Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
03/08/2024, 02:56
240803-dfezha1clj 903/08/2024, 02:53
240803-ddg13swajc 803/08/2024, 02:42
240803-c7cssavgkf 10Analysis
-
max time kernel
1034s -
max time network
508s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/08/2024, 02:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mistermodzz.com
Resource
win11-20240802-en
General
-
Target
https://mistermodzz.com
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4656 powershell.exe 2148 powershell.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files\ConfirmReset.exe explorer.exe File opened for modification C:\Program Files\Internet Explorer\images explorer.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa explorer.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\classes.jsa explorer.exe File opened for modification C:\Program Files (x86)\Internet Explorer\images explorer.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll explorer.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun explorer.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe -
Checks SCSI registry key(s) 3 TTPs 61 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\TypedURLs explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\FFlags = "1092616193" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1 = 56003100000000000259d47c1000526f616d696e6700400009000400efbe02598b7803591b172e00000000000000000000000000000000000000000000000000f0ffec0052006f0061006d0069006e006700000016000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616193" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5444" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\NodeSlot = "18" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8525" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 = 98003100000000000259487a110050524f4752417e320000800009000400efbec5525961035903182e000000180400000000010000000000000000005600000000002d782101500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 040000000500000002000000030000000000000001000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\SniffedFolderType = "Videos" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\Shell\SniffedFolderType = "Pictures" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3007475212-2160282277-2943627620-1000\{1E2C414A-326B-4761-93AF-5753C0F82152} msedge.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "14" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4\MRUListEx = ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1042" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 0000000001000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Rev = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Client-upd.zip:Zone.Identifier msedge.exe -
Suspicious behavior: AddClipboardFormatListener 6 IoCs
pid Process 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2524 msedge.exe 2524 msedge.exe 3800 msedge.exe 3800 msedge.exe 3004 identity_helper.exe 3004 identity_helper.exe 3940 msedge.exe 3940 msedge.exe 3112 msedge.exe 3112 msedge.exe 3432 msedge.exe 3432 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4888 msedge.exe 4656 powershell.exe 4656 powershell.exe 4656 powershell.exe 2148 powershell.exe 2148 powershell.exe 2148 powershell.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4928 explorer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
