4e49278775abf88be3be8aa7851cf854b901f1293b6055345d2a6c4ba6bdbf5d

Resubmissions

05/08/2024, 04:46

240805-fd3nwsxcml7

05/08/2024, 02:11

240805-cmkmwsxgrd10

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pp.exe
Size 7.4MB
Sample240805-fd3nwsxcml
SHA256 4e49278775abf88be3be8aa7851cf854b901f1293b6055345d2a6c4ba6bdbf5d
MD5 67e4ed31a1f93cfe8e39fa71c36712aa
SHA1 0b9aaf8d7fc079d5c92999c9e83f78d4cc599e89
SHA512 b93d86c0c39e9668c1db50035cb7127e8e560e51cf5a925d78769d126dfdcb9df771ed2b1ab8ef68c80860a93a7ec912d105b0569af287a80f683a5cc18589e0
SSDEEP 196608:VU7W4FMIZETKwjPePdrQJiWrBd1WutYPjo:wWQETKwvJiWT1WWao
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Everything.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Everything.exe

Executes dropped EXE 6 IoCs

pid	Process
5604	Everything-1.4.1.1026.x86-Setup.exe
3392	Everything.exe
5220	Everything.exe
840	Everything.exe
3052	Everything.exe
5876	Everything.exe

Loads dropped DLL 18 IoCs

pid	Process
4324	pp.exe
4324	pp.exe
4324	pp.exe
5604	Everything-1.4.1.1026.x86-Setup.exe
5604	Everything-1.4.1.1026.x86-Setup.exe
5604	Everything-1.4.1.1026.x86-Setup.exe
5604	Everything-1.4.1.1026.x86-Setup.exe
5604	Everything-1.4.1.1026.x86-Setup.exe
5604	Everything-1.4.1.1026.x86-Setup.exe
5284	pp.exe
5284	pp.exe
5284	pp.exe
5708	pp.exe
5708	pp.exe
5708	pp.exe
5252	pp.exe
5252	pp.exe
5252	pp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Everything = "\"C:\\Program Files (x86)\\Everything\\Everything.exe\" -startup"	Everything.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Everything\Everything.exe	Everything.exe
File created	C:\Program Files (x86)\Everything\Changes.txt	Everything.exe
File created	C:\Program Files (x86)\Everything\License.txt	Everything.exe
File created	C:\Program Files (x86)\Everything\Everything.lng	Everything.exe
File created	C:\Program Files (x86)\Everything\Uninstall.exe	Everything.exe
File created	C:\Program Files (x86)\Everything\Everything.ini.tmp	Everything.exe
File created	C:\Program Files (x86)\Everything\Everything.exe	Everything.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\1ea4214236e5d7010e9700001815341f.hvsiproxyapp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\f\LockApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\r\SearchApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\r\AssignedAccessLockApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\r\LaunchWinApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\r\LockApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1052_none_648fbf276da33ed4\f\NcsiUwpApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\r\Microsoft.ECApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\r\hvsiproxyapp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_f2bc4eeca2f84338\f\LaunchWinApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_f2bc4eeca2f84338\r\LaunchWinApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\f\Microsoft.ECApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\unsecapp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\f\hvsiproxyapp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\f\SearchApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\f\SearchApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\r\SearchApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\r\unsecapp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1052_none_648fbf276da33ed4\r\NcsiUwpApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\f\CallingShellApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\f\LaunchWinApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\f\WpcUapApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\r\WpcUapApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\f\AssignedAccessLockApp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\r\CallingShellApp.exe	Everything.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything-1.4.1.1026.x86-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133673068019279619"	chrome.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\edit	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.efu\PerceivedType = "text"	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\ = "Everything File List"	Everything.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\open	Everything.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\DefaultIcon\ = "C:\\Program Files (x86)\\Everything\\Everything.exe, 1"	Everything.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.efu\ = "Everything.FileList"	Everything.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\DefaultIcon	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\open\command\ = "\"C:\\Program Files (x86)\\Everything\\Everything.exe\" \"%1\""	Everything.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\edit\command	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\edit\command\ = "\"C:\\Program Files (x86)\\Everything\\Everything.exe\" -edit \"%1\""	Everything.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	Everything.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2412658365-3084825385-3340777666-1000\{37612B03-EE3A-42BA-A5D3-5CB8B7873A5B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.efu	Everything.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\open\command	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.efu\Content Type = "text/plain"	Everything.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList	Everything.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 514529.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
4640	msedge.exe
4640	msedge.exe
3108	msedge.exe
3108	msedge.exe
4648	identity_helper.exe
4648	identity_helper.exe
4188	msedge.exe
4188	msedge.exe
5504	msedge.exe
5504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe
Token: SeShutdownPrivilege	2500	chrome.exe
Token: SeCreatePagefilePrivilege	2500	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
5876	Everything.exe

