hxxps://www[.]rewasd[.]com/#

Analysis

max time kernel
157s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 19:02

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://www.rewasd.com/#

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SETA5CB.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SETA5CB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\rwsddrvmap.sys	DrvInst.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3828	netsh.exe
3648	netsh.exe
516	netsh.exe
4876	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	reWASD730-9159.exe
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-win-x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	aspnetcore-runtime-x86.exe

Executes dropped EXE 11 IoCs

pid	Process
5628	reWASD730-9159.exe
5224	windowsdesktop-runtime-win-x86.exe
6040	windowsdesktop-runtime-win-x86.exe
5560	windowsdesktop-runtime-8.0.3-win-x86.exe
4836	aspnetcore-runtime-x86.exe
4856	aspnetcore-runtime-x86.exe
5348	AspNetCoreSharedFrameworkBundle-x86.exe
5836	rwsdsvc.exe
6044	rwsdsvc.exe
4836	rwsdsvc.exe
5508	rwsdsvc.exe

Loads dropped DLL 47 IoCs

pid	Process
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
6040	windowsdesktop-runtime-win-x86.exe
5388	MsiExec.exe
5772	MsiExec.exe
5892	MsiExec.exe
1292	MsiExec.exe
4856	aspnetcore-runtime-x86.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{2907caa8-4808-4b6b-b7e7-fb8c862823d2} = "\"C:\\ProgramData\\Package Cache\\{2907caa8-4808-4b6b-b7e7-fb8c862823d2}\\windowsdesktop-runtime-8.0.3-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{27b7a489-233a-488c-b81b-0cb173d4cd15} = "\"C:\\ProgramData\\Package Cache\\{27b7a489-233a-488c-b81b-0cb173d4cd15}\\AspNetCoreSharedFrameworkBundle-x86.exe\" /burn.runonce"	AspNetCoreSharedFrameworkBundle-x86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mapping Engine = "\"C:\\Program Files\\reWASD\\Engine.exe\""	reWASD730-9159.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8d850e3e-c924-1144-94f3-b1132caf2975}\SETA4B2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9e9aed32-64ee-3840-828a-e9e895b9ed5b}\SETA734.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rwsddrvflt.inf_amd64_5e1a1bbde337290d\rwsddrvflt.PNF	rwsdsvc.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8d850e3e-c924-1144-94f3-b1132caf2975}\SETA4C3.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\netrass.PNF	rwsdsvc.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\netpacer.PNF	rwsdsvc.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8d850e3e-c924-1144-94f3-b1132caf2975}\rwsddrvmap.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rwsddrvmap.inf_amd64_ef3c533f9fa3a2b9\rwsddrvmap.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9e9aed32-64ee-3840-828a-e9e895b9ed5b}\SETA733.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9e9aed32-64ee-3840-828a-e9e895b9ed5b}\rwsddrvflt.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\netserv.PNF	rwsdsvc.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8d850e3e-c924-1144-94f3-b1132caf2975}\rwsddrvmap.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9e9aed32-64ee-3840-828a-e9e895b9ed5b}\SETA733.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9e9aed32-64ee-3840-828a-e9e895b9ed5b}\rwsddrvflt.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9e9aed32-64ee-3840-828a-e9e895b9ed5b}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\netbrdg.PNF	rwsdsvc.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\netnb.PNF	rwsdsvc.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF	rwsdsvc.exe
File created	C:\Windows\System32\DriverStore\Temp\{8d850e3e-c924-1144-94f3-b1132caf2975}\SETA4B2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8d850e3e-c924-1144-94f3-b1132caf2975}\SETA4C4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rwsddrvmap.inf_amd64_ef3c533f9fa3a2b9\rwsddrvmap.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8d850e3e-c924-1144-94f3-b1132caf2975}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rwsddrvmap.inf_amd64_ef3c533f9fa3a2b9\rwsddrvmap.PNF	rwsdsvc.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\netvwififlt.PNF	rwsdsvc.exe
File created	C:\Windows\System32\DriverStore\Temp\{8d850e3e-c924-1144-94f3-b1132caf2975}\SETA4C3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8d850e3e-c924-1144-94f3-b1132caf2975}\rwsddrvmap.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rwsddrvmap.inf_amd64_ef3c533f9fa3a2b9\rwsddrvmap.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rwsddrvflt.inf_amd64_5e1a1bbde337290d\rwsddrvflt.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rwsddrvflt.inf_amd64_5e1a1bbde337290d\rwsddrvflt.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ndiscap.PNF	rwsdsvc.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\c_netservice.PNF	rwsdsvc.exe
File created	C:\Windows\System32\DriverStore\Temp\{8d850e3e-c924-1144-94f3-b1132caf2975}\SETA4C4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9e9aed32-64ee-3840-828a-e9e895b9ed5b}\SETA734.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.PNF	rwsdsvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.DependencyInjection.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Net.WebClient.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\de\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Identity.Stores.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Numerics.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Logging.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.WebSockets.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\pl\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\System.IO.Pipelines.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\zh-Hant\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\zh-Hant\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.JSInterop.dll	msiexec.exe
File created	C:\Program Files\reWASD\reWASDCommandLine.dll	reWASD730-9159.exe
File created	C:\Program Files\reWASD\firmware\REWASD_GIMX_1_03.hex	reWASD730-9159.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\it\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.SignalR.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\System.Security.Cryptography.Pkcs.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\es\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\pl\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.Routing.dll	msiexec.exe
File created	C:\Program Files\reWASD\DiscSoft.NET.Base.dll	reWASD730-9159.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\PresentationFramework-SystemXml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\ja\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.Html.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.Authorization.Policy.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\zh-Hant\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.Cryptography.Internal.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.Diagnostics.HealthChecks.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\de\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Diagnostics.HealthChecks.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Diagnostics.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.SignalR.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\coreclr.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\PresentationFramework-SystemDrawing.dll	msiexec.exe
File created	C:\Program Files\reWASD\LangResources\ESN.dll	reWASD730-9159.exe
File created	C:\Program Files (x86)\dotnet\shared\eula.txt	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.Extensions.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.3\Microsoft.AspNetCore.Mvc.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.3\System.Collections.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\es\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\ru\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.3\zh-Hant\PresentationCore.resources.dll	msiexec.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5948c1.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI5461.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D383E279-1AD9-4DD8-9EB4-7C831665F9CC}	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	rwsdsvc.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DC8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI684C.tmp	msiexec.exe
File created	C:\Windows\Installer\e5948b7.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5879.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5BA7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5948c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F62.tmp	msiexec.exe
File created	C:\Windows\Installer\e5948cf.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\e5948b7.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AA217943-D70A-4078-988C-31E5EC26AFE1}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5916.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5948c1.msi	msiexec.exe
File created	C:\Windows\Installer\e5948cb.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{66F03628-AF73-329C-9DB7-59A701E08AB7}	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\SourceHash{CE4A2F26-87B5-4569-A582-62A8D3B20BE9}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5948bc.msi	msiexec.exe
File created	C:\Windows\Installer\e5948c0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C35.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9394.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5948bb.msi	msiexec.exe
File created	C:\Windows\Installer\e5948bc.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C3185BE9-A193-4021-91F1-1E196C20CAB6}	msiexec.exe