pid Process 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe 3620 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4656 powershell.exe Token: SeDebugPrivilege 2148 powershell.exe Token: SeDebugPrivilege 1456 taskmgr.exe Token: SeSystemProfilePrivilege 1456 taskmgr.exe Token: SeCreateGlobalPrivilege 1456 taskmgr.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: 33 1456 taskmgr.exe Token: SeIncBasePriorityPrivilege 1456 taskmgr.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe Token: SeCreatePagefilePrivilege 4928 explorer.exe Token: SeShutdownPrivilege 4928 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 3800 msedge.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe -
Suspicious use of SetWindowsHookEx 35 IoCs
pid Process 1228 Client.exe 3672 javaw.exe 3672 javaw.exe 3672 javaw.exe 4372 Client.exe 1396 javaw.exe 1396 javaw.exe 1396 javaw.exe 4928 explorer.exe 4316 SearchHost.exe 3628 StartMenuExperienceHost.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe 4928 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3800 wrote to memory of 2916 3800 msedge.exe 78 PID 3800 wrote to memory of 2916 3800 msedge.exe 78 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 1896 3800 msedge.exe 79 PID 3800 wrote to memory of 2524 3800 msedge.exe 80 PID 3800 wrote to memory of 2524 3800 msedge.exe 80 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 PID 3800 wrote to memory of 1364 3800 msedge.exe 81 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mistermodzz.com1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb0cad3cb8,0x7ffb0cad3cc8,0x7ffb0cad3cd82⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2032 /prefetch:22⤵PID:1896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:1364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:3008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:12⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:3384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:3280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:12⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:12⤵PID:1012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5656 /prefetch:82⤵PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6124 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:12⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:12⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:2284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:12⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1238061898975335813,904280072328317471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3712 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4976
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1404
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4888
-
C:\Users\Admin\Documents\Client\Client\Client.exe"C:\Users\Admin\Documents\Client\Client\Client.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1228 -
C:\Users\Admin\Documents\Client\Client\jre\bin\javaw.exe"C:\Users\Admin\Documents\Client\Client\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jfoenix.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-gui-jfoenix-ext.jar;lib\jphp-json-ext.jar;lib\jphp-jsoup-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\jsoup.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\895c01f2a97c8e5b030d6a8ded574f02.bat3⤵
- System Location Discovery: System Language Discovery
PID:4500 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656
-
-
-
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\81d371a0cd44471cb6e54b819ed9d5f7 /t 3092 /p 36721⤵PID:1096
-
