hxxps://ektoplazm[.]com/free-music/virus-installer-trojan-exe

Analysis

max time kernel
300s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://ektoplazm.com/free-music/virus-installer-trojan-exe

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{8738EE74-90BF-4CF1-A128-D200BF1D962B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 1e00718000000000000000000000e4c006bb93d2754f8a90cb05b6477eee0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 0c0001008421de39050000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5464	explorer.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
3768	msedge.exe
3768	msedge.exe
3712	identity_helper.exe
3712	identity_helper.exe
4444	msedge.exe
4444	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3176	msedge.exe
3176	msedge.exe
5888	mspaint.exe
5888	mspaint.exe
5864	mspaint.exe
5864	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
5568	systempropertiesprotection.exe
3568	OpenWith.exe
4684	OpenWith.exe
5620	OpenWith.exe
1784	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5464	explorer.exe
Token: SeCreatePagefilePrivilege	5464	explorer.exe
Token: SeBackupPrivilege	5368	vssvc.exe
Token: SeRestorePrivilege	5368	vssvc.exe
Token: SeAuditPrivilege	5368	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
5464	explorer.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
3568	OpenWith.exe
3568	OpenWith.exe
3568	OpenWith.exe
3568	OpenWith.exe
3568	OpenWith.exe
3568	OpenWith.exe
3568	OpenWith.exe
3568	OpenWith.exe
3568	OpenWith.exe
5888	mspaint.exe
4684	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5864	mspaint.exe
1784	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 3152	3768	msedge.exe	85
PID 3768 wrote to memory of 3152	3768	msedge.exe	85
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 216	3768	msedge.exe	86
PID 3768 wrote to memory of 624	3768	msedge.exe	87
PID 3768 wrote to memory of 624	3768	msedge.exe	87
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88
PID 3768 wrote to memory of 4692	3768	msedge.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ektoplazm.com/free-music/virus-installer-trojan-exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbda5446f8,0x7ffbda544708,0x7ffbda544718
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1388 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3920 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3880 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2564 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1560 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14717568654072112707,4057790746110296139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:5860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault63a8c822h949bh436ch934ahe2a660d09c88
1⤵
PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffbda5446f8,0x7ffbda544708,0x7ffbda544718
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,7583372226479095080,15329878139098026147,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,7583372226479095080,15329878139098026147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  PID:5616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:5740

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1708

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5464
- C:\Windows\system32\systempropertiesprotection.exe
  "C:\Windows\system32\systempropertiesprotection.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3568

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_#!!SetUp_2244_PassW0rd$$.zip\#!!SetUp_2244_PassW0rd$$\Key.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4684

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_#!!SetUp_2244_PassW0rd$$.zip\#!!SetUp_2244_PassW0rd$$\PassCode.txt
1⤵
PID:1132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5620
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_#!!SetUp_2244_PassW0rd$$.zip\#!!SetUp_2244_PassW0rd$$\#!!SetUp_2244_PassW0rd$$.rar
  2⤵
  PID:3644

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\#!!SetUp_2244_PassW0rd$$\#!!SetUp_2244_PassW0rd$$\Key.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4829218222c8bedb9ffe89dffd37095

SHA1
aae577f33f413ec3d09f2e7ff5d9cc20a602241c

SHA256
49239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b

SHA512
03e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e5609bbe458c6278dc686a3156165946

SHA1
0e6e06ec248634ad148b17b51c88f6a0fb16e20b

SHA256
dccda5608e420fc56ae1e2a8d188bdeb6c36b726e128207c3a8d138861a59f1c

SHA512
92a4fd2db229b04ed3b53023db3931684433cb191a34e3cd15abc993ced8316ccf55b74feead600113a324b89000d9443f9b8c0c0a4afceb20632429fc26f3d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
15e9c4b4eefb3e1c08a010e748e10f58

SHA1
3172378f2c7a00553ce086dbf53fcf3126c5a724

SHA256
07b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000

SHA512
811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
34KB

MD5
8c91894fd272a1dfd4a217aaf99c563c

SHA1
040b39490edeb78d79d05731963c564642fa0b6f

SHA256
ade54c249722b24c1b74b20616c656cb79f3932386e6da33d24331e4180cac23

SHA512
223901cc562d36501f5c6fa3f44109f3ad46e70a5027a89f8fba32f0f2896d38b91fae981493a64ac454cb0f995a671ca95ea88236f20efeb884537d1e778d0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
19KB