File created	C:\Windows\Installer\e5948c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5948cb.msi	msiexec.exe
File created	C:\Windows\Installer\e5948c5.msi	msiexec.exe
File created	C:\Windows\Installer\e5948ca.msi	msiexec.exe
File created	C:\Windows\INF\oem4.PNF	rwsdsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 30 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	rwsdsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	rwsdsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	rwsdsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	rwsdsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	rwsdsvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	rwsdsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	rwsdsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	rwsdsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	rwsdsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	rwsdsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "155"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.12.10343_x86\Dependents\{2907caa8-4808-4b6b-b7e7-fb8c862823d2}	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E3959C6D382567A66EA28545B978FB3A\349712AAA07D870489C8135ECE62FA1E	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_64.12.10343_x86	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9EB5813C391A1204191FE191C602AC6B	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{27b7a489-233a-488c-b81b-0cb173d4cd15}	AspNetCoreSharedFrameworkBundle-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{27b7a489-233a-488c-b81b-0cb173d4cd15}\Version = "8.0.3.24116"	AspNetCoreSharedFrameworkBundle-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\reWASD.config\ = "reWASD config"	reWASD730-9159.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.12.10343_x86\Version = "64.12.10343"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62F2A4EC5B7896545A28268A3D2BB09E\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{CE4A2F26-87B5-4569-A582-62A8D3B20BE9}v64.12.10343\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x86\Version = "64.12.10343"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C3185BE9-A193-4021-91F1-1E196C20CAB6}v64.12.10343\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{66F03628-AF73-329C-9DB7-59A701E08AB7}v8.0.3.24116\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\62F2A4EC5B7896545A28268A3D2BB09E	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_64.12.10343_x86	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\972E383D9DA18DD4E94BC73861569FCC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\71B5E379F66545F427F9669E87762100	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.AspNetCore.SharedFramework_x86_en_US.UTF-8,v8.0.3-servicing.24116.15\Dependents	AspNetCoreSharedFrameworkBundle-x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62F2A4EC5B7896545A28268A3D2BB09E\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E3959C6D382567A66EA28545B978FB3A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D383E279-1AD9-4DD8-9EB4-7C831665F9CC}v64.12.10377\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\ProductName = "Microsoft .NET Host FX Resolver - 8.0.3 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\972E383D9DA18DD4E94BC73861569FCC\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\Version = "134217731"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.12.10377_x86\DisplayName = "Microsoft Windows Desktop Runtime - 8.0.3 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.12.10343_x86\Version = "64.12.10343"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x86\DisplayName = "Microsoft .NET Host - 8.0.3 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E955187255612684DD295E2F5C1A4A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_64.12.10377_x86	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\PackageCode = "207A606421346D641AD75BAA7D13FA31"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{2907caa8-4808-4b6b-b7e7-fb8c862823d2}\Version = "8.0.3.33416"	windowsdesktop-runtime-8.0.3-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.12.10377_x86\Dependents	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B\Version = "1074538599"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\PackageCode = "9EBFBB50509247143B58A369BA86068D"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.12.10343_x86\Dependents\{2907caa8-4808-4b6b-b7e7-fb8c862823d2}	windowsdesktop-runtime-8.0.3-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EB5813C391A1204191FE191C602AC6B\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x86\Dependents\{2907caa8-4808-4b6b-b7e7-fb8c862823d2}	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{2907caa8-4808-4b6b-b7e7-fb8c862823d2}\ = "{2907caa8-4808-4b6b-b7e7-fb8c862823d2}"	windowsdesktop-runtime-8.0.3-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.AspNetCore.SharedFramework_x86_en_US.UTF-8,v8.0.3-servicing.24116.15\DisplayName = "Microsoft ASP.NET Core 8.0.3 Shared Framework (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\82630F6637FAC923D97B957A100EA87B\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\SourceList\PackageName = "dotnet-hostfxr-8.0.3-win-x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rewasd\reWASD.config_backup	reWASD730-9159.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\reWASD.config\shell\open\ = "Open with reWASD"	reWASD730-9159.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C75D4DEB6BB5AD971A9182E4AEF90603	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\349712AAA07D870489C8135ECE62FA1E\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\972E383D9DA18DD4E94BC73861569FCC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\reWASD.config	reWASD730-9159.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.12.10343_x86\DisplayName = "Microsoft .NET Host FX Resolver - 8.0.3 (x86)"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 941600.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
1728	msedge.exe
1728	msedge.exe
4188	identity_helper.exe
4188	identity_helper.exe
5308	msedge.exe
5308	msedge.exe
5628	reWASD730-9159.exe
5628	reWASD730-9159.exe
5036	msiexec.exe
5036	msiexec.exe
5036	msiexec.exe
5036	msiexec.exe
5036	msiexec.exe
5036	msiexec.exe
5036	msiexec.exe
5036	msiexec.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5036	msiexec.exe
5036	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5628	reWASD730-9159.exe
Token: SeShutdownPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeIncreaseQuotaPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSecurityPrivilege	5036	msiexec.exe
Token: SeCreateTokenPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeLockMemoryPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeIncreaseQuotaPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeMachineAccountPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeTcbPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSecurityPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeTakeOwnershipPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeLoadDriverPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSystemProfilePrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSystemtimePrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeProfSingleProcessPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeIncBasePriorityPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeCreatePagefilePrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeCreatePermanentPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeBackupPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeRestorePrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeShutdownPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeDebugPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeAuditPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSystemEnvironmentPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeChangeNotifyPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeRemoteShutdownPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeUndockPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeSyncAgentPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeEnableDelegationPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeManageVolumePrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeImpersonatePrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeCreateGlobalPrivilege	5560	windowsdesktop-runtime-8.0.3-win-x86.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe
Token: SeTakeOwnershipPrivilege	5036	msiexec.exe
Token: SeRestorePrivilege	5036	msiexec.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
5628	reWASD730-9159.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5224	windowsdesktop-runtime-win-x86.exe
6040	windowsdesktop-runtime-win-x86.exe
5560	windowsdesktop-runtime-8.0.3-win-x86.exe
4836	aspnetcore-runtime-x86.exe
4856	aspnetcore-runtime-x86.exe
5348	AspNetCoreSharedFrameworkBundle-x86.exe
5836	rwsdsvc.exe
6044	rwsdsvc.exe
4836	rwsdsvc.exe
3736	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 800	1728	msedge.exe	84
PID 1728 wrote to memory of 800	1728	msedge.exe	84
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 4620	1728	msedge.exe	85
PID 1728 wrote to memory of 2008	1728	msedge.exe	86
PID 1728 wrote to memory of 2008	1728	msedge.exe	86
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87
PID 1728 wrote to memory of 2424	1728	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.rewasd.com/#
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa43b446f8,0x7ffa43b44708,0x7ffa43b44718
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3993385238591036905,12590080170173058066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5464