C:\Users\Admin\Documents\Client\Client\Client.exe"C:\Users\Admin\Documents\Client\Client\Client.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4372 -
C:\Users\Admin\Documents\Client\Client\jre\bin\javaw.exe"C:\Users\Admin\Documents\Client\Client\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jfoenix.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-gui-jfoenix-ext.jar;lib\jphp-json-ext.jar;lib\jphp-jsoup-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\jsoup.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\15c1a09e7d0e02098719e6afe4667b30.bat3⤵
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
-
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\221b3816fb42409c8f757da4b26ea534 /t 5044 /p 13961⤵PID:3444
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:1456
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1468
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4928 -
C:\Windows\system32\dfrgui.exe"C:\Windows\system32\dfrgui.exe"3⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:3620 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb0cad3cb8,0x7ffb0cad3cc8,0x7ffb0cad3cd84⤵PID:2616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:24⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:34⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:84⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:14⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:14⤵PID:2528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:14⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:14⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:14⤵PID:800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:14⤵PID:3796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:14⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1636,11275108790472771321,9066482125589660747,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:14⤵PID:3860
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4316
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3628
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:4784
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2084
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5064
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3408
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59B
MD5d28d168e9aad0efd8091e24fa8b53b5c
SHA1bae08fcf2f766a2c7e159fec5ba5e843f83a2df4
SHA256ef43981ac441ed33592decf6842db6fc227d811216b0f170fbe958a67d4ab34c
SHA51206c5a1b9a4cece0fb9c9b27ca606f9ae5fac9c0b46a341629677185ebf01bcaca30936138447a1b3e1db758666f6fc7b719e2ed6c9695760d36cc612d8c0cdad
-
Filesize
64KB
MD59e466b4837d8431be725d6b9c1b4d9ef
SHA13f247b7c89985a41d839cad351cd0fc182fcb284
SHA2562f9a5eeb5ac8cec52a3e73621e4d392f501f5d657dfec3215ccd40eec317208d
SHA51201de0fda555d63b5c38339b0f6d38c28de2a882643439679e63cf5d75f13516b57dc90e8dfb8c638bda328fc12342e58d1e501acec8f85b92dbd5589dac06418
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
960B
MD516846df493521e84fe47cd6b6451ec8f
SHA16d99eb017c5aec08d3a7e908bbd4a051ce250c02
SHA25669f19f2ab2f3625faca623477864766ab1ef3a21712bc892d7b2b0886585b3f9
SHA512aefa5121601b8273cff6b79b7f76417c71e29e835b66faf3e1a67d0d38fb9ebe90320b75493fd5c4a2d9ea3e3c485d0a84bcdbfb78c26a8ecee3175cd8bd93cd
-
Filesize
152B
MD5b4ae6009e2df12ce252d03722e8f4288
SHA144de96f65d69cbae416767040f887f68f8035928
SHA2567778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d
SHA512bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1
-
Filesize
152B
MD54bf4b59c3deb1688a480f8e56aab059d
SHA1612c83e7027b3bfb0e9d2c9efad43c5318e731bb
