hxxps://disk[.]yandex[.]ru/d/LdNFOFnpJ78Ahw

Analysis

max time kernel
336s
max time network
339s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://disk.yandex.ru/d/LdNFOFnpJ78Ahw

Score

4^/10

defense_evasion

Malware Config

Signatures

Hide Artifacts: Ignore Process Interrupts 1 TTPs 5 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2588	powershell.exe
2320	powershell.exe
5284	powershell.exe
3740	powershell.exe
6056	powershell.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3419463127-3903270268-2580331543-1000\{843824AC-8475-42BC-A8CC-CF9D4DCFDCF5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
4816	msedge.exe
4816	msedge.exe
4556	identity_helper.exe
4556	identity_helper.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
624	msedge.exe
624	msedge.exe
2588	powershell.exe
2588	powershell.exe
2588	powershell.exe
2588	powershell.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5284	powershell.exe
5284	powershell.exe
5284	powershell.exe
5284	powershell.exe
3740	powershell.exe
3740	powershell.exe
3740	powershell.exe
3740	powershell.exe
6056	powershell.exe
6056	powershell.exe
6056	powershell.exe
6056	powershell.exe
3748	msedge.exe
3748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeIncreaseQuotaPrivilege	2588	powershell.exe
Token: SeSecurityPrivilege	2588	powershell.exe
Token: SeTakeOwnershipPrivilege	2588	powershell.exe
Token: SeLoadDriverPrivilege	2588	powershell.exe
Token: SeSystemProfilePrivilege	2588	powershell.exe
Token: SeSystemtimePrivilege	2588	powershell.exe
Token: SeProfSingleProcessPrivilege	2588	powershell.exe
Token: SeIncBasePriorityPrivilege	2588	powershell.exe
Token: SeCreatePagefilePrivilege	2588	powershell.exe
Token: SeBackupPrivilege	2588	powershell.exe
Token: SeRestorePrivilege	2588	powershell.exe
Token: SeShutdownPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeSystemEnvironmentPrivilege	2588	powershell.exe
Token: SeRemoteShutdownPrivilege	2588	powershell.exe
Token: SeUndockPrivilege	2588	powershell.exe
Token: SeManageVolumePrivilege	2588	powershell.exe
Token: 33	2588	powershell.exe
Token: 34	2588	powershell.exe
Token: 35	2588	powershell.exe
Token: 36	2588	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeIncreaseQuotaPrivilege	2320	powershell.exe
Token: SeSecurityPrivilege	2320	powershell.exe
Token: SeTakeOwnershipPrivilege	2320	powershell.exe
Token: SeLoadDriverPrivilege	2320	powershell.exe
Token: SeSystemProfilePrivilege	2320	powershell.exe
Token: SeSystemtimePrivilege	2320	powershell.exe
Token: SeProfSingleProcessPrivilege	2320	powershell.exe
Token: SeIncBasePriorityPrivilege	2320	powershell.exe
Token: SeCreatePagefilePrivilege	2320	powershell.exe
Token: SeBackupPrivilege	2320	powershell.exe
Token: SeRestorePrivilege	2320	powershell.exe
Token: SeShutdownPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeSystemEnvironmentPrivilege	2320	powershell.exe
Token: SeRemoteShutdownPrivilege	2320	powershell.exe
Token: SeUndockPrivilege	2320	powershell.exe
Token: SeManageVolumePrivilege	2320	powershell.exe
Token: 33	2320	powershell.exe
Token: 34	2320	powershell.exe
Token: 35	2320	powershell.exe
Token: 36	2320	powershell.exe
Token: SeDebugPrivilege	5508	taskmgr.exe
Token: SeSystemProfilePrivilege	5508	taskmgr.exe
Token: SeCreateGlobalPrivilege	5508	taskmgr.exe
Token: 33	5508	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5508	taskmgr.exe
Token: SeDebugPrivilege	5284	powershell.exe
Token: SeIncreaseQuotaPrivilege	5284	powershell.exe
Token: SeSecurityPrivilege	5284	powershell.exe
Token: SeTakeOwnershipPrivilege	5284	powershell.exe
Token: SeLoadDriverPrivilege	5284	powershell.exe
Token: SeSystemProfilePrivilege	5284	powershell.exe
Token: SeSystemtimePrivilege	5284	powershell.exe
Token: SeProfSingleProcessPrivilege	5284	powershell.exe
Token: SeIncBasePriorityPrivilege	5284	powershell.exe
Token: SeCreatePagefilePrivilege	5284	powershell.exe
Token: SeBackupPrivilege	5284	powershell.exe
Token: SeRestorePrivilege	5284	powershell.exe
Token: SeShutdownPrivilege	5284	powershell.exe
Token: SeDebugPrivilege	5284	powershell.exe
Token: SeSystemEnvironmentPrivilege	5284	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe
5508	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5344	helppane.exe
5344	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 5008	4816	msedge.exe	84
PID 4816 wrote to memory of 5008	4816	msedge.exe	84
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 1952	4816	msedge.exe	85
PID 4816 wrote to memory of 2072	4816	msedge.exe	86
PID 4816 wrote to memory of 2072	4816	msedge.exe	86
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87
PID 4816 wrote to memory of 4156	4816	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://disk.yandex.ru/d/LdNFOFnpJ78Ahw
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff8feef46f8,0x7ff8feef4708,0x7ff8feef4718
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1860 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3058147081529927208,3769128301760491035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:6004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat" "
1⤵
PID:4932
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:4740
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:832
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:5044
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:3320
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
1⤵
PID:2792
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:5048
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:1484
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:4744
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:408
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:2480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Nursultan_Nextgen\Инструкция.txt
1⤵
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault19b7b7c2h24e1h491fha2c2hc2d683818e5b
1⤵
PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x100,0x12c,0x7ff8feef46f8,0x7ff8feef4708,0x7ff8feef4718
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8969370468721943883,5608954824883333249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,8969370468721943883,5608954824883333249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  PID:5328