Suspicious use of SendNotifyMessage 49 IoCs

pid	Process
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
2500	chrome.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
5876	Everything.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5876	Everything.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4324	2252	pp.exe	85
PID 2252 wrote to memory of 4324	2252	pp.exe	85
PID 2500 wrote to memory of 1332	2500	chrome.exe	93
PID 2500 wrote to memory of 1332	2500	chrome.exe	93
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 2216	2500	chrome.exe	94
PID 2500 wrote to memory of 1444	2500	chrome.exe	95
PID 2500 wrote to memory of 1444	2500	chrome.exe	95
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96
PID 2500 wrote to memory of 736	2500	chrome.exe	96

C:\Users\Admin\AppData\Local\Temp\pp.exe
"C:\Users\Admin\AppData\Local\Temp\pp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\pp.exe
  "C:\Users\Admin\AppData\Local\Temp\pp.exe"
  2⤵
  - Loads dropped DLL
  PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdebbfcc40,0x7ffdebbfcc4c,0x7ffdebbfcc58
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2080,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3432,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4068,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  PID:100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4752,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5132,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3424,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4656,i,2430411838582699215,5336749148518728969,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:888

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdec0546f8,0x7ffdec054708,0x7ffdec054718
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,11844096478187919318,3293196371041231331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5504
- C:\Users\Admin\Downloads\Everything-1.4.1.1026.x86-Setup.exe
  "C:\Users\Admin\Downloads\Everything-1.4.1.1026.x86-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5604
- - C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\Everything\Everything.exe
    "C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\Everything\Everything.exe" -install "C:\Program Files (x86)\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:3392
  - - C:\Program Files (x86)\Everything\Everything.exe
      "C:\Program Files (x86)\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5220
- - C:\Program Files (x86)\Everything\Everything.exe
    "C:\Program Files (x86)\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3052
- - C:\Program Files (x86)\Everything\Everything.exe
    "C:\Program Files (x86)\Everything\Everything.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\pp.exe
      "C:\Users\Admin\AppData\Local\Temp\pp.exe"
      4⤵
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\pp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pp.exe"
        5⤵
        Loads dropped DLL
        
        PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\pp.exe
      "C:\Users\Admin\AppData\Local\Temp\pp.exe"
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\pp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pp.exe"
        5⤵
        Loads dropped DLL
        
        PID:5708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Program Files (x86)\Everything\Everything.exe
"C:\Program Files (x86)\Everything\Everything.exe" -svc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:840

C:\Users\Admin\AppData\Local\Temp\pp.exe
"C:\Users\Admin\AppData\Local\Temp\pp.exe"
1⤵
PID:4632
- C:\Users\Admin\AppData\Local\Temp\pp.exe
  "C:\Users\Admin\AppData\Local\Temp\pp.exe"
  2⤵
  - Loads dropped DLL
  PID:5252