SHA256867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82
SHA5122ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9
-
Filesize
152B
MD5f5a0208950dc408b64d0761b28db9a59
SHA1f4c13cca372786d854857305682c2f494270c9fe
SHA256e1f7e0f1b26e3e512d4a9b5ea60b90b41374c3f1a3c0b4d697cdbec78d482661
SHA51215a15cd5376d44224fec5a77868f93f4ed3c62e084ff8ec8326c99f7410581bb16d24c5ccb30e6ad0bc922f71511b86e9e7451015e852fef3563785d29da9d3b
-
Filesize
152B
MD517b0df04d2a3490455c68d1bf4a7f7d2
SHA19c845666a3bc6ec1a3eef2ca1e955b76afb11708
SHA2560ff59df6315d644036dd7623d164835aa357d6abe4c33c0b1518606b3f851c24
SHA512497c1d8c2f89dd44b2aaf3845e11b999faa92475f9809b0a272c861acb901ad8670b20ec11fa537a3e3fcb17bd357c838bb6a5d27216bfed4c6daf4cf82900b2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4dfe4108-ccd9-44e2-8c18-a6f1bbfffc16.tmp
Filesize70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD50180353897cf7d4482fa5c6a0f5d2513
SHA15d65cf5b0c38b028a6788aefba65026ba89328df
SHA2567f89a43b4bf6f1dd3004e5277e0382da4f46354935eb8d826e62c55b23756d76
SHA5121545fa10761a854f547b0f3edd662f14b5f328b0aba02c06600a3c9bbb3c1c1ab300a182c01345ed773ab5da18be91a3a5b76a03099f84c2bbd118662403c432
-
Filesize
32KB
MD50672751b0995ef0a5a980e8db3b20e76
SHA139d3c3a94af634f99180fe5b39e2adc1dc382997
SHA25686e6b40142c13ca83951ccd0265b59ed2c442ea4f4148166c7fb9b534a7acd34
SHA5122763ecd1c9db9714fe51f902e2f10177631471a9b71cba917569b3a8f4509eab4e28545813de01e59f08466fda013582a61901adf004b15c131a66414b628836
-
Filesize
32KB
MD5cde3102fe99d4e1c10a3801e7e856680
SHA1ba2d90f5c660b5a2aed2578bb3394906059d60ba
SHA2562956e4e152c25751ccb0ae2ed999adfc7980d74e3e1e641e958cedbb49ddf0c1
SHA5124561b9f02f997f3c8e37fa14ac6de008f9e5371457682ab554dec30054daaef04bfa63de1486cda48259c35065c53e0ab11c980e1b57bd9cba20d9ee4bb691e6
-
Filesize
116KB
MD587b98c7b054ea4ec1b52db58b360f2c0
SHA1a6bcdff70e06cf0fcd778cf5d85cdd280538b72c
SHA256dd5df25c8a0ad79a5c7c2840118395589f49f827975933c458b54e50232e92ce
SHA512fa8fd2806b9a3ba83a39610571406601b0f470db074eb7ea2d9c3e07fc4104917fdff442a80e688df72539c403970589b4da26387f2941f32c1b30d7b986db19
-
Filesize
3KB
MD52c162df4f38f325af94238b34623036c
SHA163c869d6f4927a734e2ffc9a56f676c4c59c9593
SHA2568a7e3b71d4831261ff76d1a859b5970ec2e9499bccb185cce0efee3a35d6e976
SHA512031e3b5df9aa8438bbb678cd2d19705a2c2ae77d543833188614ccf54a9c80e5291e6e26ba497c1cec9e2eddba5f54150becef8c9e058738aa43c6a7e537aa87
-
Filesize
88KB
MD5b757b67f4b65f9275a8781e3f3689463
SHA11503946b6d4d8d1996983f1bca3667af4f298a07
SHA2560cd7ba4aa49be611210d085255f809cf21e735596590eedf4fa7ea79b573c2b9
SHA512733685d050ebac7dc6feb2ea14ba179e149794dc77eb8ed361075cea3f7039b5e829fd2cf9142bd93d946b21b846b3a804b203ec342ed39c9cf1324550d50850
-
Filesize
3KB
MD51bd2ae540e18f41dfb8dda33ab603b75
SHA10d914044dadd48735de2d110f0baafa79876de30
SHA25626f927b0aa5d86962bcb00bafb03cb5dacd10d0744c28319b4602fc999df80e0
SHA51219698977789d7e34dd1c2cc5eb7f12a91d0bcb3498b4eb4c2c94a5f894bfc5d1e2b880c51e1489b898e8180c53f7d4470d72ea2c4b9890807b0546b64c703530
-
Filesize
3KB
MD56ba70b90dc3c043510c4afb24f43e567
SHA195138d489997e1471c009b19e985ffa8fd9ea2ae
SHA256e0f229a38b9bb4464d8363682cb5ac5d0d5207fc9f1bb5bdda8f63882d9ddccf
SHA5126222e98219f5ff1de51e7ff555b9a44a98944072a884c8317a41a216653e01064118acec5afdad186221836097df641eac010dfcb45c9112593011ce56d4d7ad
-
Filesize
5KB
MD507d7f6b19d6c3dc606591984dd4319fa
SHA19b2cfecfd9950376e46c62deef92afcf22db2121
SHA256ab71e82adb6561b272b5a0745f68262e7e0fad5929e2d7220a4940a14186786c