C:\Users\Admin\Downloads\reWASD730-9159.exe
"C:\Users\Admin\Downloads\reWASD730-9159.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5628
- C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe
  "C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5224
- - C:\Windows\Temp\{711E1135-9146-4986-8277-579E67AA5DF6}\.cr\windowsdesktop-runtime-win-x86.exe
    "C:\Windows\Temp\{711E1135-9146-4986-8277-579E67AA5DF6}\.cr\windowsdesktop-runtime-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\windowsdesktop-runtime-win-x86.exe" -burn.filehandle.attached=572 -burn.filehandle.self=680 /install /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:6040
  - - C:\Windows\Temp\{DD8FDF5B-9255-4CC4-9501-CEC6880E0201}\.be\windowsdesktop-runtime-8.0.3-win-x86.exe
      "C:\Windows\Temp\{DD8FDF5B-9255-4CC4-9501-CEC6880E0201}\.be\windowsdesktop-runtime-8.0.3-win-x86.exe" -q -burn.elevated BurnPipe.{C8EEB716-DE90-4A87-AFF3-78AC89A6353D} {58ADD55F-35A3-4CB1-844E-C53FD843D63B} 6040
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5560
- C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe
  "C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4836
- - C:\Windows\Temp\{A523453A-9910-4DF5-88E8-EE164A45D790}\.cr\aspnetcore-runtime-x86.exe
    "C:\Windows\Temp\{A523453A-9910-4DF5-88E8-EE164A45D790}\.cr\aspnetcore-runtime-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe" -burn.filehandle.attached=572 -burn.filehandle.self=580 /install /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4856
  - - C:\Windows\Temp\{078282C4-2ECB-454E-BF6B-969C84FE8057}\.be\AspNetCoreSharedFrameworkBundle-x86.exe
      "C:\Windows\Temp\{078282C4-2ECB-454E-BF6B-969C84FE8057}\.be\AspNetCoreSharedFrameworkBundle-x86.exe" -q -burn.elevated BurnPipe.{F3607311-E1F5-4FD1-AECB-9683FAF3243A} {E69B6BF7-4D06-4BC4-9944-920138F62D1E} 4856
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:5348
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\System32\logman.exe" start REWASD_service -p {0CEA7670-4CD6-45B1-9133-71A9DC48464E} 0xff 255 -o "C:\Users\Public\Documents\reWASD\Logs\REWASD_service.etl" -ets
  2⤵
  PID:6092
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\System32\logman.exe" start REWASD_driver -p {CC6AEC39-B441-4BC8-A92D-2EC99B921C82} 0xff 255 -o "C:\Users\Public\Documents\reWASD\Logs\REWASD_driver.etl" -ets
  2⤵
  PID:244
- C:\Program Files\reWASD\rwsdsvc.exe
  "C:\Program Files\reWASD\rwsdsvc.exe" -drvcheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5836
- C:\Program Files\reWASD\rwsdsvc.exe
  "C:\Program Files\reWASD\rwsdsvc.exe" -drvinstall
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of SetWindowsHookEx
  PID:6044
- C:\Program Files\reWASD\rwsdsvc.exe
  "C:\Program Files\reWASD\rwsdsvc.exe" -install
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4836
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\System32\logman.exe" stop REWASD_service -ets
  2⤵
  PID:696
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\System32\logman.exe" stop REWASD_driver -ets
  2⤵
  PID:1176
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://*:35474/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2408
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://localhost:35474/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1468
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="reWASD Engine Http (In) 35474" dir=in action=allow protocol=TCP localport=35474
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3828
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://*:35475/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1664
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://localhost:35475/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5756
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="reWASD Engine Http (In) 35475" dir=in action=allow protocol=TCP localport=35475
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3648
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://*:35476/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5320
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" http add urlacl url=http://localhost:35476/ sddl=D:(A;;GX;;;S-1-1-0)
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5260
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="reWASD Engine Http (In) 35476" dir=in action=allow protocol=TCP localport=35476
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:516
- C:\Windows\SysWOW64\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="reWASD UDP Emulator Port <36474>" dir=in action=allow protocol=UDP localport=36474
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4876
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /t 0
  2⤵
  PID:4760

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AB3D1B00CC9F2BC2DBD7ED237C83F0BE
  2⤵
  - Loads dropped DLL
  PID:5388
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5D2BA47EE0684048E2FE7E291303E785
  2⤵
  - Loads dropped DLL
  PID:5772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BB091E53008FCC052B1AA5DA587E6D83
  2⤵
  - Loads dropped DLL
  PID:5892
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0B270704605D876B6CD3197BADDDB770
  2⤵
  - Loads dropped DLL
  PID:1292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5344

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4956
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4bfba3af-f76a-aa4e-a68c-dc2de269025f}\rwsddrvmap.inf" "9" "44d8a0207" "000000000000014C" "WinSta0\Default" "0000000000000160" "208" "c:\program files\rewasd"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3648
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem3.inf" "oem3.inf:b2fe4818ebc2f07d:Install:3.34.0.0:root\rwsddrvmap," "44d8a0207" "000000000000014C"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2328
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{31c351c7-5e10-4b4e-b354-f097395251d1}\rwsddrvflt.inf" "9" "4ffb0cee7" "0000000000000158" "WinSta0\Default" "0000000000000154" "208" "C:\Program Files\reWASD"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2864

C:\Program Files\reWASD\rwsdsvc.exe
"C:\Program Files\reWASD\rwsdsvc.exe"
1⤵
- Executes dropped EXE
PID:5508

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38f2055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5948ba.rbs

Filesize
48KB

MD5
39e200051ffd1b627845d58409885070

SHA1
1a9f70daf029faacace7f49e9c857a50143fd8b1

SHA256
a48e4c63880d4a7c4ee0c1cd0da2c8d11095096b034cd0e261fbea30f8fe72e8

SHA512
356c35f3bcb3ca8d5a088d4451642b22b4a7e8b7abb8343d111079b9d5f6dac6f9595865dcee91221f9fa0c3a136506876fb7ccb856e22ee2455c03c482b8672

Download Submit
C:\Config.Msi\e5948bf.rbs

Filesize
8KB

MD5
33675ad3dfba20d3f9ac8fe817be30be

SHA1
295407270ea9fd9605f349f3261dc11082bde214

SHA256
28f06b74aff5ec9c26027363c0e50db26f31ce5445e729a952ab1d8d9db473ef

SHA512
6a6e736295cc5381de5f991b72726321c6ce4824dcca9dd7ad42244a545b501321e3bf2c39b966c71ded2858b6e4b88f001610c30dda37fc0652dd350e3c97dc

Download Submit
C:\Config.Msi\e5948c4.rbs

Filesize
9KB

MD5
a516a4f68a94f8d055b69b1563acbd1c

SHA1
656ded54ebf85b5f3fd1df4758d7d39d6c8fad48

SHA256
b05ff07377cc8ee6f38550b2fa86f5231437da4e4f5fdc3a98c62dcc06837e1b

SHA512
8bcec3b2f845f17fbdae90ee245e4b85e8a3b6e89e4c2071e7461dd9ad32cebb2b01c26791949d15b3d2447b2370ffbf8e2d1b7c33c5951e5ef6879a86903cfa

Download Submit
C:\Config.Msi\e5948c9.rbs

Filesize
89KB

MD5
37bc55a1d06d913e827067d10d3b3f62

SHA1
c5109664f6f1482dadb1bf6384b1a7cfb75d1fc5

SHA256
4ddb8a8d994495a7e201bdc95ab8d9fa543c37cd201dcf15f955dc8e0abea2a1

SHA512
593efc86eda5c8ade082b325193c6c77ccfa1ddf3b232df73911b7b66b720edfc79541ca2af04757f03956041ae83ec73c4cfc18476fb0e3749e34c3620f6b71

Download Submit
C:\Config.Msi\e5948ce.rbs

Filesize
41KB

MD5
e02d4b7e8e41f3223bdc204c805a7d77

SHA1
ce6d384b89ed5695cd9329d10e64addfe0013e42

SHA256
18fe421c70c13238a0c1350316fe5c9e1e8bb25e6cd2ba5ed2563470b080f2ae

SHA512
7a89ed60949f83364d0a48aa24444dc8bcf8117187999573e8907a5f5f446adefb87404bcfa69aa28397e00d4bd367e4d5d05ec9a734436be046694ea44f2eb4

Download Submit
C:\Program Files (x86)\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt

Filesize
93KB

MD5
90630d9ee3e0a5672166a45e00f79a5f

SHA1
d1148f8c7558e9b8a81bf1f50f9e3bed89d9928c

SHA256
1271701f435f7fe4aa81dc7e273ca80b6391b73580ee20b35a956052c95de4cf

SHA512
29e10bd57d1c580ece70b9b7c4a69dc036a5a64012eb89ba360a71be6b808150610ea0737351277a3d4235c02323fabef29f092fa6b2a40f0289f55a7973e93d

Download Submit
C:\Program Files\reWASD\reWASDUI.exe

Filesize
226KB

MD5
3a639fa95d0f0779d6c7d84614ce1946

SHA1
b7cd15cae5f30008751399397948902d45eba0f7

SHA256
063274565bf6cc0823fa50ddd0bbe11160535971a6cf705010d4cb525b04bcfe

SHA512
6998fe3721953dc81c4a71555432da6486b4f48ba92120aff8c0a624c65facf8d2c33cf36703fd10bb65c240336c1c78fff200c8f141191c99031c13e046ace4

Download Submit
C:\Program Files\reWASD\rwsddrvflt.cat

Filesize
11KB

MD5
95222a45820aa96e72091d84af5a3cb2

SHA1
3c118ebd3112eefd4eab3c939ee7978e59856849

SHA256
7257b13449e11a368d75b295849f3f5398a90ae59f255c2f03c4f0ba09496b07

SHA512
629cf30bb5de820d79d2d3cde9178778cf34c671dbbf0207da3ef6ad8b1bb60a020e7d2c71e915788305bf976d79069c088fc328bd0b253d74697efd2f60902b

Download Submit
C:\Program Files\reWASD\rwsddrvflt.inf

Filesize
913B

MD5
5c2e32a5b5955382154f396c8bda8e76

SHA1
7558ca54e7f4bc9c02afef1594cd5ec417df8d29

SHA256
5431730d0b1f25116f7c93c9f6bf625219d8c61143f90a60cb1813b6489ff82f

SHA512
0abab2ba431b1f178bf8a823cdd391298b05707a871c25b1c719f5731eb80be1459cc0d33225b8fa1a6d8acedc386a7fa1eb455f96edb426e88d57c6aac53f09

Download Submit
C:\Program Files\reWASD\rwsddrvmap.cat

Filesize
11KB

MD5
aa919c610710fa85092cd71fba71277d

SHA1
b45965b82145fbbd31899bce8da93d5296781314

SHA256
770d5354553760efa6b4b3db9f031651a425442b2b1c9c69213a6a76d69a8787

SHA512
f050b2a136cf985a35a179ff92ef398d2cc6e2fb8e189b10f14b71f93a791f3623869d63f23b29bb88cebfcf1e7ae3a0c6f1ab66375f8262fc86fb61eb848f6f

Download Submit
C:\Program Files\reWASD\rwsddrvmap.inf

Filesize
1KB

MD5
49162a35dab50095a3e7c46a740c71d9

SHA1
ef6064bfd6e5876555cb0adc74f75794b55f8df4

SHA256
2758a29b128326294db51a17ad6523ed3293452430aa33b3c326f9092a40cc37

SHA512
943958a8927d3ac947f0b5121befe1600352204868f3e260304e50e116944ca3a1bef85a66d76a37e9052783e83ad10e06b933a876bfa2acb7d82406aa976903

Download Submit
C:\Program Files\reWASD\rwsddrvmap.sys

Filesize
329KB

MD5
73e88f94bd4189809d1a2f999aff8a62

SHA1
7ec6428a3b579713f6069487c2340dabc208273f

SHA256
f920e5d33aa20e5ebcf4d41cb4a1dc4527591ec45c6db6bccfb4f01a45494b26

SHA512
320c21e496929f994c4c159486af8c5d76b2a3d95446f7523df73d3affff747669ef8b24b6a0a2110dd78a4d7e99c109177123a1f9ac5ade84959376c8d0d7e9

Download Submit
C:\Program Files\reWASD\rwsdsvc.exe

Filesize
2.8MB

MD5
6d23582deae84f7e0a3d41b0b319f342

SHA1
1a1e294b79ce2700185706ad5e8c4fbf6efaeb13

SHA256
156f2994ed0233cd16c405c99d94614cd3cb29a1b58cfddc2c17f4d5d2b8304c

SHA512
f50969e82c3b1ae52ea5b89d0d736548f5229c4d56c9aa8258eb2678c968a86dfcd75de29a3e5b0b51e8ac8dd1f287944e12b175bd68fbe6e67e07f194dbc946

Download Submit
C:\ProgramData\Disc-Soft\reWASD\Settings\settings.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
903af17ef6a686b6f9f017af6590fdd5

SHA1
4fba9caab0157eb30b7e30b684200d06cc834efe

SHA256
c7960a770885b30d659d16862352f262d959849a13e729d2332f3b26f7d035fc

SHA512
4f638e1a1c9094a6b239585f022611b7d22da286f38a7889470999ea8bb0043feb1bba62f349ac5562e61387180a6776574ef156ec81de949a2ef5a779e5f694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
98971da46697f0d8efc98f10fe104662

SHA1
48dd515fbf51b0046c5d17270b3900dee9c3c6f6

SHA256
085443329a78f24c361047021b7bae3bfd52381180d491560c1183e8119c5620

SHA512
7b7b1d332b2c630c1fe6b4c73469587888dd6a649d4b84fd8f4924967eb2b0cf2fbd4ba9ac345e3d420505b782ae4e46a01966775d4ec5762883c96d96798305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f46e8a9aaf2b29a5af98c1c1180de7a

SHA1
bcbbf3221ea4145fffc541128aea7a7862397b21

SHA256
521499399e5a7fbe48f236b9d73b3f3c9c7b5c81277e21f35b1d3875a38a5d16

SHA512
eab33c73182b1554e5f4e92a1beb1101ea369253677939896be9c4be41407534bd85f7bf916a3b0458869c3e131c16d762947e58cc82c999d7f42ebdfc438b92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8d920a0f457d8a6755737be2157e2586

SHA1
160b8c5b9d66d1f2d5d862704c4565f4f18bb12e

SHA256
39fc709fdcf56cecb2e95275182f07af45e25bae9d8584a26d141f209a72db9f

SHA512
cd69c9d857065e1e2d23149441e9c07b63e22ed5421fa11829719dcd5e132ed0a37239b3bd0b7ffb7c71b4b4ed6a2ae3313357e0c3f7ec93f19ca47f1dcd2778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e1efa908434b84cf678fced6c47337cf

SHA1
5095b7b2aed7085c866da21c5fb03b487db29e1f

SHA256
e0ede42d8c68a1eaf68b0237127d3fac97ed24e9eb5c1d05d511eb757815039f

SHA512
8e233e7852b86fc72d2ad6788106b6ce70e29c5dd0ee07997f61f2a86c3432a5f37d0e11347403c52705e3270c84eea02c37874327243a4a60eb18b3f63bb4ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000003