MD5
bd77498da0387fd4ba645f4a6832d89d

SHA1
e8b3951aa6d609992184fbebdc075ca6d948d2d7

SHA256
b766a7d9c98c5b473599760da8977b80eb5058e4eceac9bfe3fd5e6cbc9b4c89

SHA512
75e8bfb68e86f309bc99b52bd476be3112064b641c1b5dac577730ef01910d97d39b5d0adca53b8b6358ebecf13f0ed2175ed3ab2a0b489e0435b868a3532ec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
30KB

MD5
0163a422aafb83c214f62d19c936a490

SHA1
6b5779b134ee9cdfd8f1cfb99bf094b09c1ff07a

SHA256
d50229cc42c20999eeec4246f1533aecbd7d25015faed390a4bfa3360b016020

SHA512
01ab03d3d52b4629ef7912d722932f3109584a85770bee0fcd6b19a09f1abf0f67864c1b6936efb652a86705f3261d633a63ed424b6286ff75b70d26df2078c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
154KB

MD5
70819f04f638cfa2146b15962f6c1f3f

SHA1
937487156357559a325ce1323fad66a4d8db7a8f

SHA256
5369980559fbc0ecc247ed943df75cacbd91194c99b1a601d6e992439915d838

SHA512
6ea411b852477d92b334ecd971e65c4f8979cdbdf7e2a39daf99cb0a7099c89a3afc7ad1a640f701649b0ebc4a49e4f8f48ccdb26ca8d6d4801e74f56acbe794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
76KB

MD5
51cfb680e7d35e9e1cda1f7e5b442ce0

SHA1
214621e18b75c3f8270ac43c9947ac4821781456

SHA256
2d10c4edd3b5f8ff1864e4bfeb4de3b7e724a76766739f791b887247869fcc03

SHA512
c648a33b84a153e0df67ab33ee41e59d3321757a256dddded7fb396861bef05782f3762c9659386f1b06cf869477f899c8300f9dbf939e6621df2307baf383b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
19KB

MD5
7377ac1029b199fec9989d7b2ad81544

SHA1
67f751a75273e73827d49ff2ed60e0dd869836d3

SHA256
1039e0a19bedddce6917a6366300b623dd0a69cddbaf4dc543d0a8a1a48362ff

SHA512
695f3671d825b2eb9de8b59264b3bd332e8a69b16a728ea5b085d422667a650c511f0ba8fd5a10a03846d6f3f8d3c4438ccb7ffd825892d55b4c0573abc79b86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
47KB

MD5
015c126a3520c9a8f6a27979d0266e96

SHA1
2acf956561d44434a6d84204670cf849d3215d5f

SHA256
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

SHA512
02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
18KB

MD5
c83e4437a53d7f849f9d32df3d6b68f3

SHA1
fabea5ad92ed3e2431659b02e7624df30d0c6bbc

SHA256
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

SHA512
c2ca1630f7229dd2dec37e0722f769dd94fd115eefa8eeba40f9bb09e4fdab7cc7d15f3deea23f50911feae22bae96341a5baca20b59c7982caf7a91a51e152f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
31KB

MD5
31ff052bbcc7e21053772e21fa0c249d

SHA1
9aa3a9e973870eef116f56dac7c79a6074eed385

SHA256
e850610f3ac70a4c28326f934fa292bab59838b3ca2075c7c331580c72f99b88

SHA512
5b9a26eb289bce914fc9f508e8681c9de9d2f45b51529293fb33ea6561ffef8b3b869857aceec5bd884d3b70fb10f0fc6ee8e9abf3e9dcab4c71e5ab34454078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
75KB

MD5
af7ae505a9eed503f8b8e6982036873e

SHA1
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c

SHA256
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

SHA512
838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
93KB

MD5
3299dbdede43df403d514f41d0509e7c

SHA1
9411eb60c1d68d963ecc165e7b912b8b8a04dbb5

SHA256
6dec3e810ebc515612e22b013eb6a9d110d89b8cdafc4b1c23d1796873c0223c

SHA512
3c3999e223a3cc91032fc1eab855a130077352ae9e4a9857e125fd49dc31b56f3c0ba3bf3cd37af580b7298fa15b2b373738f676fc44d2a1151d42d94d0cdce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b42cdb098ea8d2959056f1b42890bd80

SHA1
2e52e250a2a162a6834026324f767c4d016491f4

SHA256
6f87d46470beed1cdb099cca78a198e835394f83aa5c4b8769655ecef1c48de2

SHA512
bcf7b6e8fb311cdfeecce7b1c18ff14d1d88d6298b01a08075b8c7e32409c256f4c06f9d2d64cc9fc217e6c97f06751f271aec51417cc62fc28dcd408d084ee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ca1eea506255820efb703d05a9f14939