SHA5123a622662eb2e548a735500605ad3b08eb3aba93589deaf8e6ad2bc0ac0dcac50891e9f1acd027cef45ab211a34adce399e6ca522aff5f05557c4101b98106b93
-
Filesize
7KB
MD5d85c4aefadb1d54ea92ed9ce9ad44b7f
SHA187749e9e025f2af571c5c551547e5c0eefe3d447
SHA256ff32cd835e6a009f742d1fa2b01facbcf63b81f3e842b060d355bdb75282d8a0
SHA512b7d1fe8ae9cf47fd7bc93f77d904d65beefa63865123167d74ec18fc02d7f541d61ed90b076ce45391dd13730df094ee31412f2ed1f944a5661ab4dc84b3f395
-
Filesize
8KB
MD55c3a15d47e5e6c7d6a85a968589be6a1
SHA155e6870573b9237996f904d2a139e8c6639f0361
SHA256e504026b499d1ce85f3e6d7b7101a96ebda2777af696b200352945c5d70b7134
SHA512abfbcadf38022ac6086691d361872cf780f0dcc63e5d161be797b9c6092fe81fe957d5868d47711a48cd9e00717fd0d70a4ae8d679114c84294aa571c7051046
-
Filesize
5KB
MD56ff4d7dc201f6b08a6a1a8ed0ffef128
SHA104b48a30e9a9f8c9051c4b385457d0e3824c9a04
SHA2568ed3151b9b32d8dba6d70cf152d07ea28441d58e152cdf4ac8cdcd5c47185449
SHA512f9d35856313a78bc9fa8e3cd1773dfacd7b2df086fe1165bbb848557ba24b6c0656b90bcf89843368177173fabcad50940a5282ee42573b12377f5a5bef815c2
-
Filesize
6KB
MD58a99884fa61aba28cc8acb248ca6604f
SHA1ff215fa23891d3ead8f8d1f69e792566cbf34eb8
SHA2569ad290147f3549fbd0be5600f91aa967dcb04b9ca42a16c195db224c73d6f05f
SHA512bae470df4ca52754a780f0d90eef38fe0aa4e4c46e739e7aeb1f22283909270db7048ce6fea726be6bd82a7012ce8c0b7b5be8ab978c6849c76b4cc22cf15a47
-
Filesize
4KB
MD5a740659984eef63e32596f5d23765155
SHA1d684fbe98b3328e92cdc71785d91ad947bffcb19
SHA25640d72012092df425911f490722a402b2a6e8e817168ff9693eff4559314f1381
SHA512576178ed0f8e7bb6689a92616a452f385ed6e4374e7ac15f057246253621fe22191aa59700a69e0bfe30b69470dc4f8379775e3a229f3362f5f3c184dae621eb
-
Filesize
4KB
MD552e449912a936c4f8c8f6dace60d22f7
SHA1ae13c8c2eb92e161dca0cfdab294566d0fdda0aa
SHA256fd7a5ac6abb277bc3fba021072f2208347218fec8db5cfe42c056d7f3dbbab6d
SHA51219f241ff04d9872c391e1f8478543952ec76dc362126fddb3b3a99124c58151ce4319be75e3e9a13919a99c98c3436d87c5798c4befa499cbb8691ca6c316621
-
Filesize
33B
MD52b432fef211c69c745aca86de4f8e4ab
SHA14b92da8d4c0188cf2409500adcd2200444a82fcc
SHA25642b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de
SHA512948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf
-
Filesize
36KB
MD568928c8c345f70dd17d4aae4bbcf0254
SHA140f7183cf7b9fedfb673ae01cdde63eaca6a677b
SHA256daa3ef3bd9ddddcaff3a1de407d82f16d4abfd905cff7fb17a64990282de64e6
SHA5121c21cd736cdcf228ae0466cb5e2340ae306a3a7869db4d572e98e22cb4547aabb27474aa874cd876c7648aaa76562a66a475861eeb5f9ecb9212790cd03ce1f7
-
Filesize
26KB
MD5b14e9b45722a116a34a5bc212042d545
SHA17690ec0c6498cf1c32cac8c54430cd41ea4da080
SHA2564cef4c871536b0608f4b9d54fc4f83178e2aefb1527175d557d183923804ad56
SHA5123655ac46a77628cfd9940a957cc00cbd4707cc469bac19d982c117dc87d37a011ac5c599154b4d3bcb241df7b6c005f17235a14087de5d99cb4c9079da077daa
-
Filesize
25KB
MD51103eac5cc6761b51e33acc036eb5a0c
SHA1dfda16b8a867439e7e48cc20a8e4dcc9c4e189b4
SHA2565eb1777aa4ef4817dcce761c506c044f6c87b74001660f264fe51550b661582c
SHA512d5cabbc5f34b6af49739b43c5e9b7895d5f8ebf07569b49a099250598a20a41d91b3bd844cc4b8d6f678778e0913c4759db203ee66a3e9764b1b18d314316778
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
Filesize48B
MD5e57155b2b3bf998dc5dd1bf1be76ce89
SHA1d8008f54739d646f25b37b0afbca7c902b6a7b97
SHA2561f806649d62e22e46a668712a3587d848507f6ced48287ce78b41211e499917a
SHA5125a26228f38c9b57caeca563b2eb089274e5436a64096554332e260c16c74a5754c5a9875cd61434ed768cbab03ef695d68e9921435a5d3f34fb74367703711b0
-
Filesize
1KB
MD5284351b39e321627d50571fcbb328eb0
SHA1c62bf4be1da8d41c964b4a54c88bbc6d1c6f96a5
SHA256ea730b3b9db7a8890c6fe82aeea2125d85abdc083097ae54783f6b4e69224aa1
