hxxps://drive[.]google[.]com/file/d/1InO7OmCm3Q4n-DVUXN76btL5vKV6pKP3/view?usp=sharing

Analysis

max time kernel
502s
max time network
504s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
14-07-2024 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1InO7OmCm3Q4n-DVUXN76btL5vKV6pKP3/view?usp=sharing

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2892	Setup.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000200000002aab9-2282.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
6	drive.google.com
136	drive.google.com
1	drive.google.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Soundtoys\Manuals\Tremolator Manual.pdf	Setup.exe
File created	C:\Program Files (x86)\VSTPlugins\SoundToys\Tremolator.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\DevilLocDeluxe.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\LittlePrimalTap.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\Radiator.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\Manuals\Devil-Loc Deluxe Manual.pdf	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\DevilLocDeluxe.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\FilterFreak1.dll	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\LittleMicroShift.dll	Setup.exe
File created	C:\Program Files (x86)\Soundtoys\Manuals\Little PrimalTap Manual.pdf	Setup.exe
File created	C:\Program Files (x86)\VSTPlugins\SoundToys\Decapitator.dll	Setup.exe
File created	C:\Program Files (x86)\VSTPlugins\SoundToys\EffectRack.dll	Setup.exe
File created	C:\Program Files (x86)\VSTPlugins\SoundToys\Radiator.dll	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\DevilLoc.dll	Setup.exe
File created	C:\Program Files (x86)\VSTPlugins\SoundToys\MicroShift.dll	Setup.exe
File created	C:\Program Files (x86)\VSTPlugins\SoundToys\Crystallizer.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\Decapitator.dll	Setup.exe
File created	C:\Program Files (x86)\Soundtoys\Manuals\Crystallizer Manual.pdf	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\Crystallizer.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\SoundToys 5 ReadMe.rtf	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\FilterFreak2.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\LittleAlterBoy.dll	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\LittleRadiator.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\VSTPlugins\SoundToys\FilterFreak2.dll	Setup.exe
File created	C:\Program Files (x86)\VSTPlugins\SoundToys\LittleMicroShift.dll	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\Decapitator.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\EchoBoy.dll	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\EchoBoy.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\Manuals\Little PrimalTap Manual.pdf	Setup.exe
File created	C:\Program Files (x86)\Soundtoys\Manuals\Decapitator Manual.pdf	Setup.exe
File created	C:\Program Files (x86)\Soundtoys\Manuals\Devil-Loc Deluxe Manual.pdf	Setup.exe
File opened for modification	C:\Program Files (x86)\VSTPlugins\SoundToys\EchoBoy.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\VSTPlugins\SoundToys\LittleRadiator.dll	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\LittlePrimalTap.dll	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\PrimalTap.dll	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\Radiator.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\PanMan.dll	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\Tremolator.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\Manuals\EchoBoy Manual.pdf	Setup.exe
File created	C:\Program Files (x86)\VSTPlugins\SoundToys\DevilLoc.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\VSTPlugins\SoundToys\LittlePrimalTap.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\VSTPlugins\SoundToys\PhaseMistress.dll	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\FilterFreak2.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\VSTPlugins\SoundToys\DevilLocDeluxe.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\LittleMicroShift.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\Manuals\Devil-Loc Manual.pdf	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\Manuals\Little Radiator Manual.pdf	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\Manuals\PrimalTap Manual.pdf	Setup.exe
File created	C:\Program Files (x86)\VSTPlugins\SoundToys\EchoBoy.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\EffectRack.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\MicroShift.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\Manuals\FilterFreak Manual.pdf	Setup.exe
File created	C:\Program Files (x86)\Soundtoys\Manuals\PanMan Manual.pdf	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\PrimalTap.dll	Setup.exe
File created	C:\Program Files (x86)\Soundtoys\Manuals\Effect Rack Manual.pdf	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\SoundToys License Agreement.rtf	Setup.exe
File created	C:\Program Files\VSTPlugins\SoundToys\PanMan.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\Manuals\Little AlterBoy Manual.pdf	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\Manuals\PanMan Manual.pdf	Setup.exe
File created	C:\Program Files (x86)\Soundtoys\SoundToys License Agreement.rtf	Setup.exe
File opened for modification	C:\Program Files (x86)\Soundtoys\Utilities\CopyV4Presets.bat	Setup.exe
File created	C:\Program Files (x86)\VSTPlugins\SoundToys\PrimalTap.dll	Setup.exe
File opened for modification	C:\Program Files\VSTPlugins\SoundToys\PhaseMistress.dll	Setup.exe
File created	C:\Program Files (x86)\Soundtoys\Manuals\Little MicroShift Manual.pdf	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "7"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3637748876-3197268895-3385380113-1000\{4B7A2F36-142C-4126-81B8-F104BD0898CB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000a31672c91fd2da015bb12bb526d2da01c0b080db43d6da0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 233381.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Setup.exe:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2892	Setup.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
1272	identity_helper.exe
1272	identity_helper.exe
4472	msedge.exe
4472	msedge.exe
4532	msedge.exe
4532	msedge.exe
1524	msedge.exe
1524	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2892	Setup.exe
1188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1484	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1484	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2892	Setup.exe
2892	Setup.exe
1188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4988	2064	msedge.exe	78
PID 2064 wrote to memory of 4988	2064	msedge.exe	78
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2568	2064	msedge.exe	79
PID 2064 wrote to memory of 2560	2064	msedge.exe	80
PID 2064 wrote to memory of 2560	2064	msedge.exe	80
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81
PID 2064 wrote to memory of 3428	2064	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1InO7OmCm3Q4n-DVUXN76btL5vKV6pKP3/view?usp=sharing
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc99363cb8,0x7ffc99363cc8,0x7ffc99363cd8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "C:\ProgramData\Microsoft\Windows\Start Menu\SoundToys"
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\makeShortcut.bat
    3⤵
    PID:1896
  - - C:\Windows\SysWOW64\cscript.exe
      C:\Windows\system32\cscript.exe //nologo .\CreateShortcut.vbs
      4⤵
      PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6484 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,8389094116489225635,9385899718802789168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\VSTPlugins\SoundToys\Crystallizer.dll