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5508

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
1⤵
PID:5836
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:5924
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:5984
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:6044
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:6104
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:5164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5284

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
1⤵
PID:3992
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:4480
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:5620
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:3764
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:3872
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:4604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
1⤵
PID:1592
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:2248
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:4900
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:5908
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:5968
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:6020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:6056

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528882
  2⤵
  PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8feef46f8,0x7ff8feef4708,0x7ff8feef4718
    3⤵
    PID:5316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
0a0b9741cb338c26f1594fb7f83df461

SHA1
b2fc8014a8629249995bdcc1733e0792260f10c8

SHA256
14b3616e9b73bbbd70d1cf8032825a1e5d22550590f08c218b7301a44c1d7bd9

SHA512
cc8cf13f94e23596b7a7ef5f551dd7a7c0ff34122ab4ef95c419460505a3cf07c2e0f843674418ff3a728dfbad842a55f810d3f09fcf11ff5155760a22c7e039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f9d180c0bcf71b48e7bc8302f85c28f

SHA1
ade94a8e51c446383dc0a45edf5aad5fa20edf3c

SHA256
a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc

SHA512
282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
60ead4145eb78b972baf6c6270ae6d72

SHA1
e71f4507bea5b518d9ee9fb2d523c5a11adea842

SHA256
b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7

SHA512
8cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f445c4981482d67d3c2c8037ee9d8b1

SHA1
5b2fabf127b1efe3d32718afb85006cd1c680999

SHA256
3da4ce858fe015cde6c18d89bd422f8053a132831ba55b9ffdec1c60c0cc4840

SHA512
3049df14bb353728473c399528de23f4c68df65269cc4c051a0582c57036b3431b3fc1a19f94f2e022a4aed2380ca8544e8018bf16228abee5ceca9281af5d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b83f25072fb6a43059574765c2b52698

SHA1
ec9d0f626ea3d427e5f38ae23357c91261ff2fcc

SHA256
b480ea713215d4bbf0f74f51ecdeafa8935b0715cd9cfdf07a1a8a01c739aa8b

SHA512
d0c5d44c506dfb4c75eb507ba15c0c2fb50cad9d0d2ad8266dd758b672da17749153b2d5a0792272a146dd12c01e6a9e5506a98768b1821668298f1e2650a404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
c6c64b60ed8b71b702c2e53d9c178dd2

SHA1
414984c47dc5c3ae0f747fbd0ed22c6b08c47215

SHA256
09b0561b9eb26add4059f7898279780969a8e29275beb598e0783277bfb8b3de

SHA512
0d38a064ebebe58a9aeee027418df7197355eb401f314b6df20173ab6e05682dbd7efd6955ea4fcde01e579f7fa7d9446b7e089a01ae8429e465089c41cb0149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
550B