SHA512735de0a8db721893e5f52eb59129c16658a8b3c8775ce24e2738dc2a84424dafe9f7613c7ff10e439776cae78a8b7e60aac8877c5d3364e6236cfd0f98760242
-
Filesize
2KB
MD50f400286de1b391c47766ac06e3f13ed
SHA1cd0794cb8f50d58c1ad9fd61c14f991a7982876d
SHA2568c27ae73d65e30b0931095646623726af40fc0423cd628f03231107ed987a686
SHA51246905f3874cd4b3ca6710e2c575b172f3d919e338c9304a9ec6c347779b3308f98674642d5f098a4bd82ffaa9e7e8ac1829f46adb6cc539901af451c8ca45724
-
Filesize
873B
MD585436e2b80727959a1d00df5b2c53fa4
SHA1face0b550b75f7f2b0dfba6094b024fbb1ab34a9
SHA2564abaf115c4557e43b67da982c5e6ec2f8487acd812b8fe0d5e6c5b0d1bf5373c
SHA5128e7fdc8fa595087f1aeab591b2e104bba788d478495c7c088ddf5612f0e0c6733d0034efc2139ba0086edcf91e6f12f84a6a3e9e88899f8aa7751c51da1fc915
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16KB
MD59a8e0fb6cf4941534771c38bb54a76be
SHA192d45ac2cc921f6733e68b454dc171426ec43c1c
SHA2569ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be
SHA51212ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae
-
Filesize
1.5MB
MD529d482eb9e0ca26ba7c1a2b8e861b893
SHA1115d33af630e9a62818e07dd71abaccd2a11ff22
SHA256a3724d8cc979716aab5cb0a967f7298cb2a269280994b41104d7b1e535b64f2d
SHA512f0cee5cea174f43265cfea48447686e0fc32e89bcf8fe163ac8ed234603006795502a5b0d8725c6ad41697a8d4786b79ff94b990ff9f325f3ec62432038b93ad
-
Filesize
16KB
MD5d926f072b41774f50da6b28384e0fed1
SHA1237dfa5fa72af61f8c38a1e46618a4de59bd6f10
SHA2564f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249
SHA512a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f
-
Filesize
24KB
MD5c7814bf9b09c8786277e50d1b54c800e
SHA1b109fd135dcee5a103663e3adcc3a5cfad793d78
SHA256a87af2e2776538f555584cccf03839577c5e60e273142c69d90447c6e46117bf
SHA5123b804cc781ad86354ddb0255b4fbf3d595469d60c14c83f03dfc1f36fb9a909d2df22713ce99255ff4b2717e3d4c6b93ad4499de5372ecbae27bbe9e61447cc5
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
120B
MD5a397e5983d4a1619e36143b4d804b870
SHA1aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA2569c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
SHA5124159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
-
Filesize
11B
MD5b29bcf9cd0e55f93000b4bb265a9810b
SHA1e662b8c98bd5eced29495dbe2a8f1930e3f714b8
SHA256f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4
SHA512e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011
-
Filesize
11KB
MD5517ae2f6bb3b958ad16e37665563e3e8
SHA1c29bfc94783c609b010ba15546438f1393a59807
SHA2565a8604cdfe05ec0228903f56bec89ca0293baaa8684f0194d4aef855d05cea37
SHA5125343f8f9a013eb281ddd3d403308f9d58694a531da984022499d1bd91e6b5722c5beaafd8a357bd3d8c1808860e94361285acfd58ee8ea93c6599b3031e27627
-
Filesize
11KB
MD5a903b6955ecb93a83d4a3cae2a80c25c
SHA15f5d3d402c3cd87a8f84dd2098d09b09c8f5a9ce
SHA2563e728b72d8e42868f904397f3a9189fdd8bca0f3960da0087a827999fe122a64
SHA5123070b6841a8ab5cb338805451c4dd9cc1f46390e40900016fc0f6eddc73333babf8060ed9c9ca76e06f6fb7b33a308951180b677fb61ac8555adec00d4c8ed06
-
Filesize
11KB
MD5c9e2a55a643a2fadd52825b0ad247800
SHA13a25c37a5ca76e0496d45c70a1f045c4e6d10f56
SHA2567566e660cbf3ab4bdd9e4595bda4884c220c784137e5c363d08d6b7d4ee2be8f
SHA512d47d8a69e4295c7dffc0a8a2ebac478b95c1ec350a18c65aa4534f37314c531bcae3e0f6a1dbd2484e8f22066de36c7cc972bf2f554ddfb684b8de257806c19c
-
Filesize
20KB
MD522be08f683bcc01d7a9799bbd2c10041
SHA12efb6041cf3d6e67970135e592569c76fc4c41de
SHA256451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA5120eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
8KB
MD5fcee4e115b3178587f585817dc476a68