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Everything.ini

Path C:\Program Files (x86)\Everything\Everything.ini
Size 215B
SHA256 f0969f438d2869641d8f76d5b9fd2b82c7232134a90972e96abb3783d1e2fbe5
MD5 b2b308d8c164f75bc11bccf7baf3df67
SHA1 6f1e5561268b2db5b46bb6f738c0f7a637fd6b6d
SHA512 5cb56d715d35a33e5bbc7e7deb43e4f143e4193ae59282892fe72b82c66a21a62cec85222a9879d5126479a59b9a5e715568f4bb62040a4c03b706f1ebde9659
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 2aef485b86974f2ace361613f09d54f8cec042c9510a7b7b7976dc47999496a2
MD5 45ef87fe6532f74e6bef1078fe7d20b1
SHA1 63f18bd8124ea9efa8fa2027401c1ae16528d3f7
SHA512 e55ea1cb296bcbda66545e5877802ac876c5a11d8d071c5be6ff2d8292153b3e00dc0493f709ad359cc29926db8a410ba5bd8b19065cc89726f2ce51c00a690b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 687a928fd4c2f59abce00ead99dda27fa070a0b3592af2c167419fbf8b68237f
MD5 14ffd133818450cf0bd8753dbb4cad6e
SHA1 96cb316d7af49c5b1acf2e6e3492b11006dcb4b8
SHA512 00a34ea05a992175ec1a5e8e94d075530a4ec8c3b394d7dcc7f2e14491057a4024ac04b60eb2613bb77c1fc076d3abb7cd98c88c7a9f2bb65242d96054b297f5
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 dfc3d556dd11ce1091b860190205ebfe9dcd500ae494f6eb4f1d88160ddfb6dd
MD5 1e27eb59fb496be7a5023aea0448d220
SHA1 ea0dddbf306541605b015bb0bc7fa0529ea11ffe
SHA512 4b1528eecc9a6deb5576b0cf809e56d4c0f5f09b8276692ccbfa10c1b8be61eaa9e3458c9f328f0ef5ca6cfb07367f27d44cf60bc62f4a6365af3ed8dc13f9c8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 d80b84edd6da9fac93c1b1ed9a08f6affcc7773fb97f375bbf154adfb49effe4
MD5 2c025bc8b7df506f0d55841ae3de0de1
SHA1 b6417913b2ce402220dcb127e3fbe009f6ac816a
SHA512 3d910ed81c08ee36a26a7b980fbca38c2faebcb66e100fbb210a598bc2fcae440e34c75079126254414bef178a13046a8dff6b4262575bd17ea9cfcb04b809fe
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 02218b304b6020e8471a9827543d1570d94cf5b346cb0465edbde43afdaa5915
MD5 eef8f0d69c748e379685c5b77ed28b56
SHA1 8a67f7e2e2b2a94cedd54acdf188f2db469e7f1e
SHA512 2b9f6793ac2aae96add6fb530e63deec809e741dda6c14faaa37f4c2da870c9f8224c11287870426b4250932c97668ff176d1b0abb5ed16f5c10627f6c4ae6b6
SSDEEP 192:+xWipIjRQejCHV+FRlwer+Po6yIsnVdg4:+xWQU3mGRj+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 bf6958a4977fb43445ada27713fe9de41ddc2c7052821aa460d1f01fd4fa45d6
MD5 00c3387592b3d6e95a6d2ef0da50e6a1
SHA1 f585c5807d57cf86b45f2c1fcf820240f3f24671
SHA512 24a225416cea57b256e1dded1ccf6955c41ff0325b7d7e62821f820fdbd664404649d1dc1ec05fea527476426296a250c19781f50dacdbffa0f83afbbbecec17
SSDEEP 192:QxWipIjKwQeuCCHV+FopIRkKer5do6yIsnVdg4:QxWQbwKCmGop+kzZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 963897dbe437e99a6543fc76bf5949274768d4b97caaa43d6bfa15447a751357
MD5 fa7f647d02ab07ef272578cc44601513
SHA1 3d0ee5252477883c8e5d3f09ed90b5d58e14013f
SHA512 196b1f9f0079c949efaa877bc4ecdcbf90b41006798b956e2c1e95bdf33d7d59b41859924de20d28bed4943358cf469ea932af61ebde8c39a8eea54df32fa4d6
SSDEEP 384:RlvF7pLhLc+eZMXmo1kXqKf/pUZNCgVLH2HfS5crUrWTl:RtF7pLhLnyemo1kXqKf/pUZNCgVLH2HT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 b27c7dc1f0aa8f63943ed1be6a8a2f63bdffa5f82818b4d67c04a7c47795d408
MD5 d4619e8056c9091214b9e8acd1bc3f11
SHA1 e5295dcafed9cd9c768be15a75ee5377f4d3950a
SHA512 72c4203b9cf98e92ea1a8328f133399782724091d6b77c11dd08f7138f7fd87776157d8e403c12e20f5c85ecceb6f32a57f0c7ce3c4d06a6b1fdc2373e92819c
SSDEEP 6144:vXWl+Yv0p1dVW12HTgfGtr4ZlTFqgImLhs6CU:elMrdo4HoGt8ZZFqgImLN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 2dc1dd1bb949fb67080feeaa75258a13d575fa6197c3cd4e9e5fcf08702e58e4
MD5 2bc25222c0743ed8c6691ab81ee0478b
SHA1 c73925440403cbfb1a03ad16821d0d8217f38fa2
SHA512 ac2364036846aca7ecab9e971ced26e60ec594e1f8d4e71ba74d2df7d39d77e68a235460430e030ff26dd600eba8ebb296df97f7c55de34cdc6fe23eb50ac6d6
SSDEEP 6144:v6Wl+Yv0p1dVW12HTgfGtr4ZlTFqgImLhs6CU:blMrdo4HoGt8ZZFqgImLN
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
MD5 2783c40400a8912a79cfd383da731086
SHA1 001a131fe399c30973089e18358818090ca81789
SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
MD5 ff63763eedb406987ced076e36ec9acf
SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9c9f10625293d02dfd8a9d5651cab11236514bc15bd851abe56d4db02e95dac9
MD5 de3610ae290e166f591f88c7bbaa90cb
SHA1 1e5f67ed49c7644c05b417735de1c8612cfb9c02
SHA512 49a617969f49c5b3fae725c1319a99d4123032c530c53f6f0955ab8156caccaf729ad1d5359d35a9c7370bf9d5a99742540a5172ac7b46c650bea60ae246cdb6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 748B
SHA256 b8f426356021d850a8e9319d2760608f9f94e28651cc94d472aa40df6962f4ef
MD5 726a962b00b81311ea3a57ede6f8ca20
SHA1 74265b5397372da82695d1f30fb45b851f82d5bf
SHA512 a8bf49a134c3befa4d924c8854721706de99b5f38676323858d42b5829d0ccc168c4ae1057e6ead9b24148b1ca3c5a44308200bd1491cc3f2406ba63f6ab75ce
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 32ca1cdbb7e725dd1566c8c84f9039df348507e2d8ee652f09451e8b60935664
MD5 1fc1cc65af56c3278b36084445098433
SHA1 baf758235e24bddcd4268de2b53315898d92b27c
SHA512 0e5598ded0fa46133af200334f7d32031d2767cf67c94ecb2ba1ff0bea197bad2269d7b2a713608905385b083b4f00e0a1df48feaf11a3650c1ef4687ff3b2f8
SSDEEP 96:nkkzUMG1ug04wpvWMoiVmdeHa00BZTpiUWQyV+VD7ziEwb:nkkzqQP4GWMXVATcrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 962c1082d0a2c6e05292b3aad1df3abdc3b62313af7220fced6479710f58917e
MD5 87830b05c98760ee7410f62540a00e50
SHA1 3508cfa598024064bfbaab3c8f78efe526b33483
SHA512 dee6a7a01774aac6fcd347b9fa24b2776051148665d91b95981984690e16e1ee20a4f9cee621a04213dd2219c92bfbff67603589b0191cc26906d21fbb6c610e
SSDEEP 96:nkkRjMG1KD404wpm2WMoiVmde6uc1ja0nBZTpiUWQyV+VD7AiEwb:nkkRnYDX4x2WMquchVbTcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fb379f301ee5ce85101517192296ecdb9cb257cce1fd81a4add154ba3604b35f
MD5 4494621dce54da8f6596d61c3f09eeac
SHA1 175f3a67b368aa83b4634c3e28b58cd8539255fe
SHA512 66e98126db04b289df044484f7e52e4735112ecb29b2e2c6425e3c339ed40233d6513d3ff807ad61126c7c6fb47948cfde8d6df7f7e450425e7830857aef573f
SSDEEP 96:nkk8sQ/6MG1KDV04wpRWWMoiVmde6uc1ja0nSZTpiUWQyV+VD7AiEwb:nkkiIYDe42WWMquchVwTcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f933659ab2ce24cdf75d1dd483d47c828f660e1f3215c9ae5b95ddfc4f01c4b8
MD5 519adb46ff01254e1b603958e059dff3
SHA1 b0421982b6ffef6892d3a2544a55ecec216c2af8
SHA512 448ff8e4c2a0a52ccf4e86fdec73b86b7ca060c49d26450ec233d165e77c62645fb1d6148c9446a2590dcd914d8676cb00aaa502337f1a1472df3e534d36897f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupudX2RUVb9Abs0KVhY352Z:A9iIxuERzA83h09RZxYxpzKo352Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a8cda3ba83f6292aea87d353d601877c66e9e6915b154da053a7a18ec9c0d4bc
MD5 ff485bb121baabbd80754b1004715f44
SHA1 5f50961311ac8b62944d6949082ec46753bcac36
SHA512 93e94e06dfee668b3c03cb8f600b152869cf5d99692266ff5235fdd38096b6029eb1b1717218f600413885e3f047c3f90b8e6d514fd03271d8eb062c11449a4b
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupudX2RUVDSaAfs0KVhY352Z:F9iIxuERzA83h09RZxYxKevKo352Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22522\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI22522\base_library.zip
Size 1.8MB
SHA256 1a2fd2bb30f1250cb552cb17839f806602da1559e29adbee5508b6e490306a73
MD5 83b06d6f90f33c512eee102a649279f6
SHA1 96e5734c6d26b9ae9ed3fc3251e8c56ed9d468db
SHA512 3404d4a06e75837b4b3b3bc53141e517feca93362e35cb1a18fee8d3799b4ca2e7c4c4a121d535446d05abd09bb9a0eb5577c748db65c544283575e065e64845
SSDEEP 24576:DQR5pATu7xm4lUKdcubgAnyPb/zZ0iwhLEpdYf9P8skoTlYdWwhuHHG:DQR5plxmrzJBeYwwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22522\python311.dll
Size 5.5MB
SHA256 a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
MD5 5a5dd7cad8028097842b0afef45bfbcf
SHA1 e247a2e460687c607253949c52ae2801ff35dc4a
SHA512 e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858
SSDEEP 49152:73djosVvASxQKADxYBVD0NErnKqroleDkcWE/Q3pPITbwVFZL7VgVr42I1vJHH++:73ZOKRtlrJ7wfGrs1BHeM+2PocL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22522\ucrtbase.dll
Size 1011KB
SHA256 6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
MD5 849959a003fa63c5a42ae87929fcd18b
SHA1 d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA512 64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
SSDEEP 24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Changes.txt