MD5
3c374cea9a0cbed2b03ee91d7e98128c

SHA1
729ee0c990849c11767ce6f8f5905e3d76db2a55

SHA256
e8fe3830fb9a1a9e6132e63747606b7e6cfa045137ec2c6d59ca085b5ada5432

SHA512
8770972366a33018b93cdd968e75a926de9c85208378802771bf58c599ecc8efdcb3184a39a54390c275e2572d8e9a3c2aa941fcc13a1f345e4b880066332888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
620B

MD5
8ae97c67851b7ed1f7bc09941f166a50

SHA1
c8cdd666a1f8382003bfec9f60c8860f0331efe0

SHA256
a25af49ac2963394621f5133487d22140b73c244cf8f39e08b27987f16cd8c06

SHA512
686eec28cd43e88e4a6fe0058432e4482bfcaf4552a852b9dcc50900629d34fadcf0ba87659f387b1fb680f85558edc20505038508655e9ecbc267cd9e021bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58e9732d0bef28135d444b6de2fbc297

SHA1
d529461478123b313732a91809246ac60ff98655

SHA256
634609b91c6d40d91401f4f5e156ed2ddd1551c6d6c5db572c3c64269c57fbdd

SHA512
bbe618affc00b4244e2986e81aafe030bd05db4c7d08d9fd724766666f2dae7623ad6a1b5c1830f23c881682f53cf38f3286311e184c66a5de8c176862917037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86115c11d72bc58dc565c96c432d6ed5

SHA1
fa5b6c828200d52dd66cf73c0ba331ad33425683

SHA256
14b48072067d4546cd4ba0e5dcdef6f3647e9378f5d51b390e28152998c14fbe

SHA512
525f13fa8f89d6b6030918cd6fd7e7fde27bd7c8c948d3f9c4bd0b5dbbe642649586acd792a97c9a263a722b09c5965fb3a4d162a7eac7078533d089969dd731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afd73dec9879d4e9133d0a0db75bc611

SHA1
b12df32045559ceaf111ae395ab020b0c69ca618

SHA256
206ad81e345097d0dc22895e5cbf4862d8bda6fb82d656d170375e0fc400862f

SHA512
904deab71cd265da5f5d120a5d72934f7e475bf6fc623f139560c17431cbfbbce4c4d9de2ad4d2b86124e61d2b11859ca0ea6fab400e84dc75e80bd2c5179f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cc3207281b4e513112740fdb3ab9eb2d

SHA1
f28fe28b67b3d2c89436c9b2a28b7bf36951acb9

SHA256
8bba25e51975bbd9ebadff6ab0c98c432634192d5d76e1b1acc5b1063f2fa066

SHA512
e4f437a70e151c058f4a41e256430d95b268ce9485b7e151fc7659f7d75f008ec2528b5cd4953a1a242d50e333244df1768bd9a96dd424d8664db66bf3aa7997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c384292692cbba5c5bc7c10569f1fe0

SHA1
586e6f2738778151709a582e22d8351b5364bbf1

SHA256
dbf9595c34c4e0b261d707ab26196beb79d0be5f1e47546ae78d2aae659fcc42

SHA512
14da7f082a7d1324cff71af0faf166b6fd05a3cb1eb70f2d679070f17d1f5172853bca24889a49b3d540cf9e7f5f166c69191860c649b3781dc8089d62624814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38b98d0972b70c95946895a5f54d8400

SHA1
2865545643db3d9e91205e891ffa1bb46554300c

SHA256
3bc7be0817bb2300bb9730e2cfd3fb09cdc83f977a1d33f1f151d8657dbfd850

SHA512
60d6eb83b0ea0f3883697b9a45b41e65ef752803657a2d946de53cd217ea6970c0e245cb9cc298557c9cc399acfcf15a6c208bdc95383862a575a075093fda73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bee7732370f24ed92bd23297818d4369

SHA1
b2f4fd10a00c66144e3fd64720ec664385e25ae2

SHA256
0e7e43c8d5a95e07871db317e93fb0cdc91494e41bc4e01f9aceedbd689c02d7

SHA512
e87f2c111175890b2426a0b505f9b744056c6c89ec4f54c2e78bbcbcb23c98e4670f879ec1c63537f451187895456efb1d0202b10545cef6973c83123a1e031f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbfbc5b0c5d37cea09f759cc95fbd244

SHA1
a3150ee561892335b701e7e41baa5fdc5b19b47a

SHA256
5d6fb2c33570ecdad8f0b3ec08558a540d76b6a9963ce252498c9acebc8cdfa4

SHA512
9414733431d555b3de4d0937a7a16c83f8b76535ff4e33689a8007681db9b8ac2240848437277f8e3a1d7a19961b88e4532bbde3c9a46c22aee705908ada3480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ffacdab1c60484eb9839edd3bc9f5e05

SHA1
bbb2479804ec6a36593ec203cc95d18e538d4d42

SHA256
ce0419221c0026212f2a059d30245031be087f637aa947ebb2b3039d1c276192

SHA512
482c017f7bb495765d822929516d6952837af08cbc9db8b1b0068f1a3945991104cf77263dc4ac8e81626a1601b42da0b6a0b1803d5d0e267e587ba7ed5c6dc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2a8f4ab6247456dedac06380e5614ccb

SHA1
7b4612ea9b8fda2ae6cf684ce67a2ac0c9ac81c8

SHA256
1439230358c56774c0158f309fb0ab973ab399853c87751e0648b4dc4fa15501

SHA512
55537fe34e16d5d63c3f7076031463c3d7863d6372122f66a19e181a43b585ec62cc1111cc9cb7ad27e6bc44b195cca952d96e68adcbc47a25014d00dec416f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a13113d2787f3dfe002abe54adaec72f

SHA1
2d3fce15e643886dad7b68e3cbf9a4576764ba75

SHA256
675a34347239ecbec1ab3353889d892f211985e4135c390b3101bb0e9c68f0d6

SHA512
030b8f7619e3d6a4a0ab9831d36b871726e3e808dbbe1e9879ccfdcd316974365f13b3b64617e54081df6f23a3c336dbe11d1d69c64cb4c767d50701c527ff79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590b60.TMP

Filesize
705B

MD5
17ce142c548093df26917a9af5b7785f

SHA1
aa2b897a4e45b0961174fb7c0c90167e3808bfee

SHA256
aa10bc43b688beed0ff34ed91a3d8a8164cc61def340d3f90440a5e120ee2175

SHA512
e20b02e93098273bb6581bcc4e2ad9c4c04134fd0fd164fba160bb8cda22395480228c07629e3777e0c34b4c0d9c3ed05e768c1eff69eaae6fe757746ed5387e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
378b8f14418d81025e596b3dc08d4351

SHA1
b66e22773082627839970b7c04521902d9be8578

SHA256
17aa3b3f784e2ace9e6be34e988d8315b0b54b678d06d7e7df28eb71c40b49b8

SHA512
b934ae9cf18192cbea1673e1d2f93c75e927bb2645f8a9cc69cad59c1257dba643e970df455e59fe9975162d800bc2b956384b6a34339c9070ffa45ba66d048c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
884258139ce92351df427374ee714a30

SHA1
0a415bca0640eb852303817e879d6502a4b5066f

SHA256
4f02d0cbb0edd25e4cc493b948a86acd752328b31e9c3cf3350c87c31d7d8bae

SHA512
6692d96cd656854035973cf24ef4fd96a76ab63a002212de252741be60a124aa1ed648830b6da279658a12349c2402a69550cb2489f2cc3308651bf3acd47711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
337fd8fe3ef6ad2c9f67927b4b9b5c6d

SHA1
45dc20d5b19d4562333340d16f50f3f8515c9502

SHA256
d2790f7b0dd8647796cbfd7fc1b4a755cb365aea04e91d064dad705007c9847c

SHA512
3c57056c36088a97f1485734c486ddf196313106859d143acb8bf3cc12edcfadef159b5c0cd6004cfc30cfbb46d52df401529d6d8b2303bc8b1fb315252452f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a21ddb5649c2ce3315b3a3560007732d

SHA1
60098a8003cb1ea8c7d832edf6b31a56437a8169

SHA256
7c5594a2d31266420e2cfd4b797733313571a0b2a8fc8d01e610eaabdc87e57e

SHA512
1653adc75724ffd7ff0b3c49625a51a2bc7f57b73bdd527651fbe52441178b412c298ce82e5e8d03649ba2f0346a19318bcc89cb2a92795899bd98b8e7eb6bae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0d0835160c8e62fe5cc519f7cb539a62

SHA1
eab9851ee2f34999eac4b7bf7c1af980f7bf2b39

SHA256
f58da45ae0ff5772f14d20546e09edc6fd8fd8adc04191afb0b7c8e8612f7589

SHA512
3fa3377093ee3fa5d505a340240c0468a28926e96f8b0efc580f70b593b9445bd233aa8146dee00c184c7c369f7c73fbb24a8e0cdf8b0a575636e32f2825f8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f4733332e07522db085ca1d9bbdccd60

SHA1
e26f594ad507b7b89e61ecf2588124a6e3e28ad4

SHA256
6e3001967982e38a2933ee941b31925d09dd72bb10e16071930c8eeef5d7859b

SHA512
e6eada50306d18f85cddbfe23ad5b1b051945f761851021dcc3da6218fe93c54dd644196e4d43d895a3119f02aeb0892d19768e1e63d2b34bbd6eb3d8fe2ea5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d83c998ee984e3dabfab8b8eb0df6bd0

SHA1
7043947be6389770f255f6b1def6fcbccc45db6f

SHA256
f5539bdf7b8ddc990a44334fcbefa7581dbb1803565d875e9cd36b6adc6b4be2

SHA512
da1307673c52cbe4d800cfa9d23c77de04d9179121ca47c150b4658475cc68cc44a355e4bf57572d34b9462f07b8b211db50e307fdf949e6f1e76d0b1865671f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0db140c2cf6c6cca75d115c1e8e1897c

SHA1
cf4b1f8e40300500ed78562fee101db472ce03c4

SHA256
8d0959f16d4deb2312eed599b66fe0bbf2a289a377fd3094eccebf536aa6272f

SHA512
d92925405cffa8945c145b371087e8bfb0ae687ec7233ad0de85266b77ed5affec09b5598e5caf8275f587009c7aa1373359e5166fbbf0f31b11a77d34c60f13

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dydjoxr4.ih2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\kdotDEbKM.bat

Filesize
199B

MD5
d4cfcc8678f1146f950256544526e904

SHA1
be5dc5e55d45f7c4e03ad97b249417b578bb66dc

SHA256
d37d5d727b74d52490b36daa54023ab8bac4eef33b19075bc7119e1dfe2a7622

SHA512
f7707e76ca57983e807b0c2f35547d12d9900e64d91d642c26849e3feff624ecb740c982fccfc9c9b2c6ff13db6f78024dc31887792a68bc3545ff47d3548172

Download Submit
C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\kdotYKoIC.bat

Filesize
13B

MD5
337065424ed27284c55b80741f912713

SHA1
0e99e1b388ae66a51a8ffeee3448c3509a694db8

SHA256
4ef6f5f73f87cd552bf0dceb245365c44996f94eb72aeb2ccefe440fe055043b

SHA512
d9290f0aa33e11da2ec88165b8133623e3f1633a9df8f477dfab395f655dc9a1d2dc82e8eae1d8eeae950ea2dd1e08054e1b258a0f2a0b4d4ca124db08e42e5a

Download Submit
memory/2588-431-0x000001DBCA730000-0x000001DBCA754000-memory.dmp

Filesize
144KB

Download
memory/2588-420-0x000001DBCA3D0000-0x000001DBCA3F2000-memory.dmp

Filesize
136KB

Download
memory/2588-430-0x000001DBCA730000-0x000001DBCA75A000-memory.dmp

Filesize
168KB

Download
memory/5508-543-0x000002797A780000-0x000002797A781000-memory.dmp

Filesize
4KB

Download
memory/5508-544-0x000002797A780000-0x000002797A781000-memory.dmp

Filesize
4KB

Download
memory/5508-537-0x000002797A780000-0x000002797A781000-memory.dmp

Filesize
4KB

Download
memory/5508-542-0x000002797A780000-0x000002797A781000-memory.dmp

Filesize
4KB

Download
memory/5508-536-0x000002797A780000-0x000002797A781000-memory.dmp

Filesize
4KB

Download
memory/5508-535-0x000002797A780000-0x000002797A781000-memory.dmp

Filesize
4KB

Download
memory/5508-545-0x000002797A780000-0x000002797A781000-memory.dmp

Filesize
4KB

Download
memory/5508-546-0x000002797A780000-0x000002797A781000-memory.dmp

Filesize
4KB

Download
memory/5508-547-0x000002797A780000-0x000002797A781000-memory.dmp

Filesize
4KB

Download
memory/5508-541-0x000002797A780000-0x000002797A781000-memory.dmp

Filesize
4KB

Download