SHA1
70af79b96da6996668cb6d21ad11653dcb4f7925

SHA256
7234a13f4abc59e8ce93104eac94adbb40502a737108be34df4ce3d5e44f716e

SHA512
075565c3b63b0ea15752194da5890c38bee095ab6e25432520853a6c216e40df30e8820505457ac65a20face00c976ca16447fd6144bd369dbe3eaacc63564e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
bd56a25c33fd0577b478d42e700baed2

SHA1
1c8f660a57eaf1003e510197131bd9ab1cc0267b

SHA256
500a801e86e8cf4a81146c242d319950dae97b3a8d357b9e6cedf88fc366b4f1

SHA512
a0c1c09f01887722f373fa9e59c46f0096f724d4ef7414d105c06f440d004e1f7acf6df83f19fe3e260eb72fab8e57ec3bbcd0c2e7ede720e87b4514fd6c1578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
57bacbde7c07526691f8958b27b50c6c

SHA1
f3d3a3ed70f7e08b3783401c7ef5d45b2ced470a

SHA256
6a7c99b1c6de75888b5999171a9c768db0534674f16122f2b43384ae3c10b38d

SHA512
420f12c2bc996f3b7aebb2fc5f84df743ca24feb8925321a3235455c13decd7cc1bf2df410f9266055ebdad08d2ea7c16ad097c7762033224d02b950392a6bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ed22febde091a3d48d8e60cb0278a9d9

SHA1
4aa5940959d3437bf6c81f5c859d4f80ca6a88be

SHA256
c5bc7be2201c6c06a55dc37d786b1c9ede843057f85a7a3d7bd26811a8b5bf27

SHA512
713f6ffc662d5f5831d4437997a96c5053dba739178829d93791911d01b1cb2445a3824b63f486a9a4e48659769ba8fae26544b0c7e1ba2cbd3e356c6b904c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dfd79b882f0dfe75b31089ceb608bce6

SHA1
0a71ea398d337b5611c6e040898986263bf69fc4

SHA256
a858e9c69092d0e1c1edde048f63b0eb06a1769aa094267ba4c530f299ea8dc1

SHA512
e5b1f2c83aceea16adf783d93fdad9b71d2c28fbea85a5c8dc7a10b3e0c3a391a0a087316a3615eb068a5870d412c547ee86213e702c93ac744ad6b36955c40f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
892B

MD5
5c4da8002f92cad0627abea2c31713aa

SHA1
2f4373a13a42e9023787ceeb4203f54e0c4e4cf4

SHA256
38b63e516cf1e2361472ecb80919bb5d34cb2b43f8f12d189f9220e70dfb0df9

SHA512
11405700f4a3c1bc563050d5bfe5382d2918b55c0ce85fb28d40557d4380d939cf9128eb1c309c321475b7fc4462aff37e93f5241bebba6d60585c33ac72df55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8962487c254049dabf6cb8c8d611a75e

SHA1
072e7cd5d993e3639292dd4cf10b68bfc7281613

SHA256
8a1c0cf239f095d956eaf26faf49d8d1dba86befb817353742334f74447c1ac5

SHA512
332b5358a295e44e7c778e2d25f5a6645239e38d1dbcdd780165f6d44981b372ef2d7486dedd2f77d3826f62c99b9f6fda75ed26b846838839418e64844d354b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c24d512a7f98211bb2de032954402b20

SHA1
f1daf1409d6d14a886700bec75cee02df18fd53b

SHA256
f04ec8430d098be371690bbe0409b31da59060000724db704dfe770d6c444843

SHA512
62b543383b3aaef6529695df54401e8faad6a043e501685f7f1110a04638ebd13fd213b0b6e8d903beb74b0d0cbb4ea0f3d7809f5ca44183a27ddfc4fffdc7dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
632b734972760811152cf09673e7fbc7

SHA1
02c0229cb6101905b43b9bad672ab27c6d50e2b2

SHA256
b12c1102bae8bb61bd33d2a6025752ad5a07cbd927c159c07eaa77d1d63712d6

SHA512
bce43c4099747ab00004dd99e7c8096e687069cc3157538aaaa823dff13b3d58b186557485850a1fd6dad2ee310996d3229001bf09b2d3532d869dda329877c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
312fe037bf34d0e5900b60d36ea04859

SHA1
61b3951689b5b6a260519a39281a55851a37b5f0

SHA256
55ca2ff030ea53781c29ae2103e85fd53aa4c13249465535c25558330f83ed3b

SHA512
fdc7050959c637436e8694bb500f917f738bad459a4a697c8f65243668a85bea5d73bf56c4b4ce22fc0d685769dea28546ccf5df70ea559477d36698750b382f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b90193e12c0ee05ea59b0aa8a63e1787

SHA1
6216fad648fa9ebf9438b03ebc79a59c4629e05b

SHA256
71dedda64debf1509c44da4a645cf1a223e89aad651acb73ab025dd324a2e19f

SHA512
f22f133afec072523e7a45c23400e63d1bbdfe262d8950ca008dd4d34ddab4961706143db8606ffd1c89abf88aeb41e48c53b8fedcfa3cd7bca227f7702d8247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1a43085c244e22a9667ae6d2fb8b2ae5

SHA1
22d20188935ac0396fe525f81bba60f96f3759d0

SHA256
9c95489ad1a636d7cff94edbfe5522a05b0295768c0b44eca6d79e69def44035

SHA512
cb51e15f242aad46cc825678f15c7899f5c4f116cc6290236bce8968d120ef0453696158b1e168d05b87300cf067180d1aff04a72e071e77478cab8994163ea7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f4b3ca8a36a57f8e2ad94236c2f5383e

SHA1
ed626401554dde569d483fa90fc3df28aacd8890

SHA256
1cbc72d0329f6ec551b0229a83b5976efe18c9e30c334b2f465823b81440d442

SHA512
06195ff98192cc97d67c13d8107133fce03830a56092fb205b9cdb8eae25f5b15ed71aa5caf6adf248986f517cd5c3e5bbbd8f7361067e4b4211f256dbe54ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
883acd2b2abdffdb3fea241d89b5a5de

SHA1
6ab310f25ac4ee62e302c5af07d39e73db1b2f1c

SHA256
d7fe34ea141eb01b889e48cffa463ce2e15d13c55a4cf285866bd3b7683ccfb5

SHA512
f44f931f501fab21e684eac467344c582428ba250cdf81ffb2a36b16c53e1a2eb82e5edcf912aac23349fa12b5515cc4a22b8abf84a5921ac0557391781dd673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7915ba0545666aa5833cf9f9f86d45d6

SHA1
743ecc319bc2a54973582d4a5198042a48fbe8db

SHA256
f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20

SHA512
a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bd83652a92f0a137e411f306083950ad

SHA1
cc45147e1608b10c7ed4c741ddb0949a5daf50fe

SHA256
ec09526bcf3a3552dc910013cdc8b2eb697e84d53e176df5c2f3793094fd4fa1

SHA512
36ffa63eec23c4a6786c21ee6024d8886ac5bc900e6c1c8a83ae692d410365f77214b88ae46966a91d9eb42951aa55e730b61b3236d539b63633df27cb92e96c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
96b02352ac7404fc6a7dddc39cc7415e

SHA1
db5d1b7aae8e46406cbe9a37741b07ae07e55b15

SHA256
58d536b1301f24583e069f1d9f8f8ccd28def045f59acc70e7d12ba131f3856f

SHA512
d700998708c6c5a5a0f9b0ace9f7a017c772a0f92f8c718e411ac2c2182fc3b4780c9e0601cedffb9c36b74b14cb00d156e15fbf05025604e49d4dce14c8a380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dddcc2864240830c7a7d72aab5fde82e

SHA1
3a13d88df6e1c4193ede270de1014de9d09307f0

SHA256
d18328ea9f14e1218d2ea45e87e1c21391342d89cadf5f8b1e53dfd6f3c729a5

SHA512
0a73fe209ce9abd0c69a8bd1b20813e5a17440aed9db63940161bf61d2b2af0f556c15d865b53a807736a8ad0923095c6c2d40871d4477e2ce7307f6037b3ba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58992e.TMP

Filesize
370B

MD5
937dbbc5246372ff8a4a2f9bd2cd116e

SHA1
d094884a473acd58d73d4fb06e0bc68856bbfa01

SHA256
8ff9d946de97ba9a33731cfc7b392adf698b4971323478ac7219916565aed015

SHA512
47fbeb8b66e00184bc4a973cbdfa546ead864f522f8b1f9bfda5b62f21262479229e16230f43ce9ebece8443f643eaccbaf210bd850c6b72588fbbdb9818e808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6d64d58-a628-4ce6-b4e3-224c52e35cf0.tmp

Filesize
9KB

MD5
763be2e2bb7a6992925007bd0daf06b7

SHA1
e7ce827ace28262a4289adadf700f83529b0d132

SHA256
4a0b51a808185a0644dd01ece8093f7eecfe77eb3a95d26036b360f0bf192bad

SHA512
9ce47deb30f50f40d80bf7e2622ccd7596cc2742dc4223567c364ede56b98a1af0767bee0f5ccaff95b6eab1bf211ea0a56d4d6a6256431f43d8609c00cfdbdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d9c6060a74db5d3bbf9b0a2f88062e73

SHA1
a08cd760bb99dcf775364f104942df5272305db5

SHA256
5344a10f895dbbd4d43c9a9adf9533112fbc2f298b256058adc4fbaeb25ead8c

SHA512
ee0eefafd392c9639518461030cd5c4fd4e94cf95a1cac46c4902db7d2349927b00b1a15da4ff354499f228417822f71ae925075b7a32d78dedf916b819901e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
11ee6d2814c1d6b53ac5a298a1c9a398

SHA1
b0d03fd565de8d7d19b4a590ea42ed2111c42a3d

SHA256
d27919db833c558298af64aae75debbdb06d28bf148047daf818e388783be62b

SHA512
1894d6ad342a9ccbd1a0b6c4ab978de4e0178ee04e7b8a93edd72072a9eb99b7fa6c3578ad1d1d9fe702b47f75a7db4128108cf902fba45496be9d852d30b23b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
787362e6cb7955213cf633fca9aaaa55

SHA1
4b325aeff379ab3ff17f61f2d42d958961617f1d

SHA256
22cb8085b5507283db3580ee137bf7c8f330339544beedb914b80b374a53f488

SHA512
033f78d9775c3b799b7ef6751491ccf75c0c8f8c8a46c93b4e424c88aa19a075a24197de9ff9e2e5dfb4f2c715f8f6a94f85170926d11e4556e2db59c3608bad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
157edd02d5c32ca95663d80658355595

SHA1
91e46acdc3dfd6b3de006d340336b02e161ea43e

SHA256
799f49cd666242fc69936bd1ee94ba917683259a184b44a18902b03703d81330

SHA512
16591c308855d8a9342bb14dcd7ca31a01848ba161cb10a7eb3e77e23c9b496a57ca4fec3fc87271be5596524e042036a5c7aacb526ea988f0280dd641b53529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
16da0dbb7cef71a7a146561088386fb6

SHA1
4b48f9804cee8ef693ae5e49d5e3057b5f9cb56f

SHA256
453dddf60b957c628e149f747e38ff888c68f0123bbfbef40c154b467f2ea930

SHA512
6606446ce04e7cebc9e2eb17cc5dc3fedce5f25b986fa06fc3fb800081cea20723838dbaa30f13b1378eccced3bf6e9ace441c72cfef00867d7fae54e295be01

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
f89fc4c2836208c3a70894b62f2f1128

SHA1
aa2f205f0a6a311049aacfaa423ed433bcd5c677

SHA256
bfe05f164778e3318a901b5082f876ea774a6b687fc7f5689872848dd56fd822

SHA512
42a9bd47675af22c2a126dd6e24bd18518de8e50132e974346802cc622778effa8bba80ec63c9de548319df4685d50659fe8247a1383b535d806219f15852905

Download Submit
C:\Users\Admin\Downloads\#!!SetUp_2244_PassW0rd$$.zip

Filesize
9.2MB

MD5
5d0ced9641e81bab8709e7ed9920e4db

SHA1
1397ec9e7f535807d35bbf82338dc9fc134ee69f

SHA256
9089740aad4ff56313d064b28651492dfafc0f79d0f02975bc3882145485f1df

SHA512
c6817e1f92a07b4e7b7ad8efea97611cd9f1d510d02b564df73b44aa0eab8409108b030ef85d19aea6c348abeb6d96480ce26e32345bd171553d069960c0697d

Download Submit
memory/3304-892-0x0000020AB7680000-0x0000020AB7681000-memory.dmp

Filesize
4KB

Download
memory/3304-890-0x0000020AB7600000-0x0000020AB7601000-memory.dmp

Filesize
4KB

Download
memory/3304-879-0x0000020AAE970000-0x0000020AAE980000-memory.dmp

Filesize
64KB

Download
memory/3304-894-0x0000020AB7680000-0x0000020AB7681000-memory.dmp

Filesize
4KB

Download
memory/3304-895-0x0000020AB7710000-0x0000020AB7711000-memory.dmp

Filesize
4KB

Download
memory/3304-896-0x0000020AB7710000-0x0000020AB7711000-memory.dmp

Filesize
4KB

Download
memory/3304-897-0x0000020AB7720000-0x0000020AB7721000-memory.dmp

Filesize
4KB

Download
memory/3304-898-0x0000020AB7720000-0x0000020AB7721000-memory.dmp

Filesize
4KB

Download
memory/3304-883-0x0000020AAE9B0000-0x0000020AAE9C0000-memory.dmp

Filesize
64KB

Download