Filesize
11.1MB

MD5
9178bcc9462b7b4b46783eb97ae9c9d2

SHA1
2280ca45c561002bf0826890a2711b59d305db5d

SHA256
61f0efab9f41765ce2d5a754d95b08550c756f7d8856c83fa79b445f48645783

SHA512
a38a92bc19099a8bf123fab1df50c9098baf76facab70f37c647691e5b368819ba3be592d263d2f558ee9d3beb826bc4e4ca7c76e0a947a9085c63e01743a916

Download Submit
C:\Program Files\VSTPlugins\SoundToys\Decapitator.dll

Filesize
15.3MB

MD5
fc7caf1cd1bdb69be8ff8c5a299142ac

SHA1
bd20a9efdc850fe53d880517933706fa43a4f474

SHA256
386f5ae1a82609633b15ca2fd18db6ca5899c4c3cc6ce8f4e5907169fd5cf357

SHA512
ade307f43c80dd22ee1e58dfc48bb827ed040f98217544dea605eb9f3dc4786f5b827a0bce049d47035b2b9d3d40b8ed4dcdb037ffaca100ec500f7bbbee4a61

Download Submit
C:\Program Files\VSTPlugins\SoundToys\DevilLoc.dll

Filesize
9.6MB

MD5
dbe812e64c42d30fa0c49b94aeb07084

SHA1
bfc8347691c09fc38d6c66f10987aefb66e46331

SHA256
7cc4a8ef3ab2d492dc5789fd9ae36895f9099c8a887cb9456fe6ca3136634918

SHA512
4612965b6c44e53e5ef48b2fe87434bcdc0b5011eef9fd09c6591bf40a32641c45c90d3a9e22867ad0ebb122dbbe6731e4781ce919e92cb3b02a2b3340a4ee55

Download Submit
C:\Program Files\VSTPlugins\SoundToys\DevilLocDeluxe.dll

Filesize
10.1MB

MD5
eb1ef7346991c303b34e78b08ff10243

SHA1
718194f06fa127ba679963ad028acba8d2e88b24

SHA256
0372f4c12ed63fb03f1af8a413c8e4ac850e71a67b34ee0cdfdcfb242c5cec07

SHA512
97de365d5459677d55a417dbbbed03455427a14cdee368b5b06d6563c21078735c8cf268b0c9b693d2d75395acee060eeb89e28605ed2c6e59e2a6faa1351487

Download Submit
C:\Program Files\VSTPlugins\SoundToys\EchoBoy.dll

Filesize
10.9MB

MD5
9bb97994f5f0c97036b6edb35fe4014c

SHA1
0d82e4e4397e69cb60d42998f962277fd05325db

SHA256
279fbe37b635557edce16f25f9e33736f637c45b6fde1f4c455081c69cef9284

SHA512
9198f24eceae839a1b11b92b9aeb12f8b177a5df7ce55bff3836904b28d1eb3650698295c4a5359b327307e2f04b9885475fdea0d538d33eaf462b3019729fe1

Download Submit
C:\Program Files\VSTPlugins\SoundToys\EffectRack.dll

Filesize
48.0MB

MD5
56502836546a4311c4d49c2fc10d1d02

SHA1
aef59f45bc86636cc0cd6332005f64c7b36fac32

SHA256
9827f247723d0f4a0e6066f48b5c8c4b3402d243467b3e791e895d26e635b06c

SHA512
ef9dd3876c55eba0a1b21c3ad64c3b81f338d6b252aa556f1f026ec8c5a028f206cae2a2f65db6ec064d1d8addc36f39c0c54600933e02db0d0f343b6ad6440e