Filesize
20KB

MD5
e8e1f8273c10625d8b5e1541f8cab8fd

SHA1
18d7a3b3362fc592407e5b174a8fb60a128ce544

SHA256
45870d39eb491375c12251d35194e916ace795b1a67e02841e1bbcb14f1a0e44

SHA512
ca77d40ec247d16bc50302f8b13c79b37ab1fcf81c1f8ab50f2fc5430d4fabc74f5845c781bd11bb55840184e6765c2f18b28af72e1f7800fe0bb0b1f3f23b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9a2816ef45e1f1cdb165f3f23873968

SHA1
212e9bee58b42a30ce82be4f58a1b1f4ba919c93

SHA256
658f217cf426dfb163947fe97082dc14815e725f13fd6a81c1501d1170fa95a9

SHA512
193a9b0c701909c3783f6ebb79ee0e5330b85e87b0616436f7c1fc5b08d60bfc2737a9906b62995f1a1e0d41d7a3e037246b2df80f34d542a5d82bb87dee8d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
95c5105210589ad981236bdf528b579a

SHA1
8a86d3949a5e95c8b833c4630f3f9cab0cfb9bb1

SHA256
aec36759674c1badfd4f40e3310c732a198c8619c3b695ce9b0e3c2262bb54a2

SHA512
80eb83d445c496fb3e70776f89b89ad0afbb47aacb5ec0af34e64abee05b9faebb18476f216156302772e10bee20b1fe45c191b582eba69a3e260a8779d96124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ed479825d6ce3f360fa20961ee9fff03

SHA1
29c872192f225cc4dd0ff8dc37403a2c407a5f44

SHA256
c6696a3dbc3b9957ca18b5716c594ee43cedd082025e1f1e04ead58789350afb

SHA512
d9214fbf5c5e140a6390d39b6277508d2d0383e866dbd4b44e50ca5cdba7c7ff78ed6e831091b10211d03ade693dbfe0ea02dce6619ec230047dd77a235cfa84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.3_(x86)_20240721190436_000_dotnet_runtime_8.0.3_win_x86.msi.log

Filesize
2KB

MD5
bb660bee1a432993e26786c61ae60b6f

SHA1
23eedc97dd7d2631a3a71991fdf707a045039e5a

SHA256
201844e0463195172ecb7d48c989c06be1b77ccb1fa751d786107f07e0c355b9

SHA512
233d81a161996d43e12803ae517b9248afdff296a5b8559624461a4e4d925b32c795ac795f539541bc7883ee35ff75380a0b416cc7b2213ac7f45a3387df0c16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.3_(x86)_20240721190436_001_dotnet_hostfxr_8.0.3_win_x86.msi.log

Filesize
2KB

MD5
4655906d7d2a50ec332948804df434cc

SHA1
d588e90a08567dd6af51c561f7da3ef7c585b83c

SHA256
6977b9c637119e3612e5caae4b497334d833e4bcb74520c3b41c41f04828b7c0

SHA512
2a15bef1acb13993ae4e2285e886734efe09b11a2cc8d6ff1db88ccb82bd246c9dfe78bf54b2a293b2a16f3e9e9bc93ba6b0f741e741224294f1277886ea20eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\7z.dll

Filesize
155KB

MD5
ad71a5e3a757aef0329aeda567f25a00

SHA1
97c766d85c9dabfcabd5a983fe165506d227a8ac

SHA256
f6b9ae6eaaedc55db0e381ec153892c122f1f257ada80cf242a20be8a2f117ef

SHA512
6852496fb8f59bea3ae46efd507d654ae27306d9f4f2f0dc0db8b03f9f63a3712e075b12f0ebdf6ea88db081fca4dd29be1555584aa70386ccb8297beef886ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\CHS.dll

Filesize
89KB

MD5
276a9f7cfea1312a4c85a31a685cc372

SHA1
3a3423b1c69c588f9dab5df8a951ae170841fe8e

SHA256
d5d958411a4034ce69c6dcf7eb3a5576a23f8a67d5f56a8068e512945e986597

SHA512
8372ed08f73c81c17256c757ede5e88cd3ba772fe3e60ebd9bd899e9d83a84bac5ba9afeae4c94c63bebe5c73fe221c7bc9374636c013cc4792d47aef65c3419

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\CHT.dll

Filesize
89KB

MD5
1c66824f604d3e9ac957fcc996112d31

SHA1
193ef3a1288534c569ea770b6a2adb8b2a078ad0

SHA256
21568718825fade0beaf9e6cb15f11ff2ffa7931c95a778bfcfe76118e23e3cf

SHA512
4b60a970096e1a3e0eaec095ef23892b1e5750b9022232c0116f447341747ea845505443614d8bcac0200fa71cefc6901753e953375f5292610afdb053d8beb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\DEU.dll

Filesize
222KB

MD5
1b76c750897c0542bbe7fc4ec6c3d532

SHA1
77bb7ab6eb0ff81233998f16f3e7c26e371ce90d

SHA256
528a240f180311cf32e73a14ad4ec563d97211e9c0a1815da890a851fce643e0

SHA512
597a6a5fbe9936117e0fdc8042003876645b13dc4d1906afb3e5d9852fb011e551c641fe8b5a7d7ba65c7d77c87662e8a24b8b3e241e71d08f4ac668d3707688

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\ENU.dll

Filesize
185KB

MD5
854efbe6d105134bde9926a0aa1e6092

SHA1
566c1635705ffb5145c221eb6b5c7d086297a1ee

SHA256
292221cc99e3f15802c3c237949323e0c8e7cd5807d2ceab0592924a204238b8

SHA512
735a4bc5d261248b96edd1f4d8e7947157d0d1248973c97ba7bdf21252e9ee4205445e02447d30865d652db7cbc7bd1e59086b3fa0b4f3621bb22385ae5f4b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\ESN.dll

Filesize
213KB

MD5
e26c5f6549129b965c3e3832f70eebd6

SHA1
85a2b254d3fbf40b68960799ddece932d607cfc3

SHA256
07e84f79a7c515c465caa372042ef5e1f94fb5bf4e48d2476fd2d2dc34a9e6ac

SHA512
f508f01643db3d0287add14891a3e4dcc86a1f646e73b8684be0889b0863adf0bd6f4d5e46b845011ac34b4ff304e87bda5fd09fb51ddb63689741c94276f196

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\FRA.dll

Filesize
229KB

MD5
63dbcca7a305183be3839e6fb4693441

SHA1
418f7aedea181d5ec589ebeb61ab3cd6842504c3

SHA256
3f1136d147c8021ae78937e6f045be6f44593a96e498371d2f92d3b0195fd818

SHA512
cc184e2b35059bae227362fbd682909773dc59c118c0abcc7f9dc241a7891597eeb61529ead2b3a6ad2e687dc0068af34d2503624eb1a3fe64fceedb9402dbaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\IND.dll

Filesize
203KB

MD5
802afb525e3188c8ba594504df795ae8

SHA1
fa5a1015a91c062b51592515dc374e4180078cc7

SHA256
75ae709c57141499b3ba5abbeafce1ec715569eb1fd1f764e27a0751703c3d61

SHA512
c7ba2e59c64e8f09e16dbaac37b5aa047176a59b9becec4465c1f50c366277e52b3f6a19e24b2e688bf7a6de2797fa449aeebb98faf40d55d81258be5e83b7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\ITA.dll