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\Everything\Changes.txt
Size 19KB
SHA256 9871a374b9e6b8660004450f2e735dda01025d4cb51eae0c296fee3fc285d9df
MD5 e3cc8979834c21ddcc26bd94599242f6
SHA1 2045335da8e3a5723547e0c728d3323ecff2aa15
SHA512 f25e89f6cc99c06197889f60e1898af4b1ea309aed9194e42fc5107b0101a195d795690f5ee5f98475a3fe252b839eb6367b154ca8686eb04d033b682002036b
SSDEEP 384:YV2dVpOQCtRjkp+cF1W2WLg4xGJ4UytZpjMUFQQ5NverB35+:BVpO5FkocF5V48J4UytZpj1FPBkB35+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\Everything\Everything.exe
Size 1.7MB
SHA256 fb653fd840b0399cea31986b49b5ceadd28fb739dd2403a8bb05051eea5e5bbc
MD5 c665fa0aa5afa3fb41c21afe5884b4f1
SHA1 c79bddbea392247a4e88221f53c0e2e30368b614
SHA512 743328d688e21f1e19605e82f1abe1b451a4812108fba7b3838b63404f9dd53a693839006cc5176dd070ab5f43de94fa9cdec47805a7e36b01042c9f6c9e4b7f
SSDEEP 49152:Qhua8pOpRzsOV9bzmkSMDgOPIOY9ayV9PxCr5:QhudpMHys9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Everything.lng