Download Submit
C:\Program Files\VSTPlugins\SoundToys\FilterFreak1.dll

Filesize
10.3MB

MD5
8b4ff06261cf0593f6978c2f8d142130

SHA1
5d4a531e105b2c70bb56b4acab70f25c8fe72742

SHA256
7582f138e89185df10f42e960219f81abffa8833e7c38b74c07e4103003741b5

SHA512
21266f1cd24b541abedbeb3856aa6589e27b12cea945ebadb6582ac99017a9bd7866f5ba1be3ca2c1c797748af4b5638752eaaa2885f1f8a5778d6e8f82cdb25

Download Submit
C:\Program Files\VSTPlugins\SoundToys\FilterFreak2.dll

Filesize
10.7MB

MD5
ba61d60ff2fe288f2c49f05e9c426fd8

SHA1
c357be35bb02c3b91aa9714c94763d5c4e01ab66

SHA256
301746b91123254f60db843d598ff79ad137711c1cb0177a74c67697efeb8874

SHA512
73fa591c487cddd0ce509d3229a2356a4dc180d0ed277407bf1b8dbffcba47a2b9483a9e5b3577973eedeafbfa821a00b37b2fc92694f80264e03e4cbb7f6d50

Download Submit
C:\Program Files\VSTPlugins\SoundToys\LittleAlterBoy.dll

Filesize
13.5MB

MD5
ae966cb150cc0c74fbbcf0aa42a06339

SHA1
dfb64456808bafb86781100b2ff9a3a7f9007400

SHA256
362b0a519ca6e4f470b7e7063139c73c959789bfce5ae66bbe58210ef86c839b

SHA512
90d0adc360acc0c6ffcf1f5273f5ef62b5909de39070361fe5b677b40197f0ca3f3ba8e6a44f52cbe7c6ccb77f2b433a5fd90189a69aba2941465b2c9dbd6404

Download Submit
C:\Program Files\VSTPlugins\SoundToys\LittleMicroShift.dll

Filesize
11.5MB

MD5
721a39752c13179d46c90ea6d792dd8f

SHA1
1bf4968347fd7607026823104bd0c5633310271c

SHA256
4d411a8e0962a0909e01567c38f9f1f4f32a991e6e2fb8d338d6053178b1c10c

SHA512
e6e67327d59fc858a703bfe77af5b9d5c08a2832ef451eec827b98e88cc4c7789a1be2cb77b1aab5d520dec50979c4c06a59d11ecd978593a21aab053fae3049

Download Submit
C:\Program Files\VSTPlugins\SoundToys\LittlePrimalTap.dll

Filesize
12.7MB

MD5
ffe6250764dab9556302852fc4487902

SHA1
2d8687a02d778f425169ba4c218a466d19fa7ee2

SHA256
052d42b4a180aa417ea78135011b2ddd39407fa25eb2a8c70d1a60a368d00755

SHA512
20843d64c05599801ff5306da6e576c2125034925d05392dbdeff11bd43267570377c6d056c766e5b082ed62105532a0e299f89eca0641895ed45f02458295a8

Download Submit
C:\Program Files\VSTPlugins\SoundToys\LittleRadiator.dll

Filesize
9.9MB

MD5
15c436b6ad5779bb94cfd320d4a9bc8b

SHA1
e38aa5f562af4d39ed02c873a246ff37c2180e44

SHA256
767479ed4f8cf3f1a998f61811d8d469b93e9ba1994717a74f6a7e80cb699b5f

SHA512
1422089eab229172a1c2765579954cfa147b35ad052573e9c738f5b88c32396ff591c4e4d3d2451338ade1ab7db732d721b036b16398784f1065755db411fad4

Download Submit
C:\Program Files\VSTPlugins\SoundToys\MicroShift.dll

Filesize
14.7MB

MD5
32d733bc34eb99c7b22c77d9e15600b6

SHA1
de8f6e5aafc01fcecf6823c38892b77d84c5f872

SHA256
21ec3f22458e740c5d929b84be70596f9f6b9970aad2a28480292b9641a6c23e

SHA512
b9517a0d38edc070d7c693935c65a64ceac23a9abb9e6ae3c8a535c58f8a5fc9205fedf91dcc0fe2d87e4b6d2548462633109a03d157a90679dd742892c0243d

Download Submit
C:\Program Files\VSTPlugins\SoundToys\PanMan.dll

Filesize
10.7MB

MD5
b270400463c55719a5d5542cdbf25616

SHA1
5f8e42ab1225463affe9b966566a4b325017d2c5

SHA256
b482afc9f2ebb714c2cbb61d0194ede27ea0818c862aee55bd8df6fab4a5d03f

SHA512
773352b1f5a07a45ddb51c57e722319e7393ad32c540138303a79b9b3e57eef51a7c832b43e810e17e88b6370d150a4820bbcf111809899775ea46a2b9307eff