Filesize
216KB

MD5
33be435d497fb8e0e30ea905cb56ea4c

SHA1
0c72799631cf16c6b60bd890c2ec9b26aeaf372d

SHA256
ad3de6891ae21e140abe02d6c2c2d53d669902f64819a7c3e943151f8950451e

SHA512
2cb1b15c0be0f8c328c39ae0816612e6aa790fea8a64fa5eab288da3487fd4bc5c97e724472e0053f495a437f19bd1e10986fde8c4ed8e16335eec032acb6f20

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\JPN.dll

Filesize
116KB

MD5
b02d7703483fedca31d3b357704bd1b9

SHA1
7319b202820d338ba275b0959711591b9ce70bf1

SHA256
af7de453b90165b3e4b445c90e99ba9f7a6a63dcf472e20921c8c5705c3dc99d

SHA512
e2e26cf506fc25b71cf5d6d5a98c50aa4119b59137f43d263283be16c858534b77060cde78beb7a735e1b2e7e9bb53b402ff9e201a6acc223eefa54020b51220

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\PLK.dll

Filesize
215KB

MD5
76aa12980798497494e192c0f4572d7a

SHA1
79c42595ade5b6eeabd3243515c8dc6d7302e785

SHA256
db002accbbcf154378ed81cd671e18d469f7a0494e5fd9af80f80b1a3cec6ec6

SHA512
e4ec21947ba8512e36cc31a80178bf80a99f89865426c517b4b47a284fd8f867ef3c9411973a92c87e95aaf0a170573af0018280a1e9cc8b7f047faf9235ff8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\PTB.dll

Filesize
209KB

MD5
14bbd08c70464b1ba37f9c87f87bf3df

SHA1
12a88e0247da0873662ecc3e67fcad317d2e6e84

SHA256
bc47763d069a804668fea58e89d641b9b2ecf1bbce3d1a334618316ef4e20434

SHA512
531e58ac14eeb2ff41171a71b8af46f33463d3f8296b2268df0049b8877c180c62ed4b43966b854d6a721043a1da19a85c580ea3d226f3573df8316ceb3d5a8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\RUS.dll

Filesize
202KB

MD5
445207d041671fb1e8b19ac35325b55c

SHA1
2823e112d4cce4a5c78f92c15a3c189eebd95530

SHA256
ea0cdfe756666444dce22acec419d7265822ae7f758be8922a3cea4ba3e5e10e

SHA512
42dff1efd31e5c763f9c89d208a22031aec92eae7fb822bfcdd14c58dbc140ebbff943fbaf98c26024e2b9d9a3a35078d6eae68f497e93a8e1a5c9b4cb7d84da

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\TRK.dll

Filesize
215KB

MD5
dffe73ac7464026c9182d34b0e0b4925

SHA1
ddc1a9a7bc4373f786c096ea26c8f9446be0a255

SHA256
e30d38ea4e0be4cd994b392e3a1226bf78cd796b350f892af9d0e7ee761528c1

SHA512
69551233c67f6913d8987b230d3c9a23d20072f716698c17d15b18f81903c35f75372d5f0b1e12299900e4e5c48a2b59d8975e9513dd0f33fc831c338d55f484

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\UKR.dll

Filesize
200KB

MD5
0bb627c8e1e00919e4d1114e0b49e90f

SHA1
a7c7fa6983b496793fa7c8397111bf169e58d655

SHA256
1d095e592bbaa9e54dde0a4d7620d0c45f99fcbdeda80abf40f930195ec67fb9

SHA512
84845aa0c98708c6d2517d653197f4ead085630f4a7178f21b0a9bfcc0f128e347082fef4973b613722d6c7a6ff812975bdbefddc1783f9889360cd6bca12e2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\aspnetcore-runtime-x86.exe

Filesize
9.2MB

MD5
d71c59dc3bba98e4f79f24fc52fbaa86

SHA1
371471968dbb45311e1161340ef7ed9edbfe8497

SHA256
5b03336ad38f7855611b7ccfa4beb80ec07526b9c17bc0eec27359ca8e9a60e9

SHA512
16f0226043d4ce4a47538f495cd77363273c7286b1be518b6b32ad0e2ca3cbe268b4cfb3fb43ed4a9d3a9176b1986a399fbaed7f6c432149f2d16c67105449d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\reWASDInstallerResources\setuphlp.dll

Filesize
304KB

MD5
57438b9790b03e74d3c35457b699e9ef

SHA1
378fb112c253954d13f1e5751b22eb1bab7a6ca4

SHA256
adfc0235283024cbf209340dd2eb74dd0b1899f3a6dab882da7843f03c9e58b6

SHA512
c825a03b5c1d765b96a9aa393c5fcc41b66b2d95f4be1c37811c1503a259365012dddf28207a9ab65f707653d61882bd7a33a65fc9b95efc49ef98717556ba34

Download Submit
C:\Users\Admin\Downloads\reWASD730-9159.exe

Filesize
30.6MB

MD5
077e49ec8d55814925e412aca0175b6f

SHA1
1378bfa2ed437696752cd5421e0d9470d16a5227

SHA256
f2c301316736241369ed85949c19855ee979e5dff60db4e371f523a20c2f92e9

SHA512
fe44d317699840e2db5e1c07ddac0e261fc6b97a086ffc25f26fc37c7e119a7cd731aad904e47d04539984ba490cd6a85dc31be876b47a89c608628aef6ecb49

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Fortnite\Controller\Double movement.rewasd

Filesize
3KB

MD5
712dfaef8373af26e0a89c8592eef0b1

SHA1
663b9164d6b35b4073ea23dbb4f71cbf73d211d7

SHA256
662756e39a5f057c5edecc5464a7b79d1f9a5494b3f4f30beca72dff5f4727f4

SHA512
49b7316203f5240cca5767b8592adcf868cce7cb557adbbbb6b04200c4a45e784399bce5e0ec647e8d9eea2110c366405c27bbf872442c8438c72fb07d3bcc0f

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Fortnite\IcoGame.png

Filesize
269KB

MD5
9ab8cbec5b61357684f7ca436deb1fa8

SHA1
626d58fcb5544b74466689297b429ba021b2dc05

SHA256
de828b711dea56563a009cc47642c54e5fc38fdea37d8a7677e8f8412bd7036a

SHA512
a05a49385b5fdb1a246cfbe84c8859a2d38c7f3b275fb87f1519aac039b0293ca31ee88498149bed249191b63f7e45566fef315d9d5dbd5657c286ba83effdbe

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Handheld\Controller\Win + DualShock 4.rewasd

Filesize
27KB

MD5
4afa72c35662fbee90060743d69f5643

SHA1
8b0587920fe01e2532ca346f84403c8acc32e156

SHA256
e2c14d6d7d374a2962358dce5c454b6ca9bee0188567734449573b63989285dd

SHA512
c74146c519a3e4e1ed96be6718227e6baa906ff2c2b2de99c18668598a588ee990ed90e01ea0a81520d7094f4d9115c812ed3611be75971ab33cc5b15c4ad063

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Handheld\Controller\Win + Xbox 360.rewasd

Filesize
27KB

MD5
aaca1b62651ac6a0032a3f116df2802e

SHA1
40f86d5d24582d1ce084356417fc6cd8e70c0b4a

SHA256
ed4b4ea60a261712b5ef0554ef66ecb107516cf0877b4d22fa205a5528e3090d

SHA512
5ddbf090e6bab4afb4890527b27c2dc9a721f5f74d92dbda0d2ea84b513285f75d1b2dcffbf16775f2baad69e94bb829b6d23d853ba3321092354491e0a82f86