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\Everything\Everything.lng
Size 935KB
SHA256 d925b044baa9af9375b8918758a4ccf12b48c5dc7b4aaba8791b92e77e9233f1
MD5 112f64226ee5a339bbe7aefbd9e8deba
SHA1 d9f73eaf2b60531ca155814d217a3b480c940b75
SHA512 d349d1546b031babb84450e66d2e92570441a07f5ef5d8ce843043e03f9050beb160d6fd343ebf3b730a116070f7ca017cd268ab1bf20e0ab71f876542678a1e
SSDEEP 24576:5kSYNOoQEPoQEsh6gST5GxRElK3JBYWuZPb3y7UjX7f1m:5kSIOKlxSAxRtZuNUQXD1m
MD5 SHA1 SHA512 SSDEEP

Submit Download

License.txt

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\Everything\License.txt
Size 2KB
SHA256 4f066c930db22da8bf0a940f4f9ecd43a208b4697288adea26ab5eb7daeaaa81
MD5 3ca499e57472869658d7e877e1ef7aba
SHA1 49d8075d373186f98336c16fcb9b91f1abca4599
SHA512 8ff7f037479ef7e8fe02e62671646cf44ede84ca1befc718c4960ee579190b588fb0bfa409c20afea117c5a4a7756eef96598c33d56605298e672d4a990bd288
MD5 SHA1 SHA512

Submit Download

Uninstall.exe

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\Everything\Uninstall.exe
Size 137KB
SHA256 1316a694538ad8c2333836ce0ab3a748b670cbab394b4683a59219772f1f92ee
MD5 4c5f28025a2603f28f5dc07eb8b802a9
SHA1 b10eefa1319f7a0cd6eccc5b6d6eff52cc3dc78b
SHA512 8f670967cae054c90f420ddf9a94cc6943c86680367f5caf0d49016e01494e77518ccedb31f1a37174b0fffa176bd5e35a88ed87e2e1af1fb75ecc31675d8b46
SSDEEP 3072:NfY/TU9fE9PEtuSWKBAkae31mgjrzElgKoUoWUHKwpSY6mqWCzqL+DW:xYa6IZCpe31mgjr4CKmTXIY6mXMW
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\InstallOptions.dll
Size 15KB
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\InstallOptions.ini
Size 1KB
SHA256 99b98f333848dacc5df866402181a6e2441fff0f9cdbb2a26f5f2c5d5dd12c52
MD5 e2808f4be298a32ae279ee9ebacd0a0c
SHA1 b7929c346ba7a7aa690a766e4f70bc1d44f75460
SHA512 a305986b1eb907caa77616bcf3b9929fcbef8156b9162a942b1720ae32b34e1ba0537c553b54e750a22c3106fdb33870c346dd1f9d72db7d0baa6d318c3752a2
MD5 SHA1 SHA512

Submit Download

InstallOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\InstallOptions.ini
Size 1KB
SHA256 d4e98fc4995e4f72e91af46a6cafcc17f199647c3c1704a063a8cf728895629a
MD5 7591c6f42bff1efbfb05c433648d4950
SHA1 703eba548987e4cece835928f04ff90aecf69c90
SHA512 ef1b0b9d02c204939ec663f2dcce6a5ee893ef36cc1d55f8e60b2dfb53cb753795dade57bb38d0f3471f3b5b6db98c12d25f2128e12688b91c90ef1d2627ffd0
MD5 SHA1 SHA512

Submit Download

InstallOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\InstallOptions.ini
Size 1KB
SHA256 c2471905ae352cf73ccb014f157efe7c76c5dd4951b789bf813df2ba0c038f69
MD5 17d691a7dfee754a0b5399257ece0080
SHA1 68e92918ecf5199c02aa00cb1189374ed0b44355
SHA512 199c63fb8b7015820b7c5c5d40008eb1eae79035ccb27a881ec236578b08a13c720882f697b9f43fe4d6c72559b3979d8233855d4246a088ea205102f888aeb9
MD5 SHA1 SHA512

Submit Download

InstallOptions2.ini

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\InstallOptions2.ini
Size 2KB
SHA256 caf045fdf50d8706410dabb4b4db6edab64d09a1c4229854666c5fdcbc70f35d
MD5 a6634dd375de49a06ff7c8c65f03bb42
SHA1 2834f907bb17d0916cfd1285718695f866e319d6
SHA512 c2d65ed0b99084753447711ea46e2805017b51917851bc7b53a96e58c49b92acf9f3f32fdb9b68beea400050703785ef49f7d7bf77131cb683663375654b71e9
MD5 SHA1 SHA512