Download Submit
C:\Program Files\VSTPlugins\SoundToys\PhaseMistress.dll

Filesize
10.3MB

MD5
83043707f7930a86f965f4ffd0781e35

SHA1
e0930f556ded0b3d0dcec8122664aeb4538f3df2

SHA256
516220a5e545876a4959472706bbf9926e4b12e2ac5ff8d303e4504e1c51c071

SHA512
7c70e3dbcd134fb135fc93505d2277f865b53faba0dc344bba726fe6f111c2e1465bbe98a282a4faa6412576b8f8f26275e544f209992af532cbf12c98a152ef

Download Submit
C:\Program Files\VSTPlugins\SoundToys\PrimalTap.dll

Filesize
12.0MB

MD5
35c411c2296b7212a18ad331c34ae029

SHA1
56fb73a2f8fd7767859d02befa3523aa213867f0

SHA256
59c131436e77163c7909f5d5c0413ab42fd63cd0b13b6dc2a0dd31d7bac7953f

SHA512
a640548fe86abc3984bffc6a3082d92748c5d3a7d337b92ea3cfa56add74fb6dc1d8842536ea770d6a122d61fdbd3c676384ee8ac8bdcb4d78925b97e5d6abfb

Download Submit
C:\Program Files\VSTPlugins\SoundToys\Radiator.dll

Filesize
13.5MB

MD5
3cf692bfad8f41f2db5f3be67f670f8e

SHA1
b665d9bd4393a2f6ad889f10bca4e1a62ec22586

SHA256
6f9361ba4a7d50c1884ac9f0becad0c937657904fc9f586646719f81d3beb052

SHA512
817c0578a22899fa5c466e43cda7a9b7885b5aa934f774f966499b0e3369527fb6fc385170102ae5b2d0dfedc685f65fdf657c06d32046549b86d8798a62a784

Download Submit
C:\Program Files\VSTPlugins\SoundToys\Tremolator.dll

Filesize
10.1MB

MD5
704ab5b650d44019f81e040b77a18a13

SHA1
64c1760916d533b1f9c6de0e9d070637795ce687

SHA256
73e4be5bf79507420ea0cf859d56b59e3b223c64c9f26a30b858511ddee7933f

SHA512
5362ad9d662364944e4af5d385a84ddea4e991c04867e58e04324228a5f24973bbe7d7120e5aeab81dec16c0e0d6cb9c554124961eff5e223c12fe7d64c48786

Download Submit
C:\ProgramData\AudioUTOPiA\Uninstall64.exe

Filesize
44KB

MD5
e8c1b3303e5dc5e13e623eac245b8c4b

SHA1
cf504dc0076a32a6b7ff725db37e6032f36cfd07

SHA256
efca7d835bcad6d5ba8843d3061c8e1b8a9b49d4dde529259afa593532cc3bcf

SHA512
c8e3acfc9c5dc8aedd278f53dc77a8ba42138664843f6a50781acb17e0701bcb6905bb61dcf1ad1a6be499db2c34449868744d13c6443b00e14af16b56273c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a35bc09-2ae7-43d2-93c8-bbb1a28dab1a.tmp

Filesize
11KB

MD5
f9ea77a900a02e880307f2a3dcfcd0e5

SHA1
f0c97a6b8a8b654fad0113ed58ac8b770cc3391d

SHA256
9bcf073b1d7732d168ca2253874726b6706f3c63109dea440294000aaf90a3b2

SHA512
5ad057e2b389148941bc7c3986261af9b3e6dea40fa3753e91267ab265fbe8e7da6444c9b909ee15a1735032a1d21d8ad342b2b68d8b331930d982d4bea9d450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1998107017edc46fed4599ad24cfe53

SHA1
47e92f0646f0de9241c59f88e0c10561a2236b5e

SHA256
cc6838475e4b8d425548ceb54a16d41fb91d528273396a8f0b216889d79e0caa

SHA512
ef7228c3da52bf2a88332b9d902832ed18176dfff7c295abfbaab4e82399dc21600b125c8dad615eb1580fab2f4192251a7f7c557842c9cac0209033a3113816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
21cf39beee4d807318a05a10dc3f1bf3

SHA1
01ef7fc09919eb33292a76934d3f2b5ba248f79c

SHA256
b766823dabbf6f78e2ee7c36d231d6708800126dc347ce3e83f4bf27bc6e2939

SHA512
0baf8b0964d390b9eb7fafd217037709ac4ab31abcdf63598244026c31284cd838f12d628dcffe35d5661ba15a5e4f3b82c7c2d9226ac88856a07b5b7b415291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
51KB

MD5
f61f0d4d0f968d5bba39a84c76277e1a

SHA1
aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

SHA256
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

SHA512
6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
110KB

MD5
40b1772be4f8be4ff044ce5c9f3f4f21

SHA1
cb47c0f6afa3e98c8be13754ba73d687e3ba1843

SHA256
7f11864f65970e2d166cc02902b7a517805ba6c0f5a438dda0d09dfaf8cdde7e

SHA512
206c4e63be57a3ddec6be7a5a4f94b7a40193744599932d69b09d781ea52d655de0488766e2d9aa566096fe38794d733559de6b248793d0937e025f04ce71a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
65KB

