quasar | b1b8ad9032b829e2ac3956ce8f302745802cd2d5ae686c700796e2f2ee81b0f7

Analysis

max time kernel
169s
max time network
162s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-11-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mielda loco 12.exe
Size

3.1MB
MD5

4ae7ab9b981922837aae1c86c7f726a3
SHA1

1783e0788fb2a103d71bc9a05ae2fb85c0d70ee9
SHA256

b1b8ad9032b829e2ac3956ce8f302745802cd2d5ae686c700796e2f2ee81b0f7
SHA512

79c4bf39ae1761414b5f37186c2483a4b8755168824d6e783ea9cab26e7c0118f391b6417c622b65ea3ac3924ae745a6abe4838ca1d87671898ad90ae9a18e58
SSDEEP

49152:Cv+lL26AaNeWgPhlmVqvMQ7XSK6v9y/ZBxOPoGdexMTHHB72eh2NT:CvuL26AaNeWgPhlmVqkQ7XSK64/M2

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

Cristopher11sa-62565.portmap.host:62565

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes

encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4244-1-0x0000000000140000-0x0000000000464000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Client.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation Client.exe
Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

4060 Client.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	Client.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmplayer.exewmplayer.exeunregmp2.exe

description	ioc	process
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ebd5d2b9-4e33-4789-bcb3-a49756ac7a54.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241107053740.pma	setup.exe

Drops file in Windows directory 6 IoCs

Processes:

mspaint.exemspaint.exesvchost.exemspaint.exemspaint.exemspaint.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3472 1064 WerFault.exe wmplayer.exe

pid	pid_target	process	target process
3472	1064	WerFault.exe	wmplayer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

unregmp2.exewmplayer.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEwmplayer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msinfo32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXEEXCEL.EXEWINWORD.EXEWINWORD.EXEEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXEmsedge.exeWINWORD.EXEmsinfo32.exeWINWORD.EXEEXCEL.EXEEXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.4355\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d116693311903842b59702321b81f4c700000000020000000000106600000001000020000000e725e0729e54a0c1228e4f45eb682cfec2e985bae808d1a5e35730d9a973221a000000000e80000000020000200000005b574beedfca1c1226bc188bcfceb29f9c636be5ee6e497769acf2c6646f14fc20000000a46304d8037a645ec819007b26f9bb0edc2277925556c464dda8c0179d31eb23400000004edd24650dd9984cadc1452defe51b067a9128de745c9584de78a18d22960f15cf0da60776d5faea0cb1c6daa9a4b9f060cf849e108a1aa58e5189d0340fcb44	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "919735891"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31142103"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "976615104"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31142103"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31142103"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "953990000"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{626A27D0-9CCA-11EF-A404-FA8B32B0AFE0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d116693311903842b59702321b81f4c700000000020000000000106600000001000020000000b9790f2c97ecc7897c5fe7388e73177721c5fe3b72527c136e7dd6da441568d1000000000e800000000200002000000062980a167612e1503eb4f80579e54f4274f6f987145ef0f08d889c2948474d2f200000005e0783b2f27587a1610820dfa103fa16e50bf14642c4aa29df09e2ce40a18187400000004941beb01e0ed65532f60b7539c9f41be19e6b5333dbe6fc9dc4409b6841ddc6c61fe4d061cdcdda4e92385c05739acdbf66bad123286cbd657a12a4a39077ee	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20328c28d730db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e7222fd730db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "919735891"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31142103"	IEXPLORE.EXE

Modifies registry class 7 IoCs

Processes:

OpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeClient.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

3664 NOTEPAD.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

1720 schtasks.exe
1216 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 5 IoCs

Processes:

WINWORD.EXEvlc.exeWINWORD.EXEEXCEL.EXE

pid process

4016 WINWORD.EXE
4016 WINWORD.EXE
5796 vlc.exe
4640 WINWORD.EXE
6068 EXCEL.EXE

pid	process
3664	NOTEPAD.EXE

pid	process
1720	schtasks.exe
1216	schtasks.exe

pid	process
4016	WINWORD.EXE
4016	WINWORD.EXE
5796	vlc.exe
4640	WINWORD.EXE
6068	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

mspaint.exemspaint.exemsedge.exemsedge.exemspaint.exeClient.exemspaint.exemspaint.exeEXCEL.EXEEXCEL.EXEidentity_helper.exe

pid	process
1728	mspaint.exe
1728	mspaint.exe
4296	mspaint.exe
4296	mspaint.exe
5064	msedge.exe
5064	msedge.exe
2428	msedge.exe
2428	msedge.exe
5832	mspaint.exe
5832	mspaint.exe
4060	Client.exe
4060	Client.exe
5632	mspaint.exe
5632	mspaint.exe
5736	mspaint.exe
5736	mspaint.exe
6080	EXCEL.EXE
6080	EXCEL.EXE
1856	EXCEL.EXE
1856	EXCEL.EXE
4060	Client.exe
4060	Client.exe
7056	identity_helper.exe
7056	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

5796 vlc.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2428 msedge.exe
2428 msedge.exe
2428 msedge.exe
2428 msedge.exe
2428 msedge.exe
2428 msedge.exe

pid	process
5796	vlc.exe

pid	process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

mielda loco 12.exeClient.exewmplayer.exeunregmp2.exewmplayer.exe

description	pid	process
Token: SeDebugPrivilege	4244	mielda loco 12.exe
Token: SeDebugPrivilege	4060	Client.exe
Token: SeShutdownPrivilege	1064	wmplayer.exe
Token: SeCreatePagefilePrivilege	1064	wmplayer.exe
Token: SeShutdownPrivilege	1820	unregmp2.exe
Token: SeCreatePagefilePrivilege	1820	unregmp2.exe
Token: SeShutdownPrivilege	1980	wmplayer.exe
Token: SeCreatePagefilePrivilege	1980	wmplayer.exe

Suspicious use of FindShellTrayWindow 14 IoCs

Processes:

wmplayer.exemsedge.exewmplayer.exeiexplore.exevlc.exe

pid	process
1064	wmplayer.exe
2428	msedge.exe
2428	msedge.exe
1980	wmplayer.exe
5208	iexplore.exe
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe
5208	iexplore.exe

Suspicious use of SendNotifyMessage 7 IoCs

Processes:

vlc.exe

pid process

5796 vlc.exe
5796 vlc.exe
5796 vlc.exe
5796 vlc.exe
5796 vlc.exe
5796 vlc.exe
5796 vlc.exe

pid	process
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe
5796	vlc.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

Client.exeOpenWith.exemspaint.exeOpenWith.exeOpenWith.exemspaint.exeWINWORD.EXEiexplore.exeIEXPLORE.EXEmspaint.exevlc.exeOpenWith.exeOpenWith.exemspaint.exeIEXPLORE.EXEmspaint.exeEXCEL.EXEIEXPLORE.EXEEXCEL.EXEEXCEL.EXEIEXPLORE.EXE

pid	process
4060	Client.exe
4208	OpenWith.exe
1728	mspaint.exe
1728	mspaint.exe
1728	mspaint.exe
1728	mspaint.exe
4868	OpenWith.exe
2000	OpenWith.exe
4296	mspaint.exe
4296	mspaint.exe
4296	mspaint.exe
4296	mspaint.exe
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
4016	WINWORD.EXE
5208	iexplore.exe
5208	iexplore.exe
4016	WINWORD.EXE
4016	WINWORD.EXE
5400	IEXPLORE.EXE
5400	IEXPLORE.EXE
4016	WINWORD.EXE
5400	IEXPLORE.EXE
5832	mspaint.exe
5832	mspaint.exe
5832	mspaint.exe
5832	mspaint.exe
5796	vlc.exe
1472	OpenWith.exe
3176	OpenWith.exe
5208	iexplore.exe
5208	iexplore.exe
5632	mspaint.exe
5440	IEXPLORE.EXE
5440	IEXPLORE.EXE
5632	mspaint.exe
5632	mspaint.exe
5632	mspaint.exe
5736	mspaint.exe
6068	EXCEL.EXE
5440	IEXPLORE.EXE
5736	mspaint.exe
5736	mspaint.exe
5736	mspaint.exe
6068	EXCEL.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
6068	EXCEL.EXE
6068	EXCEL.EXE
6080	EXCEL.EXE
1856	EXCEL.EXE
6328	IEXPLORE.EXE
6328	IEXPLORE.EXE
6068	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

mielda loco 12.exeClient.exewmplayer.exeunregmp2.exemsedge.exe

description	pid	process	target process
PID 4244 wrote to memory of 1720	4244	mielda loco 12.exe	schtasks.exe
PID 4244 wrote to memory of 1720	4244	mielda loco 12.exe	schtasks.exe
PID 4244 wrote to memory of 4060	4244	mielda loco 12.exe	Client.exe
PID 4244 wrote to memory of 4060	4244	mielda loco 12.exe	Client.exe
PID 4060 wrote to memory of 1216	4060	Client.exe	schtasks.exe
PID 4060 wrote to memory of 1216	4060	Client.exe	schtasks.exe
PID 4060 wrote to memory of 1728	4060	Client.exe	mspaint.exe
PID 4060 wrote to memory of 1728	4060	Client.exe	mspaint.exe
PID 1064 wrote to memory of 1980	1064	wmplayer.exe	unregmp2.exe
PID 1064 wrote to memory of 1980	1064	wmplayer.exe	unregmp2.exe
PID 1064 wrote to memory of 1980	1064	wmplayer.exe	unregmp2.exe
PID 1980 wrote to memory of 1820	1980	unregmp2.exe	unregmp2.exe
PID 1980 wrote to memory of 1820	1980	unregmp2.exe	unregmp2.exe
PID 4060 wrote to memory of 2428	4060	Client.exe	msedge.exe
PID 4060 wrote to memory of 2428	4060	Client.exe	msedge.exe
PID 2428 wrote to memory of 632	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 632	2428	msedge.exe	msedge.exe
PID 4060 wrote to memory of 4296	4060	Client.exe	mspaint.exe
PID 4060 wrote to memory of 4296	4060	Client.exe	mspaint.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2888	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 5064	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 5064	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3924	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3924	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3924	2428	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mielda loco 12.exe
"C:\Users\Admin\AppData\Local\Temp\mielda loco 12.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1720
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1216
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\BlockApprove.jpeg"
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\AssertRevoke.mhtml
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffaf95546f8,0x7ffaf9554708,0x7ffaf9554718
      4⤵
      PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:8
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
      4⤵
      PID:6464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:6484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff790f75460,0x7ff790f75470,0x7ff790f75480
        5⤵
        
        PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,1509778894278451049,5665113647147876295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7056
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\BlockApprove.jpeg"
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4296
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\DenyUnprotect.doc" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4016
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\desktop.ini
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3664
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5208
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5208 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:5400
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5208 CREDAT:17418 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:5440
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5208 CREDAT:82946 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2008
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5208 CREDAT:82948 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:6328
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\FindReceive.aif"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5796
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\GetDismount.gif"
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5832
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\PublishConvert.rmi"
    3⤵
    PID:5680
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\PushDismount.dib"
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5632
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\ReceiveMove.xlsb"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:6068
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\ReceiveRestart.wmf"
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5736
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Downloads\SaveRestore.xltm"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:6080
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\SelectAssert.rtf" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    PID:4640
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\SetStop.xlsx"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1856
- - C:\Windows\system32\msinfo32.exe
    "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Downloads\UnpublishWait.nfo"
    3⤵
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    PID:6808

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4208

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 2304
  2⤵
  - Program crash
  PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1064 -ip 1064
1⤵
PID:1440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2000

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:6408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
151c472e1546b6d309f2d0abf5db0fe7

SHA1
41c80c044c4628dfc79bd69b752d9d3a7d09ea26

SHA256
838da09150db6df973f158849bf18af57e305e1dff3d7cd70b4caf51eb60b4c5

SHA512
873ae990376888376af342fed318c357f8272fa903815415eb6005ef49cbc870305b83648be75e3c115825d170842eb92529cb30b1836715dfd9bec2cbabcee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
33b6a28c2ee9e79ac029e9870b6ff5c4

SHA1
7ee48c4b08d408f148b623ef6fde615a06476a3f

SHA256
1ef7196c9eef874e300aa6489767362e3509722faa4323fbceb0592bb66fe55f

SHA512
1f8e9ded3015ee53dcbef0acae20465e81c35410faa3be2d1ae327b9957795b00088bd0ca2ad84db5d1bd840a1d6a8e4a5387b53799263a92dfe28dafb431c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39191fa5187428284a12dd49cca7e9b9

SHA1
36942ceec06927950e7d19d65dcc6fe31f0834f5

SHA256
60bae7be70eb567baf3aaa0f196b5c577e353a6cabef9c0a87711424a6089671

SHA512
a0d4e5580990ab6efe5f80410ad378c40b53191a2f36a5217f236b8aac49a4d2abf87f751159e3f789eaa00ad7e33bcc2efebc658cd1a4bcccfd187a7205bdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef84d117d16b3d679146d02ac6e0136b

SHA1
3f6cc16ca6706b43779e84d24da752207030ccb4

SHA256
5d1f5e30dc4c664d08505498eda2cf0cf5eb93a234f0d9b24170b77ccad57000

SHA512
9f1a197dccbc2dcf64d28bebe07247df1a7a90e273474f80b4abd448c6427415bace98e829d40bccf2311de2723c3d1ad690a1cfdcf2e891b527344a9a2599d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
f2fad1898ccae170951608974d4b4ad9

SHA1
7f87e35a263ec24f314e2676bd4d9cef9f1a4e1a

SHA256
45df2b1cc73f6dededda10cadae11419e003d55a65fc8f3e3fd37fe119dfaf4a

SHA512
7f330c98614901f8b126d006ab4fc30a8f555be4b6a0190886a8e4d2509db0064618e39c06a0b7a326a91e418c3841b40bbdfeeac0d4b30cbdc73dfceccf215c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fbacb7c231bc645630e08a424a0d292d

SHA1
a56a662f09f0301f66cbfe9f562f47c0c3ed4e1f

SHA256
331d6cd8577ba297fb2cb7b6c61c865fecec5c3d09720da49fbfe7e0c511676b

SHA512
6aef0b59394b0b09d76b1a0d72c78a8f5c2312974e74715e4af01f459884832b62225ce5ec29ee3c21c94e4d3465468d154fb510715bbb3ac377b82ab364e0d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39ab01ad93a84ad055dce266629492c5

SHA1
89170f782274d78e8b5c086c1265b1be60c43012

SHA256
79bfacf857150b125a3aba2f55b13f06da76d34ed1b6235462ee7d95cadc6f3e

SHA512
cdd9c97b556c2b8153c2926460738e9d5696ccddbf9e19b6db3acb135e1646479da7e995548cf71fe761ac33db7582e731fb52fc1a77b67c94401e62cd956e44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e98d1679e15688ad133f11eee8458ee

SHA1
a4b1a83f0a3f2867954d3146d95d314441950606

SHA256
8aa7eaf918f2969424996a8f3575478006d9d74b308a750f996fe4f5f045554e

SHA512
eb34d52a8df4992444000a93c8d0d11254069b5f43a68a6def21061be03a538f36c42b2e968a8637f12b93235de3140002b0212aa2cdebe0950fd115c04bc72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60d82bd601d64fd00bb0373f5ecd65b8

SHA1
0e8bde426270dfa3ea285c2c5b7282ab37771d4c

SHA256
bdec91a5061c6a400ef33c2dca5b1d0c16c1fe9e464f8ec99a72442b752e6a97

SHA512
5ea1b33784438acd246c02c95716f72c78293bc8d8e8e6d71aeaab370ae9fc2063ba8ffa443bbfc26c96e45a95549b62894b846a459c986531b34a110d0be38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
845d4c2b12833be350959c37a336a3d3

SHA1
823148892fa041ec1926f82cb036a8415a2d028d

SHA256
fb32f1eb41c00d4d66240d32e12d4519a34c0b49b469f820298d06891d3f853d

SHA512
05935c975722c006180fd2660d42fbac0a1679cffb7607d45731fe70aab41e8e33a9d4089f6b980a8ff8e6193cc0a82df240d8ea355f6404cde7648ecb82aad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
89ae06c2eb0bf868c9cd603e4ee159c7

SHA1
c2f8d8071ec5951b694fb644016ca48d708c0ca2

SHA256
805f6446ea6a53b1adf32baf811501a6bbecb1fa2971198b8e2290b4fc42d8a3

SHA512
78b0fbb68c7e85657329b80652deacdad199f27a63985e6ac0c4b9b372e4dcb396ff69c61550a899de0967e7cf4385b628d129dbe90b0ab8f56ec2c8e000913f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
987a07b978cfe12e4ce45e513ef86619

SHA1
22eec9a9b2e83ad33bedc59e3205f86590b7d40c

SHA256
f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

SHA512
39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
0492b777969fd345772736f3f1bfb28e

SHA1
284180726dfaa616a4b22273b2456a1eb441ed5f

SHA256
5e51e2c49e7706abde12e499da74dc8db56d530260fe2f34f76a71dfa760789f

SHA512
d73aa7993b9f6bf69542073cba26d67aaa88782be6e1710fbb0b5f2c20841b365e5dec94a1ced0772ea8bab1b604dc92566cb35020f43248cb63fcc2872dab27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\lastplayed.wpl

Filesize
363B

MD5
c2684abfea05e5b295b75e34764ff536

SHA1
8c17c14af306dbe83e1f01deba7ed9dade1adcbe

SHA256
8b4ff0476f81cadb3e980364b6f21f7a015c5dc3bb4eb8fef4c1720b5c5e8005

SHA512
84a379b6600cc535095cedc4c8192c3fcecc167cfd166f911d497f984f090e06b567ff95055dddfca9f90cacf210d41064b942b7e8fee211e60f63e59db461a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D348E505-BF24-4BA1-BC89-A281CCA2677D

Filesize
174KB

MD5
b6880a751d5770b3404efa3c04e2021b

SHA1
79c873421425f27a96d3492639db219c345147a1

SHA256
0c3469b3cfb0a073785fa16944c3750e4c3a38f41a173fe56e6bac50acceca31

SHA512
1767a86196964271218589b64e8ef91f9196abd2e8f9960aaa21e80f17a7c003c7dfeee5b77580543842915511a06d62b842779d30456879c0bb4f5f5fbd8d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal

Filesize
12KB

MD5
52c4900c40591f6c98470e56d6cb2b19

SHA1
557538c6df695cbee57ad86ab7dd20f1c9824c87

SHA256
0af05b6d46cc5bbf626bce8144113be1f7727cb4464848c8060e505f0d0f5ebd

SHA512
a4f9815352b359addbc77aa0c66be2e8d4ce86fdab54cef7078283e400a8258c2de2ad69382f109ca9cff13bbbdf8a1f93f86c038bbf4777f3c853620e2c94ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal

Filesize
16KB

MD5
59ba8dca8577590fe48c9ffd77e303e9

SHA1
d16426c44c1755f132272468a5ad8522cc5e98f9

SHA256
9aefec17bf8c62d898c2aaabb4b15f4b7f0240a413142bf8ecc7d9431795177f

SHA512
d7ff45cb13afe03e028f57f3379d3184811195df58b0e99e964b5679086d931c3ed7bff9d8d63b59dc70d5ce1abe0f3f719542f04beea61d51dc57ddcfcfd76b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal

Filesize
8KB

MD5
78e72677331cbd92742105a8c6377710

SHA1
0b176cc3817fe0d27551e1878ae132af15bf9710

SHA256
926dde3429b0f3eddb4b17a24a4d03d04b10fd1ba3fda2a26891e49935a803ac

SHA512
238047d018d57cdf408c94938b1684d15611b6e0da51ba473bf5a5725ab7ac799b3fef9085a0202aacaa8c643ad7bfa81adba4fb8549c312f819c5e40cf6b068

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
5b2b832a51c7ee9d2bf9d2cd8d907b57

SHA1
b3f7508e9379687795dd31532e66daca66baccbf

SHA256
1264c13f972e0be2c1c44d88279dd547c62379b9e42730a89102559cc470d3d6

SHA512
72ff882d4d68071fbb2e69f7d5b8ca5e1b00d6dd45d553a827a6391d5bbd94093125f11273e945a9a8bd6fd0c4001bd9a598fa5072583f60384567b3f02807cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
d8a95023bd9a84271de0ef1a64396fa7

SHA1
fc02989ab96e410f3360a7a6ebb3f6412362008f

SHA256
548390df533c4bfddc3d18ca8bb1a08fd5350fc5c8cb0978af7ac9eafa6d2c00

SHA512
7c4c2b11e62b6dbd2477deebc3657dcb48092ebd7974cebc486226487d7c91cd5e8f9445b4ebb5caaf0284b76495edcd81df776e1cd9af5154dc23619365f5e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
7cea1842a66bfca2f05264be9023b846

SHA1
e7f4e8ff328e322fa5b6a33fb3e24ab37b8e0513

SHA256
fb5995b41b6f46a1c7f672f33a2347169a1ce74ce556570fa71cb1c702a70a04

SHA512
0b09286a9c0bdcd87e57b2e182485825557f0a19ea64655866711049fe0f300af464094b5dcf80d3d12949e4d6570c89a046c23bf6572279fd51c5b6dcf87b36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Filesize
2KB

MD5
c0e54495fabce12297dad3ad31398d6d

SHA1
d9ddd7f77ee557cd650bcc70f5c198434afe5c4d

SHA256
af101be0fbf37c65e693ffec771a5748158dba8796df2e63282718d9a9c6560a

SHA512
eb20b44aa5cc0a08c55c8fe00b14b2314a4086f2e14a01438e8ad832e572e28eac798d591b97197825e5ebc64d1991535d2e550b5846f1d97f61f1c2beeb11a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
b6210bcb2d7a22ce18ea78447999f663

SHA1
bc2c1d34d95bb370909c10dff1903e78e8645b32

SHA256
194193bc718c826052be24007d55bd0060edc086fa7ab419e28e5bc619a77b0e

SHA512
0b3249531c1cf83edbcc6c9e700d2f67eaec387130f5a8c57a9b24d24ee0935d5bc82ab474827402271dada58cbaa885039060c7524037cfd5fa98d96e3b3ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFFF8E07F4A9E2658F.TMP

Filesize
16KB

MD5
a2c53830753cc46271dd49b2c1426c14

SHA1
932ad656e900314e1eb32ebcfc3135f94e4243bc

SHA256
05106b42897eab74d3548985ec9f5cea285d8bcf4eda156a9ba0d4d7e1823341

SHA512
d65a46390167aa3e4dd0917b31dfb669e490956528fb9ddf0c688686586c5d4cfab6b6e8cd3df84a3dd613932fc95d142e5d5913aebd251660add91478347762

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
f79bea20d7845f3f7ee5a3c0404b9de1

SHA1
acb51ced114a957a74367240cde8de8a0bbadd88

SHA256
065ace47fbe15023a9be6a4de018d16e2b5dbf0ccb704ef83dfdb3bd28b3306e

SHA512
20422fe171d1b81ab95d10b4d777b337f127c2c50079a4d929ef0ce84608cb06708403e23f14e6628497f57cbf0bea4ccb79374ae754ef54a735b5298a672b26

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
139696b5249398e7056438a622fda1c4

SHA1
2abd7c002394fe5114daffbe820b48c250b3ebdf

SHA256
1eb6afdc3c80b45cd85a4c8a10e8049db56b573e74c0e6643560f5bb03251545

SHA512
ef696bf28e50c05919ce853b0a6382d14aeabc28610ddf02a93c249f80fa31ccabda9c4e53c9a2c876a11cb494e6f1f14d64d5f198a3efd0035ffca11f5b39f3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
55a1bf4fe0ae639e428b723dcbb3bba6

SHA1
06e6ad58f07b9e6df17258837ae7968466968d00

SHA256
cd5f30a534d1ebc04d7fd8ab45409d4b5115f1be65adaf5144a357530243dafc

SHA512
5d16dbc781969bee55f1701326034edad23368a9ff0580d9d557b6d95b55b5bc892929a99bdb266e423e7ca28aecee4f7f50fb68444706c3699f6e1d38ddb63c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
a126594c574a527e2739cae725a54000

SHA1
bd584d49e95d3bc664544ae65c038209e7818c3e

SHA256
269ba1a53ef2b58667b66c6226f1eaeb9447c2ccdfdf710ec6714a1c9048294e

SHA512
cd6bb91ea598829b9f10b32616dc547e6eaffb95f88a1bf09c881f61e592f81b1e7c0e76c5167bd47b9ce4082368696def203199fe8c38b91e408cb3a5f0d31e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
307548d8d78a20985ec7c2ae96e19673

SHA1
95dcf69bbe2b814102536582f4a404153c873660

SHA256
9e889e03560dc280fbded5c68b177687428b39c47f426d85c828a7a3714f4034

SHA512
fd3c83b86c0503033224654463ecc1b265101860d83d7eca9565a5ef87776d5a6f0600fe48bce077f886af3166ed3865ae274c332dba10b444566929a9464153

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
4ae7ab9b981922837aae1c86c7f726a3

SHA1
1783e0788fb2a103d71bc9a05ae2fb85c0d70ee9

SHA256
b1b8ad9032b829e2ac3956ce8f302745802cd2d5ae686c700796e2f2ee81b0f7

SHA512
79c4bf39ae1761414b5f37186c2483a4b8755168824d6e783ea9cab26e7c0118f391b6417c622b65ea3ac3924ae745a6abe4838ca1d87671898ad90ae9a18e58

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
3KB

MD5
4d327800f5056a5536079ec1a2b5eb05

SHA1
2dbed40e1a74c8cc348eb7dfa43a36ee2c3ff5c4

SHA256
5dcaf4fb9712bcdff88e7fc940fa71631538535cb8033f305499786faef5416e

SHA512
8ed7de7ad824fb6400ffb95f86e19a4647dc6101106fa00c4ba65b87126a187097cb331b6b712530998d2cd0c7b0d38c7dec325d2dfeb2896dcbf04157b9807e

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
4KB

MD5
003a807c3830a7c8c72513ad8fdc1070

SHA1
abf1af323705ef09677e2fef7a2c58dc40383698

SHA256
10822556c39df53114aa6c6209935c52bced325ff00ef32a875d888666d794a0

SHA512
20e7c80ab8491f49bfa95c8ae4ba76e27d694a78443a873c5753a1a0617f661468bbcfe6b4bda1d1fc79505fe2b0a1a5a5b68565bdaffba13ba017c64052afdf

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
6KB

MD5
4fd8b4cb0ed57f6a86137090f9688b4b

SHA1
da73a111f4b9aaca8dff86b65a17db065818fb85

SHA256
8bc74c859fc95713685f3b163c7e079696b49e27aa0a2392f507b941bb0f6b32

SHA512
bf91eccc56fcf92f4c3e49aea2d6d9c826b9730b5980e4f7612020838505b6b71f04b6a4aea36f55639102f06cf43e6f5c6a21fbf25644c29291d46dc541cc7a

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
7KB

MD5
3961adcf01b0599b1fd364df5769058d

SHA1
ac19c1163666aa8799049bd825dfe58b4eb4fd6e

SHA256
3aaeebd87ac26838488bffb600bd9b4d33758c16b4a7e4376713dc1b97d11d63

SHA512
4b2eceb68981973370fd2f955d313944e77f4b997dfe3563d883d3c4183cdf3d72111e667a055ecdf7923642254d602ab18c3028cb107d258bc0b44f53605963

Download Submit
\??\pipe\LOCAL\crashpad_2428_IOISQOSVEZFYNZGN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4016-188-0x00007FFADEB90000-0x00007FFADEBA0000-memory.dmp

Filesize
64KB

Download
memory/4016-187-0x00007FFADEB90000-0x00007FFADEBA0000-memory.dmp

Filesize
64KB

Download
memory/4016-186-0x00007FFADEB90000-0x00007FFADEBA0000-memory.dmp

Filesize
64KB

Download
memory/4016-195-0x00007FFADD820000-0x00007FFADD830000-memory.dmp

Filesize
64KB

Download
memory/4016-189-0x00007FFADEB90000-0x00007FFADEBA0000-memory.dmp

Filesize
64KB

Download
memory/4016-190-0x00007FFADEB90000-0x00007FFADEBA0000-memory.dmp

Filesize
64KB

Download
memory/4016-191-0x00007FFADD820000-0x00007FFADD830000-memory.dmp

Filesize
64KB

Download
memory/4060-224-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-220-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-228-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-229-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-230-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-231-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-225-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-226-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-242-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-243-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-246-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-245-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-247-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-244-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-248-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-249-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-250-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-251-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-252-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-253-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-254-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-255-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-256-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-257-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-5-0x00007FFB00700000-0x00007FFB011C2000-memory.dmp

Filesize
10.8MB

Download
memory/4060-7-0x00007FFB00700000-0x00007FFB011C2000-memory.dmp

Filesize
10.8MB

Download
memory/4060-8-0x000000001C270000-0x000000001C2C0000-memory.dmp

Filesize
320KB

Download
memory/4060-9-0x000000001C380000-0x000000001C432000-memory.dmp

Filesize
712KB

Download
memory/4060-12-0x000000001C2E0000-0x000000001C2F2000-memory.dmp

Filesize
72KB

Download
memory/4060-13-0x000000001C340000-0x000000001C37C000-memory.dmp

Filesize
240KB

Download
memory/4060-14-0x00007FFB00700000-0x00007FFB011C2000-memory.dmp

Filesize
10.8MB

Download
memory/4060-212-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-217-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-218-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-227-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-222-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-219-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-223-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4060-221-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/4244-6-0x00007FFB00700000-0x00007FFB011C2000-memory.dmp

Filesize
10.8MB

Download
memory/4244-2-0x00007FFB00700000-0x00007FFB011C2000-memory.dmp

Filesize
10.8MB

Download
memory/4244-1-0x0000000000140000-0x0000000000464000-memory.dmp

Filesize
3.1MB

Download
memory/4244-0-0x00007FFB00703000-0x00007FFB00705000-memory.dmp

Filesize
8KB

Download
memory/5680-268-0x00007FFAEEAD0000-0x00007FFAEED86000-memory.dmp

Filesize
2.7MB

Download
memory/5680-270-0x00007FFAF89E0000-0x00007FFAF89F7000-memory.dmp

Filesize
92KB

Download
memory/5680-271-0x00007FFAF8840000-0x00007FFAF8851000-memory.dmp

Filesize
68KB

Download
memory/5680-269-0x00007FFAF8B20000-0x00007FFAF8B38000-memory.dmp

Filesize
96KB

Download
memory/5680-261-0x00007FF68ED40000-0x00007FF68EE38000-memory.dmp

Filesize
992KB

Download
memory/5680-267-0x00007FFAF8440000-0x00007FFAF8474000-memory.dmp

Filesize
208KB

Download