Submit Download

InstallOptions2.ini

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\InstallOptions2.ini
Size 2KB
SHA256 43dafc777f8d6187d1183b0354a751db89ad90dd93d50adbee0b6795c84e5db5
MD5 472ba61013815a031c2ef6dea87ed90e
SHA1 9f9632aed6cf9bb1f2e7c36ff0c4b60c0bb51e4b
SHA512 8c5336c1324a991337882167c1967fcb7a555b6d0c92647533645d63322ac7a901694b8cdb041354b4620d937e57f07ec1422feb3403f2c9c29fcfd8c20f8993
MD5 SHA1 SHA512

Submit Download

InstallOptions2.ini

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\InstallOptions2.ini
Size 2KB
SHA256 5ff03c6a6245de551ea7b358e46e58d89e4f3bb2b1340e4839edce3d2cfad0e3
MD5 39482a5df58ff5c49d68118fd91a48c9
SHA1 c289673839b04b7ceea863f79f94d43a8ad79ae4
SHA512 7f86609cc27b97e9cb188c9d7a257240ae221d611a855f0db7176da88f4ead01a735af929a59391e72d1a26bba9719275013de67e359a619b3e5262d74f1c206
MD5 SHA1 SHA512

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\LangDLL.dll
Size 5KB
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\ioSpecial.ini
Size 1KB
SHA256 c346c0af902565f5ee2988002c16002b0220f4c9b9d96df4eeac03b2633fc868
MD5 fe92c95e0c68fcfdd596d72b774ac1cb
SHA1 6a26bbf321e760db7c98a8e808f8dbd6dfa15ef1
SHA512 a5b5405064fb21a632b145bde2be7cf39a7d5370de37a12a1ae6df791563257a403268c1e41f6d120fbcab5ac1f202c833b2ff3fee0b146c596b775f3de8f8d1
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nstF375.tmp\ioSpecial.ini
Size 1KB
SHA256 f3def147a61629ac754d2a137aa1e7122db47073a1a6f75cfb6617a0b1bbc140
MD5 6a79c1ed4aacb83704860c66197d29d0
SHA1 34de405d9c4e60d37e7c28fa8d1832a471bc4e45
SHA512 3f62984877f728854f8183654e135fff7b3c63481541b3fbfbad4ad6985da1f994f4f9ff124e1e951db239c04a23a386d9dcc62510665d530a8f24db12a7a2ac
MD5 SHA1 SHA512

Submit Download

Everything.ini

Path C:\Users\Admin\AppData\Roaming\Everything\Everything.ini
Size 20KB
SHA256 2fb724dd202047575842ab8b47f7c395b06c84879af5a1cd5978b3a0111e3580
MD5 49b6ff446eddaf88ea08a7c16792952e
SHA1 c0dc334f467d867f0e1d3fabd555ebcac395fc8b
SHA512 77caea2889ef3c8396cf333e6f99656cf087ba69e20f86279cf415e9b3ef598a98a0a2bada407443910ef24b8d51602ef3d1504f3826f0f9837d07db488bab2b
SSDEEP 192:BdnZLL+Dy9QOL4jWnTef2JFTAiwTMisXZiPgCSjvtM8nbVwoQTXaS+Ztul4AxuMU:rg8TeEFTA+isX/M8nTZ4z8lJCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 514529.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 514529.crdownload
Size 1.7MB
SHA256 bbf249ab7d4ea4b17a56d2effcd0df563bf4d5cd4f6e00ebf5e74a74ca0034e2
MD5 f81112d40609b97330688098222ef1fb
SHA1 092f5b3f4f7b437923e4cbaf2dd12a6d793a32b0
SHA512 86d6cc9d402764557c9011cd79f9d9feb3c57a3ec7717156a0dbb1a107f89bc33d7a4f61d7356c0fed8576ab1d44674e25772566b82e0ef219cf69011ebf872c
SSDEEP 49152:O4pDO4v8RH5CuO6kqFIymNDELHVDJNs9Ix:O4cFRO65ILMh7
MD5 SHA1 SHA512 SSDEEP

Submit Download