MD5
8adcff682d2d15772171fc19aec6f34c

SHA1
fef253973e08d6de3d8d8dac3a04e24f16d45dd2

SHA256
9b46fae0b59eb673e9cbab20c1af31d35b81bd627fefe5054549c071bf84a5a2

SHA512
031afdc6be2e8d6cd43f56aec912de069b77900d5b0c7478a3a2d81d4c3d3aee01a8aba22e77f2183e830b41afae94ed184b32416d37e37bf178c89ba85c279e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
34KB

MD5
6cb3d6c1cfddbe0bf0c9294595b7c491

SHA1
38afd5dd38d87c86730b63aee30145d5bb18db7c

SHA256
010d4934968264f49efb5af1561698b442082651d4e4458a8ffdc503cd0aa89c

SHA512
d7ff0fcc5078fb13183a99c4037c4c0e136121493daae9de9e2c32f5dca3394a2cb7e9264e694a2efdccc1872800b4464d8097a2260e74f23a39a27e9f6e1b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4c8892487dac34472ad909ad7c42bd80

SHA1
48ef514e600c467fa5c8626905f3cf57261d3c19

SHA256
36b57da97fc2aa72a0d428eb52966d69b0fc6c3aacb5ebd84f9e7336d7371b73

SHA512
48c0688c81d3ae1808916643860c5eccd912cb62ea8331ac9754da215eaf71c81232839999e01e01d3924e0e536b14ab57334cc0cc42cabeaccd1406f918142b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
23ae0f530e72e238e7c1581c4506983f

SHA1
dce0ebe8a819d16a4b77b2250a0dbe37a927c957

SHA256
46b95291134db3732800d5150a53a0669a6cdcc7e79d1f676dd1a7b746107795

SHA512
197b436a4dcb86c1601ef8ac6e5e71aa079731115a55e9740562f079a017c420af448d7032809c1761ee64977eeb0c6b613fbaef9344859d55b3d8381c86b1f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
a18304897ae3e382bd39ae127c298f2e

SHA1
ba3da3632e4c590c5a5e77a32d82f61b58a770f1

SHA256
b508c533f1d564d4dcb659d139f7a6f7d64102aa293b397ee8401700642988f7

SHA512
00cb8657832caffd32e833346c1558384ae97e6d47e1de5a96e39d620a350dbd554bfd942f05464e4b023808cdc37adced0e854e944533e285cddb152f64c02a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
50253aea5cbaeeca49bae4c9d213ba76

SHA1
eea369d8f00a7fed0fff84abd81ac473646b1913

SHA256
7055ed5debbb86a85d7225fe32ac1f62dd6f4078981d623dd503a42e5ca78906

SHA512
f7da9c78d6a14829013a9eb426accd4ccc56b31a4ea415a3bd69e70051526fe220877f8636590af2d8a7d43f3a10f71aa7159deb23ba127a96fe6412df210fae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
262dabb75411b537f95ce5141ffc7248

SHA1
7b508865eea847b7f3221787ee22fd3b785857d9

SHA256
f2654e0dac36ea3f583c0f4895541708114c413866803d1fd44d65e45ece0c94

SHA512
d0557d469b791fe207eb9b4b457d5d0170b1a4b19517253ae4a6d105bb42e7fc871c7c08d1830aef4243252334259b0db5661cc6b32233e3a2c313a5d3511119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
394997af9c2236027eaedc084cfdee66

SHA1
7702548e7d319193289145cd4b728d7b2cf64893

SHA256
163ab5e1bfd955d5ca878cf708515f3ba92da1c9ee487d12078944e693d8593c

SHA512
f92e9f069088296fc5e83da508962e132d7f896d3cc1b6e44475766257ff79f0eeab9b534643b825fb29688397e808b631c0e28b59efa734b88e8d4b3c9fc9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6a5291a880af687472242705394bafd7

SHA1
aeeeb1ae3f887828129fbbe6f3e65c874188c732

SHA256
35813185f34b7a2052298fe594d9770a4ffef0d089bed8a1cf9b6d258f203c65

SHA512
b866c7d39ceed7eb0f58218f11ce6054f94a74993bef7431c77e50ae62f1598063ad8e27ed11b00cd8266043e8548a42f9e4e3084b1f0258a3060494772a34ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
c5f3bd25b9f47a42169d36286c08e326

SHA1
507c15fb7a2071ed857591a192461aa67e0601b4

SHA256
e41ebfa579e5d0da1732289d4529d193dad8282fac3c464069740628e40243df

SHA512
172a26e163d7756c0011f9e06a676b822ac65d06d0c807a3701fbdb9c8698d8ea3775f498528ae1b23b63a93dc3fe140bbf07625d6c02f6fa5a38fdc14b653a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
709059c395cc548e031f0dafd2a3f36d

SHA1
d622e89bf7b3a9330f17e7cd6436763e7959fc20

SHA256
a3a56f6d0d3b9d9245b1ba10c63752914285f6b21693a79faa8e9540a82304c5

SHA512
7b6284253835d35e9f0dfecdced3753fdafde748a62162a9786d31434bb2faaa6edfd0965e36e9e6b116cd505b490d9119417c8a4946a8e8e245ab07eb310f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
337ff70a556ff3ade5f42b4d2025906c

SHA1
b0073d9d1afa0d002b62fc13c3848d2410656371

SHA256
4b72131def659d1facb6390120bdbde5a56c4772c0afbfd955f853d9320116bd

SHA512
8b8704cd8f839988a68794a9656aebed0bfec1062c3a05cee74658284ee84384e0f6fb0f067b8371d6db7dc73f86961f720d34517c077996a7728f4ae1814b36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
46156270456e2ad2d3a36172fd2a3440

SHA1
fd0f047a83f6a2c7f72ee6db103d6869409bb70b

SHA256
8ca6af539a576e0c14469d4683c96ffa86cbafc3a3e1d89dbb93a4f0d0d265ab

SHA512
ff187b834ed12a0a45d53bb605b9ea40b0f9062198defff4b62833db84e250ea5274cc5fec5f07d89cfc562534a78a51b3200997835c44bf7c946406224fa97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88613fdb2c2ed2cde32c0fd15efb36c4

SHA1
d6a9fb103ad99d02d105967920e4c79aae71ad2e

SHA256
9334fcf19dd94d68add2d436f354fba101f02d4a9b302212be6d834bf919db50

SHA512
175a324ce595f43ee989a1a837292f6a92d4426a5523c4b7a33810cb8ac0b8def63d3f490fa8624db9b8c0e9f1b5341ec26e401c5294fc5551f18a5378451732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1e702c3f351ea0dbe2356a5e0d32a3ec

SHA1
57c791d5c5041cc1ccef7005c4fe5741dbc4eca3

SHA256
542861dbf3bd6a805ade082b70e5a6f5e99f92a5c583f80d446e5c9875bf2b50

SHA512
4854991d0784dc1b8cc07235d7b2321246a460dd4c1f593ce4a54417c1cc06dc86330ac39f7de3cfae2b51b13449776884f67eaa7a2b968fb3b1328cebc937e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
480f1676068caaef0d9f488f502dba4a

SHA1
8652acd10a6dfa2190321f0048bea44c54aab0c5

SHA256
1eb1165675d060d44b9a2ef51e493a4824e20e8aee4b84ef81e931215a050fdb

SHA512
218f94e0ea4da0aa3809799abf26d355cffe5df3f3aec2c400653ec5516dff71f9b4c98a39de2a23e4c6c2af80a13dfa6caa7b3e8879432912680e9f08e8925b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a147c365fd187a60ad92053f8a1e216b

SHA1
7b0d44bed9529017a7bc3176bab0380ba7f1c0df

SHA256
74462e4b608994b092cdd47ec3594a3ac3a12ef004a7526b017a7ac32fb27c3d

SHA512
623cb4eb3a1f021b610795b0b514ff923a6433590e6673a251f6f4b08e3c2f5c78e25168d0923f6a39c2b56fd1f0dbbcd234cd6606fd464e31aee7fd42f017a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1bfeee930742d37ce228d7a8154f59b6

SHA1
6e1d7019a2125f0f1f1ff2be77a7d4397ef6398a

SHA256
1d764ce490c6424c610bf972648d0d6c07a942bce4e3b743c84b0f5a3ec54332

SHA512
8edd4e6eac260638d59f3b496cef1097c70c047ec56611ca92d3c70cb71dc38c5c16727e38c76d299bd577f58074b9f9e62f879639e55d9504488028bbdc663f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9bccbe27533a46b56775d61e60926709

SHA1
baf0733d5ed96a00ad0e64a4b0517bdec1e53497

SHA256
761e25205d7bede6627cbaaaaf628eb493774b44e709d0142820fa305768849d

SHA512
6e8264f364e567dbbd23d73da548484a860721e612d0698f60441318b0d3d59c9bb83fbb60d04809eaaae83a32676e72ef36916c63831f1c58f6bc8650654f8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fdffc6d163737d44bbb553ae5e12319e

SHA1
297e95082a6e8c4a55e9efaec6631affc776ed02

SHA256
fa2c6483c1c10ebfb9ae19f9283545c444219698d916e795c88db9391bd09544

SHA512
af99849ff9797d7b545d2acb72ee1c31478b7611099946577d4f708db6feac4b30b5487be047349c2c15756103f69ced7a89f82e1eaee7a3fe026b8aff3b99b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a225da05331da48d1d2a614aa4038ac7

SHA1
b9fba72f1cb9df416e9c36fc152adab207523cbf

SHA256
cb12da5b45310273831ea491cdfd84a3fb2b228ddba82f4b318008cc8da775fd

SHA512
146ae61ff895865b017b1c66e06713bbd61534a4a034f58c3b18819efceeda683e53c60f9962a6df622c0862e3de83177680c209925c005e98d7358daf836546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e7fe41786eb65f6e1dd60a4f0f1bff5e

SHA1
9b6acdbcc78278019f39ae33ff089b64867fea40

SHA256
c75e75b3eaec30b31697c079b90e51d70866d916677291d083088de10dc67dbf

SHA512
d2b94428d92aef91e14dde36431eb1c16ba8dca04e3528dab03602a53b841486464bac72fec8fa04e33d2536db1607fcc456e58711faa048da5206a5181fe8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b8e6086ad378d48b4432b573d7328009

SHA1
3604a2f8a8e70b1f46d76d62a018c5882b04266d

SHA256
5936a40b14129353152eb2f4d9ee42dffa7fd22ef83b58e2c8be4c4f79241150

SHA512
5ead88a30e6efdd0a9c2da3cbc2ddcc0a14beb776c763b1b4822e71d53829123bf1a19d77a7ae42b0e36edbb8cd5dad15fedc9631b5ac41c52bb8328085b4ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
824207fe2710595574a89bd01742adf5

SHA1
aab96363cb6afc1e679bb2df8b6a1cbbf8242bd8

SHA256
45bebf0c5aa145c3e6534e23197bdc8dfe0c9c04386d9bd7a4fb274edf30b41d

SHA512
cce7c2d7b6ebc03172cf987adcfa55c731b10c0c71150f58409f909621608860838e43f643a6a8d654a9fc4c1eecbf743a34a12827de6763e7b86e94c8dc2a49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8542628fb9daa01c744259622a71142f

SHA1
95ebad0576546d88f92e591c75fbb06d6202cf39

SHA256
24a3d680cedd6d4e91baf21d412e242ea2364e39c87f9d36ab99d7272310078f

SHA512
71463e28c52fd5af4d521ea41b5d2232bbd33b753e88f99742b29c82dc5ce9029fa0fbd471d68f4be131a62290ca682a7decb574826c2281ae6c86c2cffdaa9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
73291c542a9e6b3e0d76905765d600ac

SHA1
121aaeae8cb91265c3e7554836e32aa67c06387c

SHA256
ba89d29a4c34d259936dff72d45e74ac6415f35b336ef95100fa01a4ad0d68f7

SHA512
165e40e02d37b38fc71652fb97d6bc9b76df3bbff7f55e44f1ba6086bb6e4d41570bddc8a5d99a8dd502524399c90fb46a9c3448364679af33d7382e212e9d62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0aabb47c9feb2f4caf0f28827e07661d

SHA1
f9277886939db77162a5eee5a9fc2740238db338

SHA256
310daf6f453a1c43a5c99661914b5e067b34c18f1511a6fe1067177a0670bb67

SHA512
d91ba4d29af82b87cd7b5a943892756db40e4a7972e3c020fb9e334d732342f9c47e8794171ab804565a79cba68deb34c768275777207081e2440555fd5f9a3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ee4ae36fcd155f1361d4f138b08085fd

SHA1
a2dc3ed0d5081ed513d120be7c8836278bf7ea4c

SHA256
0853b7327a36a51cde2c82ef5168782198928f905630b44d3a76baeb81ad5d75

SHA512
a20eb78c80c34cd604148b090a95b39cbda4c67ee580f214396a72e81afabef25727ff25d8d522f49e1d097367065011b257cd52928830317ad6e232415cc4b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4415ba46045d6ce133eff426f077a544

SHA1
428d5ea1cc26197ad3f1ce8f527761a6aafa18e5

SHA256
9995d49aa2674bde2026f739da7bfb4eeacb1f6f4a62767f8b7579cfc6d7d4c9

SHA512
9dcb0dd7105ccc0e80fc8cf54c9a4760dfe602debe3237e68a464b4dfe19253506ce1748f99a007c853023e20ce1793830caa0355bc81436ed3237b9a0bf5ad7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fa1e70efc80e18548def51f8107c26de

SHA1
11f92a843c4244928272b0b5f33e48943ff38703

SHA256
51e648612e424e38c396e6f832a6aba666f7b5d297b57e839344160df57e37a2

SHA512
da9ddc1e1528875916668a7d152aa5d88c3dd527a0cea2c2221b1976ea25c49c9791bbb7e9f7ba91fe7d2a0374532ece246ecb3cc1112971a61a2db18422cb9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
19faf4f85c2ea15b65966e7f6fe6e845

SHA1
10d072fd7abe346a911dba99472b3443f3ddca1d

SHA256
f63d6ecaecfa356c0654ad363d74b8a5eed17661e067e3845b449c6392f4434e

SHA512
303873da3caf22be9c942a509dd20899dc6bf6022c825c0da755440ee689163c57ea5445862e42f8937d032d8c64e0401ada3623cbaa49489c991bd320bb1ad9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3c8aa4cbc169446856d458a5fcc4b341

SHA1
a1004c1dad8dc567692e5ed03f81a25e6369dba9

SHA256
ab6db7087be91ff340100109f07fb338c0b2b7be07c78471d400369c863e6353

SHA512
909d9e6fe3bef0d1b48eb020a8607f1a5cdd4a86d343d1d890afd4d0bcd083709463d79df8671f7ab1556caa4396e8cf5e69f11eb64aca2c76c4da5f4c76fe33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
411ac122d565c852f6784be6c9b32960

SHA1
f5f2ac3298e61cc44a2c9233cb032fa3e31b6a94

SHA256
35e3bba88acef24e8238d21004db0158472f61f9b2ea3c4daba021982a161379

SHA512
b85a6c3d47a88d38af7067ea169ba440b86476072fb57d9ca104bb5f83062585a0c642756335213c66dd692a34d3590d9a92001514e007a1f867f5b4b94db60a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59983f.TMP

Filesize
874B

MD5
612feac93629c8857a74eb135e0b5271

SHA1
a6ac1797def8c0fa4d310736d0cb74b82a2b58fb

SHA256
ad8ea8f242eed1a00d5f8c97e5ffaae51fba015bb0ec2c6741541dc7eafec53b

SHA512
028c2406bf01307de0251404c28b756594e7621904ce43575178f0155fad2e8310af70829a8b80ed0f6ff7f10937a82e376b3aedd93ac35dad1216ea5f89c3a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
143b64d112aaf1808b54e4d706ea62ef

SHA1
add93dd58870afd4d899cfead377a2509b9c935c

SHA256
93d99c6054259c68851e37bf02aed6dda958d349c307e09f1d67433a9dc64220

SHA512
956f77af1b9b5c28d3d8f0841b0d1e2f55f79643621001e92fe6a1c0ee2262c9ec6c9b6a8c1d9e2272e724babd7dcbb8ec406df1f0cf78e27633a0a4a620cdc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5afaed835ea059ab1c1892c3ffe061c7

SHA1
2e74c849e09f8d69d3a276cf1107e7d350611542

SHA256
01e77fad671af98688abdb12cd4d7473117204c9b455e9f5e3266726beac01a0

SHA512
4f191cada9e726e65b3e8a7ae79dd352e245ccebf9adb43684e5bd9da7e1b3177f8737b00a8c7c07f9a40a3cf2312a1b97be41e6292016fec25f42472bdb7be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ab6b02bd2779645f8a212302d743e324

SHA1
68c75e47449544904f95429ab2b23fbc4116747f

SHA256
b675e28120f771464080201b25aa3c508261d9ef91dbf6ea9deb034c693ffa94

SHA512
d88dfc209d795a6bbcb9daf66978b2a9294af45b820317d9b5914855ec1f8cc745cdcbf6c331e797ae917e898c13eaffbc456deda0d9d33fc5f0dac802f1f3ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5b7cff1ded1ea79c5b7c2aa4dea004e2

SHA1
1b1373d098782efaa439fcd80ef2a2d545259598

SHA256
24b88d93265f75afba480dc0a07d3ec3b75d92efa72c17ba14eda008211b5a78

SHA512
a0b1f21c1b968af03493062fdeaeb3197d550f71025111b10bc6d00e12617c0aa118ef4df1d44a55973c3920aa85fb8946e83a5935381af7cdf9edd91242c945

Download Submit
C:\Users\Admin\AppData\Local\Temp\makeShortcut.bat

Filesize
760B

MD5
c994c44cf6b8290a1a6b60029e76cd58

SHA1
95fd7d0902e6024ce101172e09c5dfe220233a91

SHA256
04eaafc1bed78809da5d62367b2ead38b4408579a549779ef949d7b7d1f97157

SHA512
c62f62f2433349767cc59b1f9936ec3a570f9162066207ad7a770236a45c37a206091b389d8b7efbc1d64d029ace38f7684f2850887635457cd6ba8a279f5cfd

Download Submit
C:\Users\Admin\Downloads\CreateShortcut.vbs

Filesize
410B

MD5
c2bb080d4c48b93ef2bd1712c095231b

SHA1
c336b0f32f3e69094470e592e741705303257b41

SHA256
a3870f47e67d072d371c793401bcba6f37b9f684d4457623c73831d6fec4cb5e

SHA512
10c2e2075ba4ae4aae7bf214b7d202dadc8700c81be4c576929fa792ae9f9ef8802662c36e766e4192f66ce75aac3e72d369f68668db398f1c4b4705270100b6

Download Submit
C:\Users\Admin\Downloads\Setup.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit