hxxp://A"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞

Analysis

max time kernel
384s
max time network
374s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-11-2024 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://A"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞

Score

10^/10

adware discovery evasion persistence privilege_escalation stealer trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8F5D9E08-71EC-370E-BA96-36E6EF916DF2}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{FEBEF00C-046D-438D-8A88-BF94A6C9E703}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components	reg.exe

Disables Task Manager via registry modification
evasion

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{189A3842-3041-11D1-85E1-00C04FC295EE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllProtectedRootMessageBox\DEFAULT	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.10.3.42!7	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.3	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.67.1.2!7	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1A610570-38CE-11D4-A2A3-00104BD35090}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{603BCC1F-4B59-4E08-B724-D2C6297EF351}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9FA65764-C36F-4319-9737-658A34585BB7}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9FA65764-C36F-4319-9737-658A34585BB7}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{6078065b-8f22-4b13-bd9b-5b762776f386}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.30	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllProtectPrompt\DEFAULT	reg.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies system executable filetype association 2 TTPs 46 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	reg.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
150	raw.githubusercontent.com
151	raw.githubusercontent.com

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
1508	bcdedit.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\appidcertstorecheck.exe	cmd.exe
File opened for modification	C:\Windows\system32\AxInstUI.exe	cmd.exe
File opened for modification	C:\Windows\system32\catsrvps.dll	cmd.exe
File opened for modification	C:\Windows\system32\AudioEng.dll	cmd.exe
File opened for modification	C:\Windows\system32\Boot\es-ES\winresume.exe.mui	cmd.exe
File opened for modification	C:\Windows\system32\ChxDecoder.dll	cmd.exe
File opened for modification	C:\Windows\system32\ComposerFramework.dll	cmd.exe
File opened for modification	C:\Windows\system32\comuid.dll	cmd.exe
File opened for modification	C:\Windows\system32\ActivationClient.dll	cmd.exe
File opened for modification	C:\Windows\system32\AcWinRT.dll	cmd.exe
File opened for modification	C:\Windows\system32\AppointmentApis.dll	cmd.exe
File opened for modification	C:\Windows\system32\config\SYSTEM.LOG1	cmd.exe
File opened for modification	C:\Windows\system32\bnmanager.dll	cmd.exe
File opened for modification	C:\Windows\system32\bootim.exe	cmd.exe
File opened for modification	C:\Windows\system32\cmdext.dll	cmd.exe
File opened for modification	C:\Windows\system32\AppXApplicabilityBlob.dll	cmd.exe
File opened for modification	C:\Windows\system32\aspnet_counters.dll	cmd.exe
File opened for modification	C:\Windows\system32\BingFilterDS.dll	cmd.exe
File opened for modification	C:\Windows\system32\basesrv.dll	cmd.exe
File opened for modification	C:\Windows\system32\Boot\it-IT\winload.efi.mui	cmd.exe
File opened for modification	C:\Windows\system32\CloudExperienceHost.dll	cmd.exe
File opened for modification	C:\Windows\system32\acproxy.dll	cmd.exe
File opened for modification	C:\Windows\system32\aemarebackup.dll	cmd.exe
File opened for modification	C:\Windows\system32\audioresourceregistrar.dll	cmd.exe
File opened for modification	C:\Windows\system32\AudioSes.dll	cmd.exe
File opened for modification	C:\Windows\system32\bdechangepin.exe	cmd.exe
File opened for modification	C:\Windows\system32\bootstr.dll	cmd.exe
File opened for modification	C:\Windows\system32\adrclient.dll	cmd.exe
File opened for modification	C:\Windows\system32\adsmsext.dll	cmd.exe
File opened for modification	C:\Windows\system32\AppManagementConfiguration.dll	cmd.exe
File opened for modification	C:\Windows\system32\Boot\ja-JP\winresume.efi.mui	cmd.exe
File opened for modification	C:\Windows\system32\CastingShellExt.dll	cmd.exe
File opened for modification	C:\Windows\system32\config\SOFTWARE.LOG2	cmd.exe
File opened for modification	C:\Windows\system32\accessibilitycpl.dll	cmd.exe
File opened for modification	C:\Windows\system32\advapi32.dll	cmd.exe
File opened for modification	C:\Windows\system32\Boot\it-IT\winload.exe.mui	cmd.exe
File opened for modification	C:\Windows\system32\cmintegrator.dll	cmd.exe
File opened for modification	C:\Windows\system32\cnvfat.dll	cmd.exe
File opened for modification	C:\Windows\system32\appidapi.dll	cmd.exe
File opened for modification	C:\Windows\system32\appidsvc.dll	cmd.exe
File opened for modification	C:\Windows\system32\ar-SA\mlang.dll.mui	cmd.exe
File opened for modification	C:\Windows\system32\compact.exe	cmd.exe
File opened for modification	C:\Windows\system32\batmeter.dll	cmd.exe
File opened for modification	C:\Windows\system32\Boot\en-US\winresume.exe.mui	cmd.exe
File opened for modification	C:\Windows\system32\ci.dll	cmd.exe
File opened for modification	C:\Windows\system32\CertEnrollCtrl.exe	cmd.exe
File opened for modification	C:\Windows\system32\cflapi.dll	cmd.exe
File opened for modification	C:\Windows\system32\config\SECURITY	cmd.exe
File opened for modification	C:\Windows\system32\AppVEntSubsystemController.dll	cmd.exe
File opened for modification	C:\Windows\system32\auditcse.dll	cmd.exe
File opened for modification	C:\Windows\system32\ByteCodeGenerator.exe	cmd.exe
File opened for modification	C:\Windows\system32\change.exe	cmd.exe
File opened for modification	C:\Windows\system32\cipher.exe	cmd.exe
File opened for modification	C:\Windows\system32\compstui.dll	cmd.exe
File opened for modification	C:\Windows\system32\cmdkey.exe	cmd.exe
File opened for modification	C:\Windows\system32\ComputerToastIcon.png	cmd.exe
File opened for modification	C:\Windows\system32\Boot\de-DE\winresume.efi.mui	cmd.exe
File opened for modification	C:\Windows\system32\cloudAP.dll	cmd.exe
File opened for modification	C:\Windows\system32\config\DEFAULT.LOG2	cmd.exe
File opened for modification	C:\Windows\system32\aeinv.dll	cmd.exe
File opened for modification	C:\Windows\system32\bg-BG\mlang.dll.mui	cmd.exe
File opened for modification	C:\Windows\system32\biwinrt.dll	cmd.exe
File opened for modification	C:\Windows\system32\atl.dll	cmd.exe
File opened for modification	C:\Windows\system32\bitsadmin.exe	cmd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241107221221.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\76cd0ddf-2ece-4e76-a9c8-05df8827cb56.tmp	setup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	explorer.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	explorer.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	explorer.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	reg.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{15D6504A-5494-499C-886C-973C9E53B9F1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{42B07B28-2280-4937-B035-0293FB812781}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{91397D20-1446-11D4-8AF4-0040CA1127B6}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3C4708DC-B181-46A8-8DA8-4AB0371758CD}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EF105BC3-C064-45F1-AD53-6D8A8578D01B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4FA211A0-FD53-11D2-ACB6-0080C877D9B9}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6E22710D-F799-11CF-9227-00AA00A1EB95}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C531D9FD-9685-4028-8B68-6E1232079F1E}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{C94158E1-6151-4442-ABE6-FD53D6534CCB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{905BF7D7-6BC1-445A-BE53-9478AC096BEB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CFFB1FC7-270D-4986-B299-FECF3F0E42DB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E6127E3B-8D17-4BEA-A039-8BB9D0D105A2}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm4y.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4F496A52-13F7-483D-B5E2-0FC4AA567749}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{84926CA0-2941-101C-816F-0E6013114B7F}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B26E6120-DD35-4BEA-B1E3-E75F546EBF2A}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{f5078f28-c551-11d3-89b9-0000f81fe221}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{28953661-0231-41DB-8986-21FF4388EE9B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{78E61E52-0E57-4456-A2F2-517492BCBF8F}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{472734EA-242A-422B-ADF8-83D1E48CC825}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{4E7BD74F-2B8D-469E-99FF-FD60BB9AAE2D}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm4x.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{724D43A9-0D85-11D4-9908-00400523E39A}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{8DCB7100-DF86-4384-8842-8FA844297B3F}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00020421-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{ADEADEB8-E54B-11D1-9A72-0000F875EADE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BE6-3C52-11D0-9200-848C1D000000}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D306C3B7-2AD5-11D1-9E9A-00805F200005}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2318C2B1-4965-11D4-9B18-009027A5CD4F}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm6o.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm5p.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\Restriction Policies\Hashes\8FD22F348F4EDB71C386D77A35137186C317825E	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0F1BE7F8-45CA-11D2-831F-00A0244D2298}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{5B84FC03-E639-11CF-B8A0-00A024186BF1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BE2-3C52-11D0-9200-848C1D000000}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\USE_THEMES	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{3EB9C349-7473-48AC-A59B-42F31751974B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm7j.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{33d9a761-90c8-11d0-bd43-00a0c911ce86}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{974E1D88-BADF-4C80-8594-A59039C992EA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EE5E14B0-4ABF-409E-9C39-74F3D35BD85A}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FE9E48A4-A014-11D1-855C-00A0C944138C}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\INTRANETFIRST	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{54274112-7A5E-11d2-875F-00A0C93C09B3}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BF4-3C52-11D0-9200-848C1D000000}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C94188F6-0F9F-46B3-8B78-D71907BD8B77}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3A04E10E-0171-40AA-BC41-69014E5DA261}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\ULINKS\NEVER	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm59.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\Negotiate	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{d99f7670-7f1a-11ce-be57-00aa0051fe20}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{053F9267-DC04-4294-A72C-58F732D338C0}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\ActiveSetup\CompanyName	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{eeed4c20-7f1b-11ce-be57-00aa0051fe20}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{877467C0-F9E4-4561-84F0-65AA7539833C}	reg.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "245"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{3918E32A-FD7F-461C-B2E0-F5605207C30B}\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BED7F4EA-1A96-11D2-8F08-00A0C9A6186D}\2.0\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEE00915-E393-11D1-BB03-00C04FB6C4A6}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0098-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0255-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00024424-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0136-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60695e7b-0dde-44fd-ba98-63606218db97}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EA00553-9439-4D5A-B1E6-DC15A54DA8B2}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5A98B233-3C59-4B31-944C-0E560D85E6C3}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0293-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0049-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82B02373-B5BC-11CF-810F-00A0C9030074}\InprocServer32\11.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0073-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CDF168A-6E3C-4004-93AF-A3D5E3C8DCF9}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2E34EB5-8B9D-11D2-9014-00C04FA38338}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B0E94BD2-2DD2-532D-960F-4D1A8185B021}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.icl	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.opus\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E556-4FF5-48F4-8215-5505F990966F}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0347-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mix\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.SVCDMovie\shell\Open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0066-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0147-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0345-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\Verb\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp3\shell\PlayWithVLC	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0308-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E47EAFB-79CD-4881-9894-55A4135B23FA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{760681E7-B985-41CE-BCBE-2985A1DFC61C}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002095F-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicMarkerTrack\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{0621016A-022C-3A7E-B017-F4589F97BA4E}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\Version	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B0BD075-929C-4E52-AAD1-458C81A10B24}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0174-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{c1e9bc6d-1dae-421a-9369-cc7ff0d6e359}\Shell\Windows.BthMtpDisconnect	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3059007D-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\P7RFile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.thp\shell\Open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F26E-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AADJCSP	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0218-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CompressedFolder	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{305106DE-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4466E0F-C942-4C9C-98EF-B31A17AEAF1E}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0373-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C374A42-BAE4-11CF-BF7D-00AA006946EE}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\DataFormats\GetSet\5	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\search\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A11A6FD-66B2-4AC3-B8A8-75CFFF27A389}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0216-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f949c481-4e2a-4e7f-bf59-ddd7eb0e7a83}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TIFImage.Document\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0060-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0127-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0336-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E170-0000-0000-C000-000000000046}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0343-ABCDEFFEDCBC}	reg.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
5784	reg.exe
2824	reg.exe
5580	reg.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\21761.bat\:SmartScreen:$DATA	cmd.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 196314.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2688	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
1456	msedge.exe
1456	msedge.exe
1152	identity_helper.exe
1152	identity_helper.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5828	msedge.exe
5828	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1824	explorer.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
2520	Process not Found
1708	Process not Found
5932	Process not Found
5824	Process not Found
4696	Process not Found
1700	Process not Found
2400	Process not Found
3804	Process not Found
1524	Process not Found
3620	Process not Found
3684	Process not Found
4456	Process not Found
2112	Process not Found
5244	Process not Found
3780	Process not Found
1592	Process not Found
4404	Process not Found
1556	Process not Found
5052	Process not Found
1940	Process not Found
5096	Process not Found
4888	Process not Found
2500	Process not Found
4320	Process not Found
3052	Process not Found
1540	Process not Found
4176	Process not Found
2840	Process not Found
1272	Process not Found
844	Process not Found
3356	Process not Found
2264	Process not Found
2076	Process not Found
2432	Process not Found
3672	Process not Found
2448	Process not Found
2440	Process not Found
1968	Process not Found
1936	Process not Found
2276	Process not Found
2484	Process not Found
4656	Process not Found
5428	Process not Found
4936	Process not Found
4764	Process not Found
1256	Process not Found
2360	Process not Found
2272	Process not Found
4836	Process not Found
4904	Process not Found
5720	Process not Found
4556	Process not Found
2404	Process not Found
5140	Process not Found
3264	Process not Found
5340	Process not Found
5336	Process not Found
5420	Process not Found
4680	Process not Found
5432	Process not Found
5440	Process not Found
5448	Process not Found
5464	Process not Found
4472	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5384	wmplayer.exe
Token: SeCreatePagefilePrivilege	5384	wmplayer.exe
Token: SeShutdownPrivilege	5728	wmplayer.exe
Token: SeCreatePagefilePrivilege	5728	wmplayer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe
Token: SeShutdownPrivilege	1824	explorer.exe
Token: SeCreatePagefilePrivilege	1824	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe
1824	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1824	explorer.exe
1824	explorer.exe
3100	LogonUI.exe
1824	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 4912	1456	msedge.exe	82
PID 1456 wrote to memory of 4912	1456	msedge.exe	82
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 3128	1456	msedge.exe	83
PID 1456 wrote to memory of 5116	1456	msedge.exe	84
PID 1456 wrote to memory of 5116	1456	msedge.exe	84
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85
PID 1456 wrote to memory of 4592	1456	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://A"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞"⃟⃞⃟⃞
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff938f546f8,0x7ff938f54708,0x7ff938f54718
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff70b575460,0x7ff70b575470,0x7ff70b575480
    3⤵
    PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2320 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5540 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,182001662573194854,6393248296491881313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2092

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\e______________.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:2688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\robux giver.bat" "
1⤵
- NTFS ADS
PID:60
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1508
- C:\Windows\system32\cmd.exe
  cmd /c rd C:\Windows\system32/s/q
  2⤵
  - Drops file in System32 directory
  PID:5692
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Control Panel\Desktop" /V Wallpaper /f
  2⤵
  PID:5560
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:5784
- C:\Windows\system32\reg.exe
  reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:2824
- C:\Windows\system32\rundll32.exe
  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
  2⤵
  PID:5552
- C:\Windows\system32\reg.exe
  reg delete hklm /f
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Boot or Logon Autostart Execution: Active Setup
  - Manipulates Digital Signatures
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Installs/modifies Browser Helper Object
  - Event Triggered Execution: Netsh Helper DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Modifies registry key
  PID:5580

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\c5d1fb2f45c04d9a9d9c7bb2100e5057 /t 3764 /p 3760
1⤵
PID:848

C:\Windows\explorer.exe
explorer.exe
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1824

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d3855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\USERS\ADMIN\DESKTOP\1045.TXT

Filesize
473B

MD5
07df9ad5b7ee223925dfd104ac460c69

SHA1
b8a4adc8b8919557ca05a60322bf89709122ce81

SHA256
0dd8519c44de623ec2b80a3df0d955a7475ec8e13922de82c99ea8371f7b7182

SHA512
d06f3ac226551a9e7f4f549200a507c31f8ad655ae1b6ae539edc29ea110bb14acd468407e38f88cc4972551ec48ca7f79ffb96e11460fadb73265048402eaf3

Download Submit
C:\USERS\ADMIN\DESKTOP\1220.TXT

Filesize
473B

MD5
60fbe14aaa75e5b56376620c75d7c3c9

SHA1
5cacdebb1545986f9f7a263cd87bec6d35f07ac4

SHA256
610372886a77373cf378f419cd571eb0aa9b07ad45d9171f178f69f30d112756

SHA512
210516d02df1fe404e93114e917bfad4ca4e6facef9a58df6959dad089fe8d7dab8b1a61e8ccf906e95b675dee030fab2cfa4c337520ec4783f71193cea6934e

Download Submit
C:\USERS\ADMIN\DESKTOP\1279.TXT

Filesize
464B

MD5
5d9c04776b0b4d86bebc8aeec54754a2

SHA1
c00ff71356cf29acb66beecaef9bf4e567f2e97f

SHA256
3698e1bdb434e9eb2237b5e57ccea8edb2261f7dd1eda88fd77271acc500a027

SHA512
2e3996e32884188d304af89ed059de223ddb08d86e379b4c775c388b1b3c2b87a2d7641701d3ecb038c4cb61bc5947867b81d589cf7ce63ea141abd138d3395f

Download Submit
C:\USERS\ADMIN\DESKTOP\1394.TXT

Filesize
461B

MD5
38191a70c5fb74a94a4615245ed33011

SHA1
cac0c305590e72150cb4aa44181ba5107bc3dc7f

SHA256
474838956b6831ccc25eb7b3af8f39d866cef2c2c3f9a1d8219f9a4935aab846

SHA512
be89a67d881a361c8b1147489de6063851e86dd7c3b7e869683cbce1d760ba8d4d6c41d2126e8dec51524dc14f38ae225932b3002437e32f0c97a3d4523f7979

Download Submit
C:\USERS\ADMIN\DESKTOP\1497.TXT

Filesize
473B

MD5
89f516ae61780b246b12c416b513abb4

SHA1
37069753d651d70acf2f0c5a5546443f575033d2

SHA256
ca7b4b89772df9a8cf235bcc79b166bc3145a35e4f3edbbef2626b27818376ca

SHA512
a5a999f37cda117d1930f6f1dcd170a31f1ae4b70319140844b50f4bcfc5706b36df1e490dd0554363c148bc8c909e268e3762b2c1baf6819242ca242d015221

Download Submit
C:\USERS\ADMIN\DESKTOP\1504.TXT

Filesize
476B

MD5
f7085cdc1de71f2c592bf70a8aab66df

SHA1
e40d7d52b80ccfa4f5c154cf4cd4a3b8b6c955c3

SHA256
6487b2237c3e9d169ad78aa99476c84f641e836e640743e32a471efe6f2d846a

SHA512
d8842e8c5c056741d077309a6783afc666ca1e97cbc9270cd278a3af5f1d0757baece4c2fd232a242a29f92526373a2fde62612d5792f8f2eaa2731dc49445b6

Download Submit
C:\USERS\ADMIN\DESKTOP\1553.TXT

Filesize
475B

MD5
df013dc87998d4e404c3d9c05d3a80c0

SHA1
7db953b1f7cd49b3563cc08e79202c939abfc284

SHA256
28414d20035ebf232429a08619ae91eb92ecb8b3b513eaab11cc9eb889214d18

SHA512
e14a857e3e426c10215e12e92c1884ba63f692297049c3f091f02cf8b0795381681d940622dcdb4bef791c1f2cc911c4179758835b127209e86cdf54d5e06a03

Download Submit
C:\USERS\ADMIN\DESKTOP\1614.TXT

Filesize
473B

MD5
875a814c3e0db177d817d56909c9ba19

SHA1
ec4d43065d3dc6ef5c17d6ea91747ec1d156a421

SHA256
c083c421360839094729abf7f492ed916db36e5a3931cdbffd9b2b61aa72dacc

SHA512
3a6f6e5230a3e009a7fe3fe0cf144529ce614bb351a0126b2a6945f04ca3848288413e28c78a7a9aa45907e0cfa59237e366bbe94235d4bf712867fd3976b0da

Download Submit
C:\USERS\ADMIN\DESKTOP\1685.TXT

Filesize
473B

MD5
cb9b02e32ee8cc17fb4823285a4be31c

SHA1
6244a8d908a0db89b3907e9727ef5fbfb434d21e

SHA256
abd94c0ecc7458219dd7d11e6191e8f3a8f3255d274b962d1eebb2356200356e

SHA512
1aaa6c6386386e0ecd3a1823b2dc49eba311cd7b76d8a8757c229b13bc718bededbeffb3322d1d54ea4ae595a6ad475aa56cbadfaf88fb92e72c73224336ee2b

Download Submit
C:\USERS\ADMIN\DESKTOP\1727.TXT

Filesize
468B

MD5
c79d1ae4689ce9908bfe5c5f6b67452a

SHA1
44381820f8889398ef057d22d3b9d21164bac2ff

SHA256
1984c1fab24da4f3538aca6c4733438c86e47e6cae5fea228e7509aa7a63f3d0

SHA512
c8365fcaffbd99c50795fe4b10e36646e9c567871cbbe4885c6b1b7e534e32c5bbc329dd317197b91b9813535296645563d53307ca03d5b6ea406f511f89fed4

Download Submit
C:\USERS\ADMIN\DESKTOP\1858.TXT

Filesize
478B

MD5
1395e22921b8073e500470e58f4b6fe5

SHA1
a2cd5390b54a7013d8f873a044f6fb214ff250fd

SHA256
74fb2f0db9d66020bf05d79b73341ee5dda1c97cfef1a82701ef63a514e0ebe8

SHA512
f98428aa717d0e1b5b0da6b09083f278849cf2f30894dc69ec4357ca2c34cacb98ea9f084f3667145d7af426a0db6327490579f3aeda5e18437b1cde5335083a

Download Submit
C:\USERS\ADMIN\DESKTOP\2024.TXT

Filesize
462B

MD5
8ffbe7d33bb78d55dac906c6840ac7da

SHA1
04e3dc282f9c94d122f66d8c9bcce85a2c89829a

SHA256
7b0a9e9e0edaf6e7087df9ff6a762c3d41975aec39eb899c3e989b56020a0b7b

SHA512
085454e1c9210cd6c5107ebbdfab263050812277f8fcd608aff5d9889e0909617c0c56a3b3363c9746c180eaff712a84ab547a1c43f1ebaeb3050d36f6db3a8e

Download Submit
C:\USERS\ADMIN\DESKTOP\2451.TXT

Filesize
470B

MD5
584b71ae3612d1d559e78ad440d9fb28

SHA1
fd505c671080561f9293b04c1b07c6490c1b7bd0

SHA256
061bb678fffe714b7fcee9572ca10d7b1a48de02f16e5bb318a458d25af81de2

SHA512
2f3a724343ab6fdc97fd7eba5fc51d0a64bbae4a5986a17bf282e6e83b5d09b7553967e33837b74a4cd6c5a0a468b98cdd3f71df1d825a02881875028d9cc35f

Download Submit
C:\USERS\ADMIN\DESKTOP\247.TXT

Filesize
466B

MD5
b91cbe94bfaa10671c70a22f2f9b5876

SHA1
166c566ee387c2d0706783cafc9e2152aa4b2ad7

SHA256
c90b5ab5a31bfc87dbfc7c1f4384669d70392dfc7de306e17449d6ae078f59c7

SHA512
c95bdfc6dd2b3b70125301db9f6c2b44a397bc9b18014c3c63936dcd8e034b86f67633840abe8afe54004a586fcc78326600a4ef1c9ac6036f5f0ef6fed4bb93

Download Submit
C:\USERS\ADMIN\DESKTOP\2538.TXT

Filesize
462B

MD5
21aeb27ceff8182a6b1c13c84c233cdc

SHA1
da420737c293a2b923a99e9287ceccbd37744de0

SHA256
f1efac53e2b68756c06042a85d81b0fd06af87cfbb8801da9b81f5edaa0c2f2a

SHA512
12700f83099a5ea913c6f280361f6eb913bfdccd2d97282f1c30b68b66cffc9e8ceef0f93f3e89472bd18b39aa6d7c66deb646ce85b82aa79c26ef9357f8bb6c

Download Submit
C:\USERS\ADMIN\DESKTOP\26.TXT

Filesize
473B

MD5
b2b69d5edfdbb9a1be58c10fd210995e

SHA1
edd69e3a34dfb722a6f64fcf3b89b8fef4e331ed

SHA256
4c40fcc2573eab5f054ff75b900097056a776dd69cfad065a87581a6ef9d8289

SHA512
ed4b27f614d097a12b7bce4b475960189bda8acb3e9c6fe3be2c1009499c88de42d45a9f58fdf7d7ac3d5d31b7d62b1f2a9fd4502b7555fa6d58255aecf3b93a

Download Submit
C:\USERS\ADMIN\DESKTOP\2694.TXT

Filesize
482B

MD5
a6ddc9978c52939483bcce5930c85d4c

SHA1
f71fd86bba036f60b83869b27e132196671b06ad

SHA256
3f0c1088b4d3a9da6766d620be3d2509196035d7931db38c206dabcdbd8dce61

SHA512
b1ca7bd47a50f5acbf6ee6ee7d34fc646373e4d71fa7e21f224433372a448537948f50d314cca969326f54902ff0d24a8896eec2e08e2ddd6acf3e4919c9e32f

Download Submit
C:\USERS\ADMIN\DESKTOP\2729.TXT

Filesize
469B

MD5
0786d447ddb0c2e4a4b694bbe0097fc4

SHA1
5f74eee4aa6fdf44ae43857d17aed87c85295974

SHA256
1f5b96b7b5948b44147077bd539137f2e8c78a660a7681dad742b1479b114746

SHA512
30bac3f3e83a61ce460e81b65d8e03347355a9526456ae23896045d62061971072fdebc15239502e9956ce93f6cbfad5e44ae513f25e73e67f734a44502fe330

Download Submit
C:\USERS\ADMIN\DESKTOP\2763.TXT

Filesize
484B

MD5
45aca27624ce4741511a4ac62dfd775a

SHA1
bf413112c576d05d59252580efaa219889cc211e

SHA256
a6961f6ad3c4989b4d413fa0612a2d36c49906df595c58ad1630f380cd420bd2

SHA512
2ffd37b3b60b3457b234ef6595fe01852bed5a9e7ab7673165ae7e0c49ca053a1dfca09fa3b16175c0b9033ef3b404b105317c774ebbe61b5ccce877adc63dbb

Download Submit
C:\USERS\ADMIN\DESKTOP\2778.TXT

Filesize
466B

MD5
7537b8e87758250e321e3eede9f51100

SHA1
cf8d9576f3c5c87276d287587bfdd899a0326a7d

SHA256
1a8af73b743b43b4b7e22ac9ecb9507464ea69edc1483b8a19395f3375a935a7

SHA512
3a84f1cf958034dfb25ee80807ee9985bd512f30c530ed8b542e06ae2f6ca2b750e68110c002efe9800cb4218e94b9057f2b05cfd1f07e5b6f3dbaeecf3dc98d

Download Submit
C:\USERS\ADMIN\DESKTOP\2791.TXT

Filesize
471B

MD5
c785a211f8d093680d7293478236706b

SHA1
716885264a43fefccd8de38b7b7eb9ebd1d10ebe

SHA256
6ed81226b133d93f48f695f800b946ec1e1e6259c2695ef8de2fd2b8206affb1

SHA512
5f5a26b074b17cf96af7c95b9f64d545c99f793b4361954f9e15c6c17bb4e8b1133754a65ba235b413792c1a2c65ad358150ef861a955084a3f068f1d30b4e51

Download Submit
C:\USERS\ADMIN\DESKTOP\2882.TXT

Filesize
467B

MD5
61e56e2e3f4a248cfeb4bb33f5ef7db5

SHA1
1b7d4d2c175bd2d9764410d164265ea1e2915eb1

SHA256
ab56ae2a5743173ac039d2afec6bc53defa2ad7b06b691f99eefa94d2e772104

SHA512
5378fb0ee351e298189e45a1733f24b16d7e8e9713b8df83fc40ba6c94e2ea2e888832a029865661449114819909fd04425c3a198a0e48f068e055b815c57aab

Download Submit
C:\USERS\ADMIN\DESKTOP\3132.TXT

Filesize
464B

MD5
bb471cf32b64a3affae18c6569f81c00

SHA1
af08307c5e15f967abd1f8ded5f9c1ea9009abae

SHA256
887b2e70b66ae0cfcb4b1efbfd143ec974c38b39a7e02941642c9810c3ec44d9

SHA512
150ab74012346df75d1f7dc4a09e84cdc7a39aa34ed401593c07f278520177e19659800c31449541011e907c7ce8b364d1504f3ff005f19e4d20312362f06846

Download Submit
C:\USERS\ADMIN\DESKTOP\3592.TXT

Filesize
466B

MD5
2cef4f429a42c9446f63fd00df4bc948

SHA1
5a2829a3255ed976a3ab4f62ed3e3d2900351347

SHA256
222118651e98a545dd2768b4aa7a38c140e616848a5f20750c1956a7094a88d1

SHA512
a21dbac00762958aa26a80e5860317688de84c88e9761595b57a8fca91b6ad23c373d12d6ee4b1d58414997dd329be67a89216c14bdb5f2c36e3e7684ff2a2b8

Download Submit
C:\USERS\ADMIN\DESKTOP\3726.TXT

Filesize
479B

MD5
6d9d6c6630fd4713939d531e06e396e9

SHA1
0aec7fe3dfdcb784f7fff97562e391aa18e6b766

SHA256
81ea3273a9d6ee3fc12df5daa6553bbafb0a6ef408c859791679b04aedfff7e5

SHA512
2383aa887e4bece7fd2004a5143901ce6821f9381ab9019a9c988bd2934b9455629db356055f9fea056aac8e9e5ae06f347ac738d2928b3ff3ad691237f2a994

Download Submit
C:\USERS\ADMIN\DESKTOP\514.TXT

Filesize
476B

MD5
017c948d47c76fa55b772b743e80add8

SHA1
d3616c5d7d1aa3b636510027454620f1e82763ab

SHA256
ec768f429a9cceadaf028f7c73005a0efa388de911238654d838e653988213d5

SHA512
8c9746a5b9673a1c8b291fd8b27b539ef033d28f3c7f83a914511ade8a5ceb9180352ca93305d00104c9a2531080f8a8d49bac4b40b00ea05e80ef3aef3c7822

Download Submit
C:\USERS\ADMIN\DESKTOP\547.TXT

Filesize
477B

MD5
7590b0566905981c2cb22fe4cb8e1515

SHA1
c1672af64ae0bd31fd228adfbcbb217ef2c9197a

SHA256
de672f537e8db47cd1c0a829beed1f0867868ecf4ecc2982d35fe1e388f025b9

SHA512
e89f4a4e37e73e7b9837f12020b3b2f7e90f5a4d6b92a71badc7d35487b9ed9aa21f9d96ffd9f7bd58eceda4ba886c744b72600a04938b58819f6bf148e42971

Download Submit
C:\USERS\ADMIN\DESKTOP\673.TXT

Filesize
472B

MD5
c28f8d21b9c770b32ea54c4a070686f8

SHA1
b3e6a668d1d1a79ee5151a7322fac627b2120fdb

SHA256
59d56c5c248b62fbf11f341be395321a3718fa3ce4851795b63008324201cd20

SHA512
a6593218d64137bedc10b9b63fde92c6965954081e9f6e3c8f91afd0a144c3fd33842179a910a44a048e7661c176ad6adcfaaba0ba3fee7682f00d654a81bfc0

Download Submit
C:\USERS\ADMIN\DESKTOP\694.TXT

Filesize
459B

MD5
78e2daa1b32cc1c6037eb55eb6eaad74

SHA1
a0177071fe1d55e06b7c461f8645bc0cff0fc7db

SHA256
6a35aa0798c00abc0833bf902b9e08cc8dafd45676085a7031a279478d4d12c9

SHA512
c01f895932c0664fb414fb1543b3580becd85128a41b00f449e97697f54ddf0081f2bcb3f1c033c11974543d66a4d6f98ea81425ef1325d761e3520ef2bf5923

Download Submit
C:\USERS\ADMIN\DESKTOP\733.TXT

Filesize
467B

MD5
12c4e09347071d02736842296e1ee980

SHA1
f52ebc15e2c803fa40bec1cbefd80c8d09e77ac0

SHA256
62686d7e771b3c38cb979cee6cbbf7fe8aea2db45b8dc41cfefae89c7b3fa57b

SHA512
28239d8bb7936c366ec4726c51e589f8040b41f3727f159c6b3506ff6de86a0b9fb75a83fda0f159339129d76390b7dc5f9d814b96bc046242e3deb1fc498982

Download Submit
C:\USERS\ADMIN\DESKTOP\740.TXT

Filesize
464B

MD5
69f6d29963ede8aa2133bc46ef768ad7

SHA1
180cfce237ee807b26922e3e9308b16b04df17af

SHA256
2293a6e60c12d86468c41c66c21a309d63295dc1208fb1e6bd4ebe86cf2fae53

SHA512
fba0bc573e17161cc652bfa35f27ece597e254412f58407822d3318bcdd27a2d9ddbc1d11f8e0dc77878327e7b8a4119e8cc2c93d2ae011e2a21df31bea41764

Download Submit
C:\USERS\ADMIN\DESKTOP\857.TXT

Filesize
467B

MD5
44bbae153c6ff19eea680c8ec764f4f7

SHA1
52b69ebff90b43f60ff724fe5b85cd7a33cd39d9

SHA256
c73fa4831f33e7d78f9c352926ff4d657c30e4e6b5585e630d95516b3cb00ead

SHA512
e8532798cb3ef789bbbc411661f225e1a378ff48d67e0d29ae4807b3ca06f629cd878707abf7d27b1ec1689320a817038725cead9f997218a0dc029452e5a18a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c917cf2b719af9137e3710bcd0550cc

SHA1
cd6b01992102e35d44e9733e07a35e439d7688c8

SHA256
b79cee14139cd3ba414294feced905539a0a29e8f1b34682b1363a498647e827

SHA512
af49c6bc57339bc2ee93a3de8ce53018203efb43a55717a9a044ffb507c4b3dd3fe651d85ad4b9a8b78879f1134fb758e605a81b3621d163843da3a11bc0baf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2905b2a304443857a2afa4fc0b12fa24

SHA1
6266f131d70f5555e996420f20fa99c425074ec3

SHA256
5298bdb27d48c2c2b5e67bdd435445ef5b06d9b36c11394705b413ff3d0f51f3

SHA512
df85de0c817350d8ca3346def1db8653aaee51705822b4c4484c97e7d31282a2936fa516d68c298dcbbb293b044aa7101b3de0c7852c26e98ac6c91415162b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5391bd7b113cd90892553d8e903382f

SHA1
2a164e328c5ce2fc41f3225c65ec7e88c8be68a5

SHA256
fd9710650fc6774ce452b01fb37799cd64d3cdc282ac693e918e38322349fe79

SHA512
41957bea3e09c2f69487592df334edc6e3e6de3ab71beb64d9b6d9ce015e02a801b4215344d5d99765abe8ab2396394ac4664fced9f871204453a79463cc7825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b82e718-cc61-451c-a573-18f32dbe60f2.tmp

Filesize
6KB

MD5
06008fc9b026b120f1273e92004571bc

SHA1
ddd01db626ca4c445cc1b85cafec4bfb9aae4c23

SHA256
d5f995a139723c9431395efc53951168a8e453028af8538832eeeb7f2fff93e3

SHA512
7a668251f30471d902d33162f73f146e377044c149d3e697ef940d013625bc6044a6c4ccec244184c142e7f834401d5849f9e5f24482db243f2c39e070a6c3bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
47KB

MD5
55a93dd8c17e1019c87980a74c65cb1b

SHA1
4b99f1784b2bb2b2cc0e78b88c5d25858ff01c5d

SHA256
4925dd477b8abf082cb81e636f8d2c76f34d7864947114fc9f1db0e68b5a9009

SHA512
f9ade542c593067dbcd13ed94da1ba17a84782575355396db8fd7c28aa70a3120d0c0a22d3ca3d2f0774c1dcb06b9319e243b36001c618c92e0af25cb9c8e46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
67KB

MD5
fb2f02c107cee2b4f2286d528d23b94e

SHA1
d76d6b684b7cfbe340e61734a7c197cc672b1af3

SHA256
925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a

SHA512
be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
25KB

MD5
2e86d70d45640d4fe3b7151e03a809a6

SHA1
01395a29cffcfee88d2d09b074e1244672dbd842

SHA256
72533ce3e7be24c15153d2e1e0b5dd07af6dcbadd913d17659f711d0f954d31c

SHA512
1293179e36d312217c48fb95c487e6c3bc7c919bf3c49d3b6e436b11891da887d71699afed608e47c5a5e5506f4ac065d19e91580b03666716d37d285566031b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
17KB

MD5
b14df0fc02c4f68c8b7d93002761fc99

SHA1
350634cfbf28b5d95f52767d56d981c0163b200e

SHA256
d546081ee3063768149c696d6c65ff97cd3f77ab420b41e16902c184a711cba0

SHA512
13182bd2b8cf97acbcc7723e4cb97e9a1e661beca971500a485a3e1caf1f483ff579976bd8df7a54110ccb3c1774184f71532223ca469fa9e770c9b2b7669272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
1241330c87db288e0cb6666d1d9e4737

SHA1
1c75bc5508bf7475653ddf7c84ba7945c199129b

SHA256
e6e9f73a502e9fab07b4cd7019dff7a2023394c77e81a116f7339297443ab705

SHA512
9ec0a502cf77539451ee769e079b368dd284ea6d2d31492eb01ca6159b92a4113a7c659312ffa8547fca6ed7b33189435f47bef7056aa69e073306857e292582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a994fe24b451732_0

Filesize
14KB

MD5
29abefe971b86d526795d03c1c688129

SHA1
e9f617c903e8d626ad36a90eba85d26de94dac43

SHA256
586d34a06334ae7397dc99250d02b4ec669ba1047de866fa5d0fee678fa9a477

SHA512
783ac7460f48f474f35ddf9dc31b38f5a6e821f15d348166619cfa63647502eb4809deda4e70dfd3a3e47d2b8d4d8f3ce2b508f1fb9e0ad6c9827be2c078859c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

Filesize
2KB

MD5
0f4548625343419406964bd4ccac9161

SHA1
cf2e0b6faac6a2d061b820e85ac54f9f3c4e0825

SHA256
ff0cb9849fb10a6f9a0029c8e411863328e8d9a32080e2bb11ae133f22379951

SHA512
d15f8b34f50effb2301084c6187c1f9151473c4a14162c98a45baef6c8075112dcc35dafaf61c369cb3850113ae32685b102be946c4b1c69b44eb084f75fc5ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
211a1674f152401122c6d8e80184aa43

SHA1
d4c9933d641468fe6c211d7054c06f024f8d263b

SHA256
cb3b61e92073904dc5cd42c4e48266676c715f18ac4830ecff8882fd444ba801

SHA512
5d17dc773aa32b33798b4ca00f2a32999361249162f2d4191cd4fd8862bbe83f28f3a5229e0d2a8724c27c53ad2e4305ac378d1d8906cbc475075f9e49e6f110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
bf5f2f6a4cb8451855578b0012bbc802

SHA1
f648c60826ab318d99ba7301152cc2d8bbdb69dc

SHA256
cb0d1f31a263661b10cb8f9f7c178f12ee6159da263274704ab5b0ae3631f941

SHA512
df9e6f30f18c5cfc7d5c0f940e954b66613a9af9aca960f9304a3f48db13b7c0c0bf4a656dbf3c4e79c7447dd145f8b33f1e82e696d557ea0f100f630f2b1dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
02c3d823e7603237e4c662fe599e4736

SHA1
653c07fc018ca0b330b5bf8eee70bf0ea96f8fb4

SHA256
9da2aa5dd334eedcc39a8198b533322a25d24bffd0f944f49950a49f210268ed

SHA512
583d70015e11f130c5e0c3cf4ea02049d9f8f4fef7398233ff3cc6b848d52a3cc6881ffc845cd55a0dcb8b8e9ca6ede58cc20a926e6b10c8bd8c779de0cd0fbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Filesize
256KB

MD5
cb5cfc6b3d22aa27da22351077f08c6b

SHA1
fd64f5dc8adbcabf5d7dc49b189db9c71f4b0456

SHA256
668464fe90981c0b06eda9eee4041d8217486c762bc339981f79775b4e649943

SHA512
e24006b1a621e0d39adb35e4f1c9b6dc5dd90afc49edbaafbd5143d29b3095aeacfba7e0f2df3159c58b5dfa2dab577f09f17fdbea830755c809cf0643c9850c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4faf47885de886eb20b91e43e8660f6e

SHA1
02ad2fbbfe63350e8539026692478feefcd8d3c9

SHA256
0fe61c762f2c8fb62f8d5e52a7a67b4f2fffaddf70abeb4b8eee3120e993d39d

SHA512
da9ebdbfdbb5355bf82658d575026c0e42881934149b99a80675762a90637fa8eb7d8746f1e2ba2576d8f0db40cba4920330d5de99e80bf9ef1dcb3490d1d292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
00958d969bc8bd8d534e417574f88e3e

SHA1
b13a09ad522874b4b6ed03ba4454926982d4c99f

SHA256
436db7fc74ce9fffb0134656d41f2f4af3d68a9e9b91246c04ff3d91d806a8d3

SHA512
95861a14d089e9dadb0afbc1a39916f6d13d2879463c808bdf26dcd20ef50b2212ae35af236d4e78cbdf9cfac50e14c2c212f4bc4eb60a9cea9196363d063c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4da97998f3d5da46b1b20062affbaada

SHA1
e1f9a475b698dcdad2f62410a242be4abaa6ae41

SHA256
b6e86ce358898dd967910b1867f34fc01fd4e57766292e4091df1f7be92f93b0

SHA512
970355172c49c01a10e871e9ae49b8486164c66828f7113112abd568ac6b62e9fb0c705f8d6e607ad1ff9ba91c14edeecfebd35f4ef121d533338b504ee5dbf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
808B

MD5
d4af16cbcb5d9330fe0da465a0ed8ce8

SHA1
3fb88a1d6bfff5b6bdfbca629c979ed76e32e780

SHA256
5070e86f04725f758604096505c3428280534de7e82ae0f2be95c6d46c01a291

SHA512
113380be66333f1c3e9f78482449e8d9fc92fb3a9b774cce9f658585c8d8629b6b2068f5c1e5adc8e2cd71187871c819f2999e1fb553478470649e188a198b5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58c639.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4fceebc0a0f8474bf0de966ff02079ee

SHA1
e241420201a4a90157b9e4711798fbb42f8a3563

SHA256
f58f9d0da24ac53011ee9904ca1245b4fa8cc07eb420c1844c412b5e85ba9754

SHA512
7eb38b0980062433372ff01e6cfeca5c2ec6fd32f819afb176384425afa9e4779a1077fae29e2ef6eec95f1c8d0448a04d657b517655c089840add553df42d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7bc250bd7e8723c7049e26f4a6abfcb3

SHA1
3e0ba017c5a49e130790c71ea04926b58d2a7861

SHA256
148cc6f20baa22edc3a3fd524c78fea96f2a6975329ea05153b7c628d1092b9a

SHA512
5753fd4f481e535ff9434912c9fac5663f348b92ddec41012dc71c1919744733d7a9e972a0aaa2da81f3a4a01f5a3d4701f6d7b841cb672b570e8a7e934f0123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3e34e0ea4bf521f9876be5afd5c46506

SHA1
a22609cab4ce16ad98b848beb335af6da5ff3dc1

SHA256
c94e4f72fb4b3275ed94a9eca1e59dcdb6069e53d12825e090299b1d3068c87d

SHA512
597ef6c045c2eaf2975a9c7fe6a8f0fc8ecd5b1c6dcc767d123cab4a1ed4d90e1bac8006d99b6687de147afab82da3c24c1cca182e35993d5314fc372aef3e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8df3603d0bb4cfe828697deb72bae51f

SHA1
eb34b93e16e4e52ad510bd4fbf74c632d7f3c0a3

SHA256
fce39465f25405ab3a232560d64b77a5f1e02936d20d0b55e89b5c5ccc9fba89

SHA512
4fe93ff2a59f0daca141a1b826f27002138a3f00ec5c4ef22446a3ccd865610fdaa692cd0130b649b6da5952e256e0188eb1546924018bb2d9b2742bdea15a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b86d1285d336e3a24a73f8fa20b9f8bf

SHA1
346b66dadcbb986fe84cc8167a2e6a0862f302f5

SHA256
4d77d61fa17855a30592508569105e4ddc526faba18a33d46a2d6c03507e8f6d

SHA512
043a41392694a1b39a24f96bfd8183312b51f64e2bfa9fcef672446873540c5f56eda81ebb46945172b7540968a93756d27e68935c3b06b8133395e0f6f0813f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f49b6980f89f9ff9dd499308cf33f927

SHA1
dd832053460592b0f48e0d5fd595eaf8b425cf62

SHA256
e86d8e1dc7e321399eb8aa62a515dd6a01096562b21f5b4c83f5f601a67f9a12

SHA512
009b80d3ae1e2067310362e460e48bd86288621ebc195a5e3b5ca96b55c3cfebefa6dd629b4acc88c8df8edaa697f377aa873dedb04defa07f03864d1e7d81a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b0bfda0f53bd1e8728034588ddfe41c4

SHA1
15b0f32af4e877d138592ffe90c559bc13be3bf1

SHA256
ede9940a63ab5a3ef5843759154287c82947416ef35a5218ab421c8b0979782e

SHA512
9005f5e8c6f4449ee86caaf2baf19819eac55d15b667cc97fee9bf17357d7d836554868311085e0bd26f2b2373a72ada570332b5d894f84753cbc488ae5d7e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aee5789301b3c43ede970cc925668eac

SHA1
1b00ed9c90a77869d42a914bdd90f2e73211f2ab

SHA256
93ec9f7667df3f5379c4694b77f71d604bdcad71a892a87775b16f9939db24e0

SHA512
d4673ff19aa6e68e9914e615edcdab3c511648f441730baad814e38cefcf3388b17a4daa7e2b2a4b6fdee8d0fd20a16325ea3eb23a403cfc57a510e3a802dee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ad9709100fb43b77314ee7765b27828

SHA1
5cd0c406c08c9c1073b0c08169ccaffbd4ef6b98

SHA256
04b61824ffce6fdbae4e6a527ae58b85813226ee28fe4d631feb76b5f936a1a9

SHA512
fc55ee34b1107e298f2cfcb20dce42b5dbc98a7b68e72ed80a6ea594f66dff6f9e9cb70ad5ccbf5ad2171275f375abac1defd8dad4118afa280cd9c1d9f6a538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e122fc93c0ad25d45d09ba51a3e86421

SHA1
bb52a7be91075de9d85f4a4d7baeecc3167c871b

SHA256
a277c1c6fafd7a44b47d94e4bc3c0337a64a34d252e58722855aab09e6f52bee

SHA512
12787aebefd6a5e4584ec8747a78538f948a16b214bdf81302036ae89e2c4563027847236a4770c4f780a9ca0ed03f29b1577bfb6f11feffad85b7a625324bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
17c43372f35b62f89fcfd257eabce098

SHA1
3febe0cc078cb1a0ef432bf9e43c09b458dcecf5

SHA256
6d7b3cc5f729da55733ecbd01845bb6b7e951e6ac68932acf431c068ecbb3217

SHA512
145ced0ac6e78d83c4a3a18f6a22bc6b805265f6cdcefbb290a93cb1de433983150b2cccb98f3df234cfa367ea97e65d67893212e9afd52b451ec9f8f08c6e53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58654d.TMP

Filesize
48B

MD5
022496ca9be6430902003bb5eca5e20a

SHA1
b1a26cec39158ba2776b31f95528b1001858994c

SHA256
9fe6b9eacbb9438d9de6b2efc0b7e3c5fbf2389547cacb341817936e66240609

SHA512
37490973ab65c1a0a44fa7f2ff3198bc8cb4e85dafadf5db3a64303c5e55c35c3671ad1b683299acf820ee1dacd3bbc076e695125ca48b5a743534be84172730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a0dce47b01ee603604262024f123ac0d

SHA1
5554326b03236302e7422c899e49e51df885ff33

SHA256
c840cbf2e92268eb59460afd4d048623a895d22e28e5f21e218c35e2c3cfceac

SHA512
2fbe75e4bd045ad73e2b3a1de406fa540bc451e17ce2b3ec1e42bd7a70aa880f1ca027a8ef318598e922396774f6e15fe54cc653d1f9c209359e89c93b777838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ad6af6467095478873bf572b2d479a8e

SHA1
4840a988dc0990868e234c0740bfb6b29ba27444

SHA256
7d159a36200f099bd36a55658cbe6f50439ecfb7a31caad3e001423a423bee53

SHA512
583b37c5f8713cdc4c7a5808c88b7e7cfadfdcd879c09914d11477f458a7b667c4c9c8f87cd6e65453dac6ba04f191417614af513eb7cad94498b27e98cb9008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
973816109ea9dbfaff879215e5d05204

SHA1
4202912cb5336e3653a1b191397a3cd96a1c64c6

SHA256
8c52534f9f0dcfc1543fe09d7a8df4dcda01755d113cd2b67af20b9f09ecead6

SHA512
b49e466cf0d9c8a653b663728533359268af1b15d0d087d786e8b8afe4a586c837262cc69454bf9c43d6b593bba72e9ab646569fab35e2a66c7090553a1a1d1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
373a9966a9541bed12a811adcbb4e6ca

SHA1
71f5e1584e8410964ea9d4e3ed707332d498a619

SHA256
8193283c46e11250e25d9c3082841811b6d7639a0c4ce3c45be5ac4af4736147

SHA512
4245390ab59a15f1ce0c81afe0216a1c495b5aeebb72df08f962fc446be38596ddcfc820f5529b47e985dd0e05d7563066d3551be0f47728ec2e6561762ca500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2f871bc021ac3713147d04734df45445

SHA1
ab5c4e99d6711ad18f0a32ff17e3b33f929d680c

SHA256
3521f62f5cd338677e9f3f46787e9528cdcd8fc725ca3addd06a7196b5893534

SHA512
613e4e92c853809b707bfee96af654803e6268c6fdca11f298a518f231f5533f6838a31d16c0cfa26843b82bc354f90738455d45f9455349e5239462638d6f71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
5cc2ae0ef00ce1204419b7420d868e28

SHA1
f697b07de45dfe1b3e292ba0ef33820d193a594b

SHA256
76ddb644bb1bec3731d51cc828346e9447276e14f1292fe1ba99347cb56774da

SHA512
f5afe2c3bbdece20f8f8107f544723723c221d330e2143bcce7365d694e587b30448f18bb570180803a9d503485249270d53548d21a309285b2253e173ce61f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583a64.TMP

Filesize
536B

MD5
18572c92729178ea90100dd9e7153ca9

SHA1
ce7c6b6bbc296c1333316b8945ec6994db1c16f9

SHA256
7b4babf4cb6b336a51b09e20bb4971cebfe39539671e62954413ea690bdf3879

SHA512
6dc2d1e5a1136a612bbc95b37ef62fc6c3f77d94a10c491a10ce191cef1231c94f635e470517cb75f6aad042ce98484e5293f8006bbee9f4fbbde4b1934616a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_00000b

Filesize
20KB

MD5
e8e1f8273c10625d8b5e1541f8cab8fd

SHA1
18d7a3b3362fc592407e5b174a8fb60a128ce544

SHA256
45870d39eb491375c12251d35194e916ace795b1a67e02841e1bbcb14f1a0e44

SHA512
ca77d40ec247d16bc50302f8b13c79b37ab1fcf81c1f8ab50f2fc5430d4fabc74f5845c781bd11bb55840184e6765c2f18b28af72e1f7800fe0bb0b1f3f23b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
85a9923312ad4df097289a790931f4c4

SHA1
3ff7d9a6eac8e5637da73e1886a09122e9759db9

SHA256
72ee259c16d2fdd30a047e77ffa33a47eb44eeea8288b453d5798b17b8852957

SHA512
7cb17d0f721da9d7c71c9d2c5ed4ed6762ff2926dbea80dae4a2fc9287ba8e1b0744a2b32ec0255b3bfc34f3c2ebb72c779ef538acf73b8ebddce978e4d1cc40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
bfde86be68fad5751c8b23a0473bc07c

SHA1
0c9b064787a8cec3219aa1d8dcee7bf56686ea23

SHA256
a9e3574e494364b57b206e812a27148138800470fa0c72a2bbd3ddc8c74ecfab

SHA512
294bec98b294d69892df66251165cbc78ce09c3e3ae920b5ffac3501eed9edbeab43e7797c929bc986eb6dc3ef0075eca37ca89beb017cce1814c7c2dfdfed02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9f3265571e6bd1a787b66e52e491ef4f

SHA1
7fe77a0c1e3952384204710f371dd9a96b1c529f

SHA256
d7e6f7037fccad23682d426c9e736eed2f46f21bfcb6d205db97ffedb73a543f

SHA512
74e5cd067cd9282c18def38e39f879a730ffba9385c4dc8f34d6f806022a45267e44c8cb0ed29aba3b871f44c1d7ee3a1a3d6f0f6f25d3f74343f628a319d28b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d92b6881a9ba67f9b366d030a18e0681

SHA1
22518f0824c74ad90d8e0b4fa70c4f043f0c3719

SHA256
d03ea2d90407b1a9658fd60644c9903244191d35187093a1447817756fc464f6

SHA512
5daf1ff8d6b72797bcb34587226ac43298b5a9f43b10da32d45a687a448fde74413134ab65975e1cf08799fbaf5bcd54c75d02f6c8109a96d5b0bd9bf456875d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
11a5410fb33344560548c6d0f4b2c5ce

SHA1
d018368a45ab1c2f40e72de83f776a9e04fc8b0c

SHA256
77b8417b6821ede4db52070059cb69ffd91ba99beb0949c3a1f8aebbed8fe89c

SHA512
206542534376b8764788a30fb91cfab1753d4fe33f48862e8fa09a9eccd9325463b9adbf8cfc45fc6869a19abacd42ea409bd32321dfda4796056b808caa5465

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
5e2e157f034d89e257291f9567d30901

SHA1
ee1061043ec520dcf26cb9c9d7f15a4b3d454b41

SHA256
6c9db6a40d3a42ffef0aeeee047eca52e57fa540361a0f2899201a61dcc8fd9c

SHA512
e49926c3da4fed6a36e842c0db596033fac9fc3f7e04df3b70fc9cb1505d2d9895e7785716e6513712e2c1cfcc0f19b6a97c26613d086b235525bd78007fbfaf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 196314.crdownload

Filesize
165KB

MD5
9779aab9b681c3e2825303442945936d

SHA1
8c160957a9e9c31782ab106e9c0f973c2d72eb65

SHA256
baa3bfb404c663a5a813475773b4b4d479ceb8f1cf02dec627591284b959a343

SHA512
6661a56700196c0fb6f3d9a69232acf4df26597fe8bc310c62313b6684605bc520c68dea4e8b591d6de4dfb92ad7d8d69fac2832fc9d98bf6b583a5adbcf6a24

Download Submit
C:\Users\Admin\Downloads\robux giver.bat

Filesize
165KB

MD5
4a999b26f3b58f656730d49cab4893ad

SHA1
08fbaa2eade4fcdf3a188fc201f6e2604a6a5bc0

SHA256
b5f6180d4bbf75a57087026ac12a4a206e144f0f7eba351b40b8facdc3639bb2

SHA512
7c8e941b769995f0485bbc510bfce3cbc2d09456172b6951d125563a0982418232e137dd261470176ae8f05d7b90c3df81a94f5cc0794cbfdff2cf2fd03d985f

Download Submit
memory/1824-1669-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download