d5bf4d5ab54c198d6eaee0503e2cb

SHA512
aabf9e1d727ac2341e12e2f1a9d1557dc836494aa772081b91a60de613a0dcbc1c1df7dc71bc3e2653a9e7295cea013e26a65f4c3395ab575e59d54b090ac3ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1f89d364e3c353baf48633f6aa405264

SHA1
ea53e1e889a292160c8cc363949003c2642ff933

SHA256
59d116b9604dd3fb150ef0b9a24e697ce95b402d0150154342be90a60ee9b22b

SHA512
79d6057522e2ef2b78b35cea99c56050da4ed145cba38d17488bb557b5eb2902e2b279cac490e6a5941268aa989c986ccaa499396a57ed890ca0dcea8a53acfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cd1be41b4166f955355b3d58663cdbef

SHA1
eb99368e5c498befcb2f7d169e86c4735fde6efc

SHA256
ac68eb048be119308983a62c4b1b65878c2080214583b0176327297ebbc49e23

SHA512
5ce8f1deaf28f892af3cf4fa741f4264a02a28b87569f20c65d20246d39d79dea7ed0fed4031405dcc2b61c19591a5e60fb9717ef3695b19824c7ee3edfcb986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
99d8a855d1ddd34541230d20bf993331

SHA1
45255ec5e7561f1d3a382a5935564f846e8a4ec1

SHA256
78eeb9f37cd53bafbed15e777cb417b121303841493816b3cfb8527eebe39414

SHA512
23eeccaf5e527ad2ae2141f60cdb2f1efc57e64492cadd5af27cab420117de24349f4c67898e6ed94ba55616511dd49feb636694ab9986b44d1d1bc7a65a9433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7b65086fc34ed5355716005d889e4bb8

SHA1
fba5e400c295666b68e41439ecafc0e77e35b9d2

SHA256
c720a3f7bc2180b1a113d3280c7fe5ecf020f724fc50e598af840b92a3df9abe

SHA512
674589c06edd7ae2a4e7d54e464a3ab37da364c825bf419b9010394e88220b4c9aa1e224986f6c314505469a4674c5addec0148599d7fba8958d768c171c2f3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d1b4cb59dba26a76b56938d5201b3395

SHA1
3c8f4edd58bacfa34ce154207dd38630b0a5e175

SHA256
22aebfdf281d29de027ce837ad2ecf995c4bb56784af1c24660e155aa0f7784e

SHA512
445e0ead6c2f94af8ea5ed30a6bcb7ed87efdd27ba4f8acdaa5bd363ee5fa2a551a7050152f8d962c16abdc78f68accab627c3c98f72427a43d9e417696f4aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7268cade27106b04b540e797d5d8a79f

SHA1
a2698eccd5320779dbe3fa78226304ac32a2054b

SHA256
c575e7627ba6b34f93439db75792a5283add70d11a451fc65fd096a030895e8f

SHA512
2a4e48fca44854c96d26a3d30f3a797dbaf7bf50f592c750ce8eed52c15dc77d4f65ae2f6bda3e38168be990b28e8290a3f9a31c7bdc96004ed276a44dfe6e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2c77cca83405e99384fcdf376db7f812

SHA1
cc7e6482c9bf9888f0bd3bdfe04583b1ca8594e8

SHA256
26b13231851ca0892ab69928bf1ebbd54a579fee7de3c162ab8556e2ee19da4e

SHA512
e9bb8f24514d26fd0c954e3c78f367e37d0fad0fefa7ceabb8d85aeea148adc650547e2a9a14e068eff2d10e5b12f8a487ec4c89aef1ed7ad0e31e491e541298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dd3f5613755dc53966a799341ff35486

SHA1
84567f9431b5b9f6303b27e7d661cd471ccc2aef

SHA256
8f22ed6975623efbb287d76779f54fc5ac32ca2ae42208b0783c6690a1fbf7fc

SHA512
eaee0cab05938cbaf2d6fb70a43220ccef95136588f8117e468740be2a91495b939fe72961185c4dcb821cfc343e6183192ad04895c11b004f6b5e00198e9367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
52787246e77ae1bddb7bad93c81ea8c1

SHA1
07f84b63baa60914931066d1ac7d7744fc5d2007

SHA256
cd563f541b7423883b91540295d5a4dade13c9eee344ab5fbaa8eaa97260df9d

SHA512
c2d606fa6d1e403f49e28a844c03e4c2d56f2f27e1b9936def448744a6e34811f788a2bdf57848a2c174fffc36b7918209988114156f64413f00e09f7d06e057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
568645801793000425eef8aa2fd28dfe

SHA1
b912e439628c24b485be4be43108f0a068c97992

SHA256
35cc1f2e9bdbd43782741a372789977fa228672c155b0e8b791ac196e5cd8ee1

SHA512
1f33217d9f4016ae871c0168cc0120887570cc83885dd8de406836965de4092ace5d05db735c2d491ad88a2314dcfb01b48ec1e561fece8e85674cb71cbef04e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
85680786c669150f953549ca41c1debf

SHA1
917c16177578bd67701f8c913791dbdc2410e822

SHA256
3e6cad8c0e0b8c29f8c553fb3d7a8c830e3e619cf916e44e1bdf6687348d947b

SHA512
1f00a2c909d84f37304ef3d7e32f79427f159f03f3c721fcd207ec00217baae5eee0764728c06cc7be21e03e29e1ea1f60c873de8d09fb59fd85d08548dabbf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
6b0d5e18a945391f54dfa43365728b1d

SHA1
dab4d8289d8aadbe5bf515cf910f672d0f8d0b83

SHA256
2888078915c025e0c0e58b3fe4eb20b71b0a83758176a57ed6233242d8dedb2d

SHA512
c7a0da6478d9ed737eea3b27e650fdecab9e898604c4e7444c2407c982ca60827fe7d85017e80478986b8743ac26eeb17c46fc0cd6044b2f3a3967053be49fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
51a96da019f66773466e26076de45b3a

SHA1
051b3426e4db0617970124646cc8ae835c41eae3

SHA256
54f54a210f6bd97bd2b7d48eddcd400827bed70ec3b12474ee7eec793e907fe2

SHA512
2fc336106fbbc6e4371dc49c00503271708475ef9c52a5f740de35f49f2b835e0e02645b7862560992f5757a7c4e4cd48ab4d822bde68568d641a6f991e86a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
17fcb0e2a13aef23a1bba484ca953987

SHA1
106aef33c5b35bba254e13e4cc63f6851db0cdb2

SHA256
39b6218794f0cd2b10a291eb3b34f69eb1903448915fe16d413abf5d05e7535c

SHA512
6d0ef42a9892115887e36a58dac575db539b58a238fe15c651403f6215cb7d433685f4852d66b52f6bc4c72c019ace4e5008046c6f7e72f6881112b4768d5484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c8595174620a8c9c09705609579f4f20

SHA1
8a4e75b9917112f2e9e6d68b3910fad451ce569c

SHA256
8be7689086987b6f2215b9c9186e5146f945b73f65e317241941c9393f018fbc

SHA512
18ae0736569702b952a0ec2326e60ba427c76c5a65ca3a0e9acc24e9d46958e176f7e95a2a58c674b43c8117d35881465d0ed573645f69f6abb9fd21188e91be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
7b26e4efe155428bb90dc16c96854c5f

SHA1
97870bdaa7516e5afbced8bc62d3a6f211981a97

SHA256
dd15e951af1ad14961bcaf025c623babee96a85a3d3a2cb873213777edecfdd6

SHA512
76be2ecf4603abb04748a191e527de01db343338ba7e855e80bfa24e9346a2d5bd003ea0a35811575b2e456dca0bb9bb6af77fdb5ffaae44584fca804b4a66a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
27dabc30a714adf23b17174fd40eaf5c

SHA1
67b6ee459209f2c11fdee3febc39f04ba08711d2

SHA256
565208c5f6a009f68d3336c918a3a8414eeccd139b849a63e1ebef80a7b0e8cb

SHA512
eff95ff7e7c3f974927d735159204f8f537ebf095adb5498c060426b98727ce3e9b6a4d567f133af5a444418d067b5b59d3a1c2f3be4ed875bfa2f5bc312ca4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3d40c22037487af64bd96e18e22924c2

SHA1
ef63c4a07d4b1925c1c6575b162651a389e1bdd5

SHA256
9fd851af0ee477574f3722e35f5c6cc72a1ac95c9e226f3d1122ae796f50544c

SHA512
99bad085288304c450dc4d81e64bf9c6e98fc9a3bf8be10f671f725f20b0a0bf970d41ee38a71eeea96ff964d333c9358cb90a1733928fdc4682f192c69bf2b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cf56.TMP

Filesize
204B

MD5
909886306611e0690f1df67b6c11f916

SHA1
5fb35b4a94a4562d68c9adc1d94550b62e1176ae

SHA256
be8a54689ad92b895985566cb681a6f539579883be31cc3975dec03f1b51104b

SHA512
11ad69e79f2eeb89acbb09fe5c72123ed21a12ed5dbe018a85e879348792a2d2bb326eaac5598e68cafabf3c54d61d9eb78e760220399d564feff39a97ff1327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
93f916784074c416fcd673478b8dc152

SHA1
5f10cf1be28dd7dfe537a97c7b45804fb7619cbe

SHA256
69eaa55ac3d0bcfaca0e8c55207dab674b16ae34ef554bcaeef168c974dc36f5

SHA512
0d0f43e7e9bdc46378feba81d474c038772aedd83f30f4a19f8a4d6380d50a53e4a74cd369110599fbb907bd20ca0b4333278256fbfff3518bab58dea9e683f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e7fb1e62e914fbf8098477e38386be4b

SHA1
18b3b3ffc22f9841443d71b399e4e9bc0c9aa927

SHA256
58845d9fd65bd3a07f3a7e0ea6511ec13fd03e42cb2cbc0c9b4b4d67642f0693

SHA512
fc8e1f7388e215359763e7513ab24e7085bd616f45969ec0b00d855ee80a55995ff16ee184030387ca460edbb88791b5994360848763229fa4c2f5e21823eef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5c980450a0847f7982d655bbec760ced

SHA1
3ecac8e5b98d0908c10ad10bd83f4fc3141e8c49

SHA256
762dfd976b19063d2c1dc31b44996789165308f1a0ba211e4e4c3c95c890195f

SHA512
42ccca06eeac2979f2cfa7e5bb7d86f75ed6f1d8f5d5287b78e079189c7c08c46ae12d34a2b8559dcf3ab08956e6b1ac12bb7703c5a86d6c8c0ef4a8d0a006b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI2D64.tmp

Filesize
324KB

MD5
d045098c42378ebe26f6da17977551ee

SHA1
80a93acee96419dd9c44d0d15d7518aea21f782a

SHA256
92b89b56400e8d01a813513ef8af685fb23adcaba49d7775853e650266b2f63a

SHA512
9e110110c6ec6aa43e64069744901c955ac90253a036b9837d2e0150c5da97cb8f927db4a36e9f289684c3b91724a4d93aa189a3fde9d06d07d62dd4b8c08a35

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
4aebd14c2eb7309d3862d57c8136dda8

SHA1
4fb85e78a9d3020f727055902d8fab7a7f03885a

SHA256
230c5295df47af05c025bdd29b6eb4c445da4600a8f3b66de46b01b862367d72

SHA512
0586dfdcbb6808e5a1085cf988f47a7af06a1869a1cedddb8c3fc6f0c5a935d545883721f67c9162f10dca4389f799744c26d7aaaf547c7a91bef846447a8c81

Download Submit
C:\Windows\Installer\MSI7A50.tmp

Filesize
234KB

MD5
8edc1557e9fc7f25f89ad384d01bcec4

SHA1
98e64d7f92b8254fe3f258e3238b9e0f033b5a9c

SHA256
78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5

SHA512
d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd

Download Submit
C:\Windows\Installer\MSI7D60.tmp

Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI8B6F.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\System32\DRVSTORE\VBoxSup_C1568B0197F11F03068219F1FC3418496EA5F1E1\VBoxSup.sys

Filesize
1.0MB

MD5
8dc26c500f411c68a1cbd2523fe85dfc

SHA1
c43446b2005130ad83579132c979def6841ff43f

SHA256
5eddb05714b93fcbf3d9dc9210f2e29a7d49d738fecb63f89021a2b17cebc382

SHA512
78974b608dc671eff7f1d7b31435d3bda4bb7897f8dd835b265cbf4d8a5f1367f1f7e09b387d1199046a44797bac5d180f488400a35d2946373b1f9fa576d0a4

Download Submit
C:\Windows\System32\DRVSTORE\VBoxUSBMon_76C300885A3BEF8EB122594DD2B3D02A309D39C3\VBoxUSBMon.sys

Filesize
199KB

MD5
6bc9768cdd545c056faeaa153e73c686

SHA1
8dbfeff04cb7a6a32f3f2a09fbbfaff31dd34792

SHA256
2e19d29e7e6b1d1a9093eb7f0bd2e2825ed08785d6042b90e3748f3d087e59c9

SHA512
7b4e293dd8c1e7cb466d71c5a2b98814ebc973d717e46fcf5e63dcde925d9905fd5ec87f729c1feace5baba74eef9a8a769b47e191df6651d1122432fb8e6739

Download Submit
C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\VBoxNetLwf.cat

Filesize
11KB

MD5
60b2f9f910c1458e203a34fbcf0e1915

SHA1
10f1ea3e3ce1fc54d45d1ee2c9fe56e4a2b5dc1f

SHA256
73eb94e2977c6b32799037de23da54adbd0f61d5c585dd1b65368c863e98fa7c

SHA512
5514903acd301a6d865f37a3b8f8ec90d3b4846e5fc28a1372aa3af5e4201ab8011e1eedf1cf9e88809276bfeeac41b8ab33eea6a5c9b56991451105aae207c4

Download Submit
C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\VBoxNetLwf.inf

Filesize
4KB

MD5
7cf28d3145d8b0f9cdde7f94a8729e03

SHA1
0cc9adc8322fe07ce03dd1e7e91a276a953fbefe

SHA256
2585f5715d6a5ebf1e0ae04f11408bdded6789f677a6c4cc7111cf418a296c85

SHA512
7b234e92235bf2422020da65cfcf9c05a884057e921befeda5c61cf0116e6bc549a06b53cec641e31b07bd378f711ad9911e74f0dece057d2660689438c138f9

Download Submit
C:\Windows\System32\DriverStore\Temp\{0da746a4-fc82-3e4b-8d6c-1fac6615b080}\VBoxNetLwf.sys

Filesize
259KB

MD5
98c5be1edffae7850132d9950e8ed658

SHA1
3a04c50447bc8e8cf4f72fa3a21ac66e952dc19f

SHA256
be8c1e532b226bc5882d62eeed88dfb45a230cf6f78dc65a3ae1de3b142cb171

SHA512
7d1d3209fa2bd2123584ec4776ecb5e5e1ff1b239d5d35532cda0c60f26122faa74b0ab3c7e30ed31efc5ebc0d3a134604e2af4d1c8a72068776f6b71376f498

Download Submit
C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\VBoxNetAdp6.cat

Filesize
11KB

MD5
d8ca5a996bf2d542fc111586aa122cd7

SHA1
002d5343fb1a35283f231d5d6d5f3537602ff94e

SHA256
d2d1296289411c8c469312a9569549ba24f4b2d3d525047fded6b4cd178154af

SHA512
d0e1617f91ebf93488a949d6f8548f0721b66786ef9788e176d5f2aa4daf84e0aeafaad097c22c8dd0f77f560f7cba2f597c7deef13abb0593d337f1d8652cf7

Download Submit
C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\VBoxNetAdp6.inf

Filesize
3KB

MD5
4dee77e6d95b41afa3cf5582706438d7

SHA1
7e6914f9ca78d2b0022f1ba5db083a72165b3cda

SHA256
81ac95d678978f9f82dccebe5887f52a9660a729f564698af7a4253e29032a88

SHA512
7a3cf6a9d64ab9456206a066eb89968d64f9b459e5e7947c6201c25722e6122bfd8f2d24bdc57338db149a81f3e68cc3b3b9ac085059fe4cff1d9674903f1eb7

Download Submit
C:\Windows\System32\DriverStore\Temp\{5bad43c9-5175-7548-88fb-585d3dbbea71}\VBoxNetAdp6.sys

Filesize
248KB

MD5
dd03fbee01f74530584061fe46a3aee5

SHA1
49177c7d906c66b322499eaef9b26a0ba36e060e

SHA256
44f9d678b6018602bf200772ac5588c2003ae9f413a5a5ef53fb73a70f0fe0be

SHA512
4cf701d356a9ae529618e69fc1d9ae518dd20a2d3469f90d5b379f84b748dff4703ddc56e5c9bcc7f44f201bcc422b761b7313e09399f52ec0d2614e5e996dad

Download Submit
C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\VBoxUSB.cat

Filesize
11KB

MD5
e01c0f59ee96483ee31dd70fb1218795

SHA1
4dc98fcfa6dffdcc9fdb9733b58a0cfbb0957e39

SHA256
775427086b53136855c0d6b65bf32412a06c92155e67351033cc4ff8be565d49

SHA512
2ac8c7363fa40f5c2dc4e1e69905670ec890506b2cac7ba6b8ecfd1ed0b7abb65d252c3c2982c829393e3dea1712b5a2cf2dc728d49c36ebedc431f0eaca1a3d

Download Submit
C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\VBoxUSB.inf

Filesize
2KB

MD5
35806a0ffff129546450cdcaffafc06b

SHA1
11251df1fbe7ab027059768154077eb985cca790

SHA256
66a137a1a716e2d673666e74074b69b6f68f46072b359b4c17fee5055a3b98f3

SHA512
ac3d4a434b75b22d3334c9e7c6dd2be51e55d5439c78b8e05c83ce84da78016d111a95f3890f950de57431b03cfc136fce7563ef7931b3e1724ada6f19defc4d

Download Submit
C:\Windows\System32\DriverStore\Temp\{75017211-1c06-994e-81de-54b563c529a1}\VBoxUSB.sys

Filesize
184KB

MD5
1f50fa5bf6487796d2913e78ed8cb8b0

SHA1
8be143b0a7d6963e9ab911cfba9d3e4ec508f368

SHA256
d38854405d1b7e9602bc288e2db9b8492d82f14410b44f655f5505ba9e41aa90

SHA512
bfebbd90662901ea80a2f7eff4446c02bd0549f823b310908fc4e2e11b8cc370fc70a0da6945aa4335de81d61dd95980cd3a7bd58acdd06b015d5b4e163c6a29

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
19KB

MD5
d94748cf4c4f9d8b7725e57c4c9c32eb

SHA1
73d9a0588ec1d9ec4696b8dc186f878c46e40ff4

SHA256
b63f1109101497fa01d627969a44b3d77808f5c2ad56002d4694aaa4be9588b3

SHA512
fc4c0f91e520e52ea5a936a49f47a91daf0736f643b3530781d042f388abd95e16210f89c8a908d5e88e569a1efe18ea86b91d47dcea425943fd86d62b6414e1

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
ac471340094de2b72078ea6cda6c2115

SHA1
f6d1f7d0265697357da64b46e0c2e6b05748bbf8

SHA256
77b56cb816101c27e4a9652468b53f6359134187af5e0372fbfafcd7637a84c4

SHA512
64b156e7eac019cbc2cb8bdc14df66e75b5d5781f2b7bb98c999ecb2faf87b44b7fb208fc5de21c2abbbf1a0c6b16620b9fd16b2db74cff0a8cbbd0c23ea4b12

Download Submit
\??\Volume{8ccc3c3f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{84defe71-ee06-477b-b928-217bd9a24815}_OnDiskSnapshotProp

Filesize
6KB

MD5
34173f24b3b1089a6e0e49757bd17815

SHA1
81fb299db0aa0e9f2de3eb072b85f5d6c0a8e684

SHA256
c3ca354972646cc9bfcd961ba49a48cdbe55c03d4f4f17d37a54d8a2791837a0

SHA512
630a8a8c1bc656260c66c8abd7bbba3ee79eec61fb50f1284ef588718aceae4ad2a7951b63f79b0e4582755df3aa2b450192d8f6db154730d83f4efbb65eb54a

Download Submit
memory/468-461-0x000001CA002B0000-0x000001CA00D71000-memory.dmp

Filesize
10.8MB

Download
memory/5764-910-0x00007FF60AF70000-0x00007FF60B1F4000-memory.dmp

Filesize
2.5MB

Download
memory/5764-914-0x00007FF60AF70000-0x00007FF60B1F4000-memory.dmp

Filesize
2.5MB

Download
memory/5764-911-0x00007FFF666C0000-0x00007FFF66C01000-memory.dmp

Filesize
5.3MB

Download
memory/5764-913-0x00007FFF67290000-0x00007FFF68E6E000-memory.dmp

Filesize
27.9MB

Download
memory/5764-912-0x00007FFF67290000-0x00007FFF68E6E000-memory.dmp

Filesize
27.9MB

Download