SHA1acecd2a29fe5b8004956549820ada0bcdd0cf2b6
SHA25697fd7700786b3821362ec6615b32d5731fc06697d2ac101e414ea928e1fa60a2
SHA5121b97573d33182881cacbd8ec9e915f795631969c7ce5ebd6e3bfc848c4099b54f1d90411ba9fe1a83770c77c110ca9b61cbdac759d73929b5ff87617d71489b1
-
Filesize
4B
MD597c830c538d225ab6750f6ea423343e0
SHA1c6009e0d07257423ed1ea6ccd019c72a69991371
SHA2561fd269a6e96dfd872dd405946a45ba2987ef9302aeca66055e08c3b88815f9b9
SHA5128c3ca0e0d963bcd2f58dd213e4f6fd53bc16bce111e258eafcbef6581106748d0ed69c40199fd33169fcc9428fc31f7385ca302c8026c7e61b248506fd33e8e2
-
Filesize
1024KB
MD5749d408a627b90e524819b42aca07b45
SHA1241f5c6bb141450bce999aa2b98327764c933665
SHA2560ae92a30e61d4baaae0e0c02a7b896a008612a98fdc336dfc13be6b28bae1829
SHA512a24d889d82587a591a5cff976f4bd6acdee928c2bb8b1c9b555b4c0c3373ef3bedfabdaec360004e59e98dc0c807b7ce96ae6bd5fdea41fa8ec47e10bafcec4d
-
Filesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
Filesize
7KB
MD5db78d0e7a576778b07c444f77b9bb99f
SHA1be72067d1be19858f50a5ca7c87ef56ca266731c
SHA256c0a9984df734dd1b09b8f3d395c59a499400b00e8200c63fdba6377486351d3c
SHA512b541cb37b5b4439a95ed3f7b9b91da351596fadcb7a529b3d092cd452c9aac9403e5fb553fce58418957e9be754b5c307be30b731fe7d35ab78023c9504a00de
-
Filesize
16KB
MD513a1721f4ac8f232197d25cb7227db45
SHA157cbede4af94d669351b4dbbc7e727d1633dd008
SHA256cd7883b0c107c561a32a89995003c8a7a8850f5f470130a497d20c0d87858640
SHA512070637dafa3efffb1657ca0d209c5378faf5ccfa760f0f1a9af2ee087280cc34bd12c9d3af21f81c300e7ee3178e5762135faf934d0b1a71557c0db8de6179ca
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1PX6L5Q1\www.bing[1].xml
Filesize17KB
MD580720fe0e0120e81341e7f6a74558ea6
SHA1d8e4671fb8aeab3033cb8d74e65d3a176c0e13b3
SHA2568242bd5da688ace1aad7dbaf274d877bf5e3d1ee068cfc765d114a59978b51e5
SHA512cf3496cb9d46e41d4a9ca9385696a137abaf66822ed138c63353096dc0c30d5cce4ff89d346bd6f4d54e806ced98c10e1290ee985e58d5985f52e6d1f4131862
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1PX6L5Q1\www.bing[1].xml
Filesize8KB
MD5ac98e452e0b8b8d63fe1785a2014b10a
SHA1c7f886fee377e5013c8010aaa8e2def8c6efef37
SHA25654445dae22a20ca03b43f05032aa457b387ed6124fb88c24761e054d7604af57
SHA512e934279c649934f24ae7ad298f6b81694b93b66e3ec0acbb8747bde51240ce28ef841f13500a22b560556ed182da09beb43709f1600c10eb7d76ce11851a468b
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1PX6L5Q1\www.bing[1].xml
Filesize24KB
MD52d38cce0584a5e1aecf48fab09d8c432
SHA121db239eb862d0cbf1f5d1f06bc180029f3bfee3
SHA256c69f2b9d0d0c65f644e4722ec42204f71f01977e4e2052650d4d766e88268fc6
SHA512c87479a91d67fae77593e926f5a067b90b4afca863815fc2eef886feaf2e633cfb2bcffff3395b16c957dad910ba026f0967d7d053de7b02c5f54d9659896a4c
-
Filesize
134B
MD55f9531d30f1404d9441eab4ba8bf812b
SHA1ea1ce8870e6c10a64eaa87153d1e6f91036ea669
SHA256474379fb0ef61f6881c498bed88bbcd1dc60c0438a4e8d68335771676235530b
SHA51213c7755bfefb4686b5a46b52043e9bab955abb16e4316c621e02f44572f2e68ab4698e247eba6a2a8324488ec933297e25da0b03adcf822189b3cdbf0367ea2a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3007475212-2160282277-2943627620-1000\83aa4cc77f591dfc2374580bbd95f6ba_4880fff3-ce96-47a8-956d-b60b04225313
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Filesize7KB
MD5115daaae70ebdd84bcb5dd0615c28ee5
SHA1a10ee70461447b573b8ba4d61970d571a43784e8
SHA256ae98b4a4e744777bb3d7e62a6b49291c8775577e226e31ca322a9299621e2f8d
SHA512d2f077c2f2631b1857d4c2ab195440a377de7dc7c69a0494d334a3e2f2380c60761b74bd17c9e7b1d6ad8c769b367c59a1f679f168ef416eff8fc7e2586f1b78
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98