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\PS4 Remote Play (2023)\Controller\For Keyboard & Mouse.rewasd

Filesize
69KB

MD5
188f2439da63508db4ee0e025b7ba918

SHA1
bf1a3c9a3c4fb09a3ff006a0dee659c2170a2f19

SHA256
bbeee0fa97e19ca6c6bf23663a4fb465507daa784714182fdb02f9aea4b07e1b

SHA512
a8b8f9ef79599bdab2d0ba5d4fec0e7ab94369f28a4a515bfac8b359318eb93904b3cba866712191cec475baac75e482408a6958344785737b3c578c1aaefae5

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\PS4 Remote Play (2023)\IcoGame.png

Filesize
453KB

MD5
ff596ab3265df6db369996ef455e90ed

SHA1
920df613e33223eeccdf07b82ffce4622bc5ca50

SHA256
e09a2f1a9a04efb485bf35c402f5adbaca1821e6ef05ba9f65414760c61473a2

SHA512
8aae92cfbdfc7dac570b6b5e5ff381a5329cfa8a3c6d0552a48dbaa2432dae104dc16b8b7edf34e0c63ed6dbc6c38bb7a519473232d1a7033a1e8452ee27a03e

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Switch console\Controller\For Any device.rewasd

Filesize
69KB

MD5
01bbdf8e66318cb24245a2be643ab670

SHA1
92c896fe8b7c2e9f6e27de7a80ef477135cf49e9

SHA256
e7efc86ef882c162fa88d2764b8b647966f5a5e1bc631ff0781baebaae143643

SHA512
9ba6c4bf82ff18d7e5f5b117d0f2e1a1213ea6504321579b45b469ed8cfa2d3c8f7860424ba9ab8cb161fe0eeefbe68e09058e98dea52d6ab3740d98ffbafc01

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Switch console\IcoGame.png

Filesize
484KB

MD5
7ba44ef4cf5b25558dfd9561b54c2449

SHA1
05ebf7587443386df5fbe0945a90c10c6f07d90b

SHA256
feea7a36e5ba70b36d2b501cdce652013f35976d049d5e154cc8b272774b9b27

SHA512
68dfad91cb16229fcc5bd8c76b3d51a34be411fc297e19fcd9a6627354470b9da38274830389529ce5918190e033799eab56762943c7559ebbd9ebdab56d571c

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Switch to Xbox 360\Controller\For Any Controller.rewasd

Filesize
406B

MD5
1ccbe7c61f22e6ca768d51c36c92b9b2

SHA1
5e829c21a646caaddaf89e600cd97b77f8c01f5d

SHA256
6c8a54e671b04a51859478e5b2c28c68f54d32936035f55d345155e6b4603418

SHA512
95681c357a40ab9d23b8d4e1484847f2636a9117b1ea0ca1cc11231b8ecccdebec4f80f23fc2bae403d2bb3422260d27ad6ae5358d3758714bb30409052c5596

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Switch to Xbox 360\IcoGame.png

Filesize
880KB

MD5
eacfdfbae6e6d7e6abecb58a73e812e4

SHA1
6b6053164db446d1d772d9ae6ea3cc0af7dfc34b

SHA256
5e0499e1f33b85867c1aa36bc1b86aa2c86aa3152814dcabaa2e8ccd0dd9e2ab

SHA512
5c3fd1f39744a6521a6de72ef805a03d9c58d06970de76c3e1741969f74e702460d0efe25f8d6d406e86c70150ec4de4e8b27b8f7f57f6756352c713540b1d63

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Valorant\Controller\Any_controller.rewasd

Filesize
22KB

MD5
95398465e031f6aa67fbde011bd23b5a

SHA1
3b4643da4365d067988f950924ae23d0837662bd

SHA256
519503549126c4a080ca0b332c76c68151180f8ac25bab1e9d2513ea02a902cd

SHA512
742471447d4b169544913139b4b158b2140275c73de8b55eaa5f486d75072a9bcbe8da39358f1314d0e3108e967b26c13f486a87963101d63a87241bd5b67093

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\Valorant\IcoGame.png

Filesize
240KB

MD5
e56933d3a93b7d69deafd34dffa18d89

SHA1
5c09ea645c024bf181acf4c87e7cd3b0242e5dc5

SHA256
94e53c0aaa54729fa1d8674e40e21e2bc1ee5202c97b47f793b72db6841ef954

SHA512
1754ca46b62f18e5a58467ec3594b8f21cf113fc7549db5239f88901d4163ebdb236375740938494b39162d2e4f1bce9be601efc0015c6954d74a5f7b70c39cd

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\xCloud\Controller\Kb&Mouse for Xbox Cloud .rewasd

Filesize
67KB

MD5
a4c5806ca8cd2fcc97e82524187fcba2

SHA1
9b123e06d51a013f3d531c9ae0a98d68f515ebc1

SHA256
b967a6756ef795a0c7581d20bc2f5c277f67b0eef29ca7b0d0c0b489bb81c2dc

SHA512
1f981d2b9f2a8b1dbc635ffc996724ab469636e8ebb00229f97329a121f60854415a29891296a41cdfd75b496a343867995c281068064c9e7a38fdddcbf31a34

Download Submit
C:\Users\Public\Documents\reWASD\Profiles\xCloud\IcoGame.png

Filesize
218KB

MD5
424b4d94227424765577ea368f34ed53

SHA1
b6f4a04014e8a1a10eb42686a3437aacf28889db

SHA256
f535c85f2365f786465c8c3218ca36180f53af5c56a3d09218abe86a30da7594

SHA512
939dfa90a6ca9ed812578922643726bf2e7119ad6e47aedd327c92d3925ae5e4706e00fe7d670f729fd962587cc313d6d21fa01da2c7206d7b5c1116d45c35e3

Download Submit
C:\Windows\Installer\MSI5461.tmp

Filesize
244KB

MD5
c0777f5c9995b8c0b08ed33cee7e1008

SHA1
12f08bb8febedb3f16b22bf94bc47c5c3910a477

SHA256
cf531f10cb410f4825bab4fd4b15df8e02cb9a18505a3a3b05c4c2f4ccaf90d3

SHA512
a3478bc42730169abcb7635f1f73bc8b1a639fe2094c7e3866d8321b6efdf0740f8867dccdd5fb1b12f73b8e89a51758280ab9c3d184d36a7b86f3f91ac9dc0a

Download Submit
C:\Windows\Installer\e5948cf.msi

Filesize
8.9MB

MD5
52b794ca478228fcf4a2991ccf2e02bf

SHA1
3d60f16a63486637c625f693401abdec2274eab0

SHA256
cd1b376c4e88866d709a06c85d0095d390f91639b29806c4820dfa2bd1f3cc34

SHA512
e2b7f4ee52cffe84e1a8af4910b0836fbceffbc860405ff409ca6ba3c181e1f6ab1956d81cfc212fe97c0a8ca81ce316b9ec53ac1bf8097413625a7c73ff2205

Download Submit
C:\Windows\Temp\{078282C4-2ECB-454E-BF6B-969C84FE8057}\.ba\logo.png

Filesize
12KB

MD5
84709eb22e4b05688067699ca9b0d322

SHA1
7c3381d8b6a58087cda95577cc2d25e7aa2c21d8

SHA256
c8e23a42e04fbd73f5f66f3b9f2ba34a777bc4769c413a0f78335a4e757baad5

SHA512
04de70b7317ee1cbde73ac0fe84bd70983cf0ff7e769e5f9626c69eaa6e3e9724c95b14ccb7a5478ee639848d3f8c98e4dec599cc5e33ad71de638da589ba319

Download Submit
C:\Windows\Temp\{078282C4-2ECB-454E-BF6B-969C84FE8057}\.be\AspNetCoreSharedFrameworkBundle-x86.exe

Filesize
615KB

MD5
a2f197252858376280566098ac779f1e

SHA1
b9bc74545bc11839025216b43fb1bc274e8865ab

SHA256
9143e60c28fd6d82b79dcca4f5fc61876f10e2376242d81bd3df2c1677e6f01b

SHA512
50dc074f436db2242d1245b8506357b7af482a8f61e863dc272e942a9ba21a83aaa9f506e68ba3bd41278fae93eaaa6ec36d24b6d44fe8aa2fbb042d17f39935

Download Submit
C:\Windows\Temp\{711E1135-9146-4986-8277-579E67AA5DF6}\.cr\windowsdesktop-runtime-win-x86.exe

Filesize
635KB

MD5
47b63cad653dc2adc715a83b1a97e0e8

SHA1
1e60af79534ad33b7bb4aa2dfd27c2102dd12741

SHA256
e6ba36b1824fe82c4b333896239ec69d2fdab970253882af8691f2607c72fc2e

SHA512
d6c4a693fa994dc6aae9e585ff27eb46cfd318237c544e328fd5b65ba3ff64d6a4cfd40e6f27108f69efb5df57b00964d6079d0bb28304e3390dc6ab355fc52f

Download Submit
C:\Windows\Temp\{DD8FDF5B-9255-4CC4-9501-CEC6880E0201}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{DD8FDF5B-9255-4CC4-9501-CEC6880E0201}\.ba\wixstdba.dll

Filesize
215KB

MD5
aa531c5359ebfb8204c12e774c7ef280

SHA1
1a35e2a5d9d9c51ff59279fa3415ad0346573438

SHA256
44b362b78639baccd5c83f0b224a206730b1276fab849c77fd1fb17db2f07014

SHA512
49e13931d6575655ddbc1da4e09484dfee9c0308c5d071470b1d903ac37819730c6b7c7fe452f4425aa3c5bb18b1c0b16f189618517f81c378cce75e52b46722

Download Submit
C:\Windows\Temp\{DD8FDF5B-9255-4CC4-9501-CEC6880E0201}\dotnet_host_8.0.3_win_x86.msi

Filesize
772KB

MD5
294781415f09e281929c46e09dbe6021

SHA1
8a8e76eafd473692deed53561d6e1d05fc76593e

SHA256
8436264fc25783303c0a86517d9c3c2b986401d3e4207ca81977a53820ba5247

SHA512
d42ca21da198b75c0bc3870bc1987bdc30945afe9dbe6dbeb8bf5b963cfa9b7842d6261993c1639b31eccff2211a9b8ef5a2e93d521292342d9521d861eeaa84

Download Submit
C:\Windows\Temp\{DD8FDF5B-9255-4CC4-9501-CEC6880E0201}\dotnet_hostfxr_8.0.3_win_x86.msi

Filesize
828KB

MD5
f9600d32247218e2aa26f71dfc180be3

SHA1
3483901e85e60fd801542b5fabd0200578f0cf0d

SHA256
479dec4aba43cb645202cc4aeda2fee13efe84316f17ae69737ef4c97f8d5aa0

SHA512
2209712339e987369755acddf32a138b8d27f14887a5535ede41f8bcc534ec9a0bbc8f1cf08578a7a9a34d5704d78709fd37a368de870483e021d31551e4618e

Download Submit
C:\Windows\Temp\{DD8FDF5B-9255-4CC4-9501-CEC6880E0201}\dotnet_runtime_8.0.3_win_x86.msi

Filesize
24.1MB

MD5
134b25b04e4539a6254a3d4c23949113

SHA1
774aaa31ac4beb1ed2019a872ec645bb97ebfa9c

SHA256
7fe867831099aa8db41325ac5b8d161a4789899df036b19852e5588208205147

SHA512
fa94be7a5894cd62a42b319a4282374e2c7d03d4ba6e6f6cbd70ff2a8a0e0713ea2f3d625a24341a12fb2345165d6222ce74ad531f972ad436de98c207d77ff6

Download Submit
C:\Windows\Temp\{DD8FDF5B-9255-4CC4-9501-CEC6880E0201}\windowsdesktop_runtime_8.0.3_win_x86.msi

Filesize
26.7MB

MD5
f4e126fa58b4b8d9f7b6a2ee3bf5a441

SHA1
c98f045fb1f97dc86588c3e322b75a42dd1f0db0

SHA256
4bfc9b09c9118c226e5cbd0c861893816c3c601a24b407c898294e8944c344b4

SHA512
aeb93bd48c34047a7c5ac85e62a259e477e5c87da602be7ccb7f09e9f5b1de672cf64609bbf08ee2d7909039c1beaccece5325d3d4f9d8e8d0dc5758e85c207f

Download Submit
memory/5508-1701-0x00007FFA128F0000-0x00007FFA12900000-memory.dmp

Filesize
64KB

Download
memory/5628-343-0x00000000088C0000-0x00000000088CE000-memory.dmp

Filesize
56KB

Download
memory/5628-320-0x0000000007F70000-0x0000000007F78000-memory.dmp

Filesize
32KB

Download
memory/5628-319-0x0000000007F30000-0x0000000007F3A000-memory.dmp

Filesize
40KB

Download
memory/5628-310-0x0000000007B80000-0x0000000007B8A000-memory.dmp

Filesize
40KB

Download
memory/5628-318-0x0000000007F10000-0x0000000007F1A000-memory.dmp

Filesize
40KB

Download
memory/5628-341-0x00000000084F0000-0x00000000084F8000-memory.dmp

Filesize
32KB

Download
memory/5628-344-0x000000000BA50000-0x000000000BAE2000-memory.dmp

Filesize
584KB

Download
memory/5628-316-0x0000000007DD0000-0x0000000007DD8000-memory.dmp

Filesize
32KB

Download
memory/5628-342-0x000000000AD10000-0x000000000AD48000-memory.dmp

Filesize
224KB

Download
memory/5628-309-0x0000000007AE0000-0x0000000007B80000-memory.dmp

Filesize
640KB

Download
memory/5628-340-0x00000000083C0000-0x0000000008400000-memory.dmp

Filesize
256KB

Download
memory/5628-234-0x000000006EE70000-0x000000006EEBF000-memory.dmp

Filesize
316KB

Download
memory/5628-213-0x0000000007970000-0x000000000798E000-memory.dmp

Filesize
120KB

Download
memory/5628-212-0x00000000078F0000-0x0000000007966000-memory.dmp

Filesize
472KB

Download
memory/5628-206-0x0000000007320000-0x000000000732A000-memory.dmp

Filesize
40KB

Download
memory/5628-205-0x0000000007430000-0x0000000007442000-memory.dmp

Filesize
72KB

Download
memory/5628-315-0x0000000007B90000-0x0000000007BB6000-memory.dmp

Filesize
152KB

Download
memory/5628-195-0x0000000000AC0000-0x000000000295E000-memory.dmp

Filesize
30.6MB

Download
memory/5628-317-0x0000000007EF0000-0x0000000007F06000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads