Malware Analysis Report

2025-08-10 14:21

Sample ID 241108-sblntavank
Target edkdpu.zip
SHA256 f45bcf726922fe01b71eb17cdaea8fcea57bdeefced3054e118732a41805f15f
Tags
discovery adware evasion persistence privilege_escalation spyware stealer trojan
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

f45bcf726922fe01b71eb17cdaea8fcea57bdeefced3054e118732a41805f15f

Threat Level: Likely malicious

The file edkdpu.zip was found to be: Likely malicious.

Malicious Activity Summary

discovery adware evasion persistence privilege_escalation spyware stealer trojan

Detected Nirsoft tools

Drops file in Drivers directory

Boot or Logon Autostart Execution: Active Setup

Event Triggered Execution: Image File Execution Options Injection

Sets service image path in registry

Modifies system executable filetype association

Event Triggered Execution: Component Object Model Hijacking

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Checks installed software on the system

Adds Run key to start application

Enumerates connected drives

Maps connected drives based on registry

Checks whether UAC is enabled

Installs/modifies Browser Helper Object

Drops file in System32 directory

Checks system information in the registry

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Browser Information Discovery

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

Uses Volume Shadow Copy service COM API

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

System policy modification

Suspicious use of FindShellTrayWindow

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

Checks SCSI registry key(s)

Modifies registry class

Modifies data under HKEY_USERS

Enumerates system info in registry

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 14:57

Signatures

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

92s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\devcon.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\devcon.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\devcon.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

90s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\NVIDIA Control Panel.exe"

Signatures

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\NVIDIA Control Panel.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\NVIDIA Control Panel.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\NVIDIA Control Panel.exe"

Network

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

147s

Max time network

152s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Export.bat"

Signatures

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1292 wrote to memory of 132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1292 wrote to memory of 132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1292 wrote to memory of 3516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1292 wrote to memory of 3516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Export.bat"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD "

C:\Windows\system32\find.exe

find "Intel"

Network

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

92s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\str.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\str.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\str.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DeviceCleanup.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DeviceCleanup.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DeviceCleanup.exe"

Network

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe"

Signatures

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\130.0.2849.80\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A

Event Triggered Execution: Image File Execution Options Injection

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\cookie_exporter.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\cookie_exporter.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\cookie_exporter.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\psuser_arm64.dll C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_kk.dll C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\pt-PT.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedge.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedge_elf.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\pwahelper.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\edge_game_assist\EdgeGameAssist.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lv.dll C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ur.dll C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\VisualElements\SmallLogoBeta.png C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\identity_proxy\resources.pri C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_proxy\win11\identity_helper.Sparse.Stable.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\65354d6d-b711-4c80-adae-f707ada85dfa.tmp C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\psmachine_arm64.dll C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\dxil.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedge_pwa_launcher.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\MEIPreload\preloaded_data.pb C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\ar.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\ja.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\kok.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\lb.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\sr.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Trust Protection Lists\Mu\Fingerprinting C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\fr-CA.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\msedge.exe.sig C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\hi.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\id.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_es.dll C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedgewebview2.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Trust Protection Lists\Sigma\Cryptomining C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\gd.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\hi.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_proxy\win10\identity_helper.Sparse.Dev.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_gd.dll C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\or.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\pwahelper.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Trust Protection Lists\Sigma\Advertising C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\vi.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\et.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\gd.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\ka.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_proxy\win11\identity_helper.Sparse.Beta.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\identity_proxy\canary.identity_helper.exe.manifest C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Trust Protection Lists\Mu\LICENSE C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_cy.dll C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\fr.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\kn.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedge.exe.sig C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedge_100_percent.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\af.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\as.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\pt-BR.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\edge_game_assist\VERSION C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\130.0.2849.80.manifest C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\mip_protection_sdk.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\edge_game_assist\EdgeGameAssist.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_km.dll C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ug.dll C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\sk.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\bn-IN.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Locales\ms.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\msedge_installer.log C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File created C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\msedge_installer.log C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File created C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\metadata C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\msedge_installer.log C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\msedge_installer.log C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\msedge_installer.log C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\130.0.2849.80\\BHO" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge\WarnOnOpen = "0" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge\WarnOnOpen = "0" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\130.0.2849.80\\BHO" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133755516157576028" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E8770A1-043A-4818-BB5C-41862B93EEFF} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\130.0.2849.80\\notification_helper.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ = "Microsoft Edge Update Update3Web" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\DefaultIcon C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E8770A1-043A-4818-BB5C-41862B93EEFF}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CLSID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\EnablePreviewHandler = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas\ProgrammaticAccessOnly C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VersionIndependentProgID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ = "Microsoft Edge Update CredentialDialog" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebSvc" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ = "IAppBundleWeb" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\130.0.2849.80\\notification_helper.exe\"" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CurVer\ = "MicrosoftEdgeUpdate.CoreMachineClass.1" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\ = "Microsoft Edge PDF Document" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\msedgeupdate.dll,-3000" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\130.0.2849.80\\notification_click_helper.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\URL Protocol C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine\CLSID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1300 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe
PID 1300 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe
PID 1300 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 2136 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 2136 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 2136 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2136 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 2136 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 2136 wrote to memory of 3564 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 2136 wrote to memory of 3564 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 2136 wrote to memory of 896 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 2136 wrote to memory of 896 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
PID 1256 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 1524 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 1524 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 1256 wrote to memory of 1524 N/A C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3456 wrote to memory of 4172 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3456 wrote to memory of 4172 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3456 wrote to memory of 4172 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3456 wrote to memory of 2968 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe
PID 3456 wrote to memory of 2968 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe
PID 2968 wrote to memory of 2316 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
PID 2968 wrote to memory of 2316 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
PID 2316 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
PID 2316 wrote to memory of 3336 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
PID 2316 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
PID 2316 wrote to memory of 1068 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
PID 1068 wrote to memory of 5024 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
PID 1068 wrote to memory of 5024 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe
PID 2316 wrote to memory of 2084 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 2316 wrote to memory of 2084 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 2316 wrote to memory of 4248 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 2316 wrote to memory of 4248 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 2316 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 2316 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 2084 wrote to memory of 1712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 2084 wrote to memory of 1712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 4248 wrote to memory of 2008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 4248 wrote to memory of 2008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 1384 wrote to memory of 3048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 1384 wrote to memory of 3048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe
PID 3456 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3456 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 3456 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
PID 2820 wrote to memory of 1580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 1580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2820 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1" C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\MicrosoftEdgeSetup.exe"

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI1M0QyQ0UtNjRCMy00MjlBLTg5NzgtQTJCRUQ1ODczMkRDfSIgdXNlcmlkPSJ7MTA2MzRBMUUtMDJFMi00NzhFLUFBQUMtNDdGQUVDMDYyNkY4fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0UzMUFBNEZGLUU5MkUtNEZDOC05MUQ2LTg4MTg4MkQxREM0OX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTQzLjU3IiBuZXh0dmVyc2lvbj0iMS4zLjE5NS4xNSIgbGFuZz0iZW4iIGJyYW5kPSJNMTAwIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDcxMjYwNTY3MyIgaW5zdGFsbF90aW1lX21zPSI3MTkiLz48L2FwcD48L3JlcXVlc3Q-

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100" /installsource taggedmi /sessionid "{DB53D2CE-64B3-429A-8978-A2BED58732DC}"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI1M0QyQ0UtNjRCMy00MjlBLTg5NzgtQTJCRUQ1ODczMkRDfSIgdXNlcmlkPSJ7MTA2MzRBMUUtMDJFMi00NzhFLUFBQUMtNDdGQUVDMDYyNkY4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzVGMzUyMDYtQzA1NC00M0M3LUJENkQtNEVFNDNCMEU4N0YzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjMyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MjgzMDMyNDEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM3Mjc3NTkzNTEwOTA1NjUiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzE4NTQzMzQ3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff73affd730,0x7ff73affd73c,0x7ff73affd748

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ACF80073-497B-4C8E-8D1E-A61923F419D2}\EDGEMITMP_08608.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff73affd730,0x7ff73affd73c,0x7ff73affd748

C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level

C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level

C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level

C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff71891d730,0x7ff71891d73c,0x7ff71891d748

C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff71891d730,0x7ff71891d73c,0x7ff71891d748

C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff71891d730,0x7ff71891d73c,0x7ff71891d748

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REI1M0QyQ0UtNjRCMy00MjlBLTg5NzgtQTJCRUQ1ODczMkRDfSIgdXNlcmlkPSJ7MTA2MzRBMUUtMDJFMi00NzhFLUFBQUMtNDdGQUVDMDYyNkY4fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezhERkE3ODRDLTE3QjItNDkyMy05QTkxLTdDMzU2M0YwNkRDOX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzMC4wLjI4NDkuODAiIGxhbmc9ImVuIiBicmFuZD0iTTEwMCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNzI3NzkyMzQwNTM4MzQwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ3MzIxMzY5MDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzMyMTM2OTA1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEzOTc5Mzc1NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMjdjYjcyOWQtZmY5NC00ZDM0LWFhZTQtMzM4NWZhMDljNDRjP1AxPTE3MzE2ODI3MDcmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RGZURlNkV3V1QjBnbWplaDF0OXc0am5tZ1ZONHh0MzloNkxLdG55JTJmYWtpbnBSYXhrOThvY0hJQ3l1VlRhZGZPUFFKaVl2OTAydlA4ak5JOExseDIlMmZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc1MDc2OTIwIiB0b3RhbD0iMTc1MDc2OTIwIiBkb3dubG9hZF90aW1lX21zPSIzMzg3NSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMzk3OTM3NTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTUzNjk5OTE4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzczMzg3MTI4IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iOTUzIiBkb3dubG9hZF90aW1lX21zPSI0MDczNSIgZG93bmxvYWRlZD0iMTc1MDc2OTIwIiB0b3RhbD0iMTc1MDc2OTIwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MTkxNiIvPjwvYXBwPjwvcmVxdWVzdD4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-installer

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffbdd054dc0,0x7ffbdd054dcc,0x7ffbdd054dd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2200,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1832,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11

C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2500,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:13

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3420,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3428,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4132,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:9

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4588,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5280,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5440,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5476,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5680,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5688,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5604,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6192,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\cookie_exporter.exe

cookie_exporter.exe --cookie-json=1140

C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6808,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\130.0.2849.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6808,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6988,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7152,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7052,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7048,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6392,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6380,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6268,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7568,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=564,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6880,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4772,i,2813197925684484287,538068831321116992,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14

Network

Country Destination Domain Proto
US 4.151.228.221:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 clients2.google.com udp
US 204.79.197.239:443 edge.microsoft.com tcp
GB 142.250.178.14:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 216.58.213.1:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 assets.msn.com udp
US 95.100.195.147:443 assets.msn.com tcp
US 95.100.195.147:443 assets.msn.com udp
US 95.100.195.147:443 assets.msn.com tcp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 c.msn.com udp
GB 2.19.117.73:443 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 c.bing.com udp
US 8.8.8.8:53 c.bing.com udp
GB 92.123.128.157:443 www.bing.com tcp
US 95.100.195.147:443 assets.msn.com udp
IE 13.74.129.1:443 c.msn.com tcp
US 204.79.197.237:443 c.bing.com tcp
GB 92.123.128.157:443 www.bing.com tcp
GB 18.165.160.56:443 sb.scorecardresearch.com tcp
GB 2.19.117.161:443 img-s-msn-com.akamaized.net tcp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 239.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
GB 51.140.242.104:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 147.195.100.95.in-addr.arpa udp
US 8.8.8.8:53 1.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 157.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 161.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 1.129.74.13.in-addr.arpa udp
US 8.8.8.8:53 56.160.165.18.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
GB 51.140.244.186:443 data-edge.smartscreen.microsoft.com tcp
GB 51.140.244.186:443 data-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 browser.events.data.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
US 20.189.173.7:443 browser.events.data.msn.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 204.79.197.239:443 edge.microsoft.com tcp
GB 92.123.128.173:443 www.bing.com tcp
US 8.8.8.8:53 srtb.msn.com udp
US 8.8.8.8:53 srtb.msn.com udp
GB 92.123.128.157:443 www.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 r.msftstatic.com udp
US 8.8.8.8:53 r.msftstatic.com udp
US 204.79.197.219:443 r.msftstatic.com tcp
US 204.79.197.219:443 r.msftstatic.com tcp
GB 92.123.128.190:443 r.bing.com tcp
GB 92.123.128.190:443 r.bing.com tcp
GB 92.123.128.157:443 www.bing.com udp
GB 92.123.128.173:443 www.bing.com udp
US 8.8.8.8:53 ecn.dev.virtualearth.net udp
US 8.8.8.8:53 ecn.dev.virtualearth.net udp
GB 2.23.220.162:443 ecn.dev.virtualearth.net tcp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 13.107.246.65:443 edgeassetservice.azureedge.net tcp
US 13.107.246.65:443 edgeassetservice.azureedge.net tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 13.107.246.65:443 edgeassetservice.azureedge.net tcp
US 204.79.197.239:443 edge.microsoft.com tcp
GB 2.19.117.161:443 img-s-msn-com.akamaized.net tcp
N/A 224.0.0.251:5353 udp
US 204.79.197.239:443 edge.microsoft.com tcp
US 204.79.197.239:443 edge.microsoft.com tcp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 13.107.246.65:443 edge-consumer-static.azureedge.net tcp

Files

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdate.exe

MD5 136e8226d68856da40a4f60e70581b72
SHA1 6c1a09e12e3e07740feef7b209f673b06542ab62
SHA256 b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f
SHA512 9a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdate.dll

MD5 5d89123f9b96098d8fad74108bdd5f7e
SHA1 6309551b9656527563d2b2f3c335fd6805da0501
SHA256 03c3c918886e58f096aa8e919b1e9f8dcd5a9f2a4765971049bf8da305476f44
SHA512 9d8190e5374cd1b4adbbfb87c27fa40d4de529d7c0a20654e0ce189a4cb9a53d3708c4ce657a7a5469b015df7efbbff495fc844579d9cd363b329b7e007e85c8

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_en.dll

MD5 19dc1f6d1f309eb7abf1e0c8257f41f8
SHA1 e2d3e86fe22c6af6b8ee5b359315dfa6ac4d52ec
SHA256 046f6c532fcabd969c6e63bb7ee0d7a83d806fa659006508e1c3a9485190d6ef
SHA512 478d6a84452cfadc48547930e336ad459eec188dd3d9e4c778cded4ec3d34e00b2b8c0538366aa644ee67f878b29c5c73444c1406c66e8394761bb0979c6483c

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeComRegisterShellARM64.exe

MD5 b69894fc1c3f26c77b1826ef8b5a9fc5
SHA1 cff7b4299253beda53fb015408dd840db59901a1
SHA256 b91bad4c618eb6049b19364f62827470095e30519d07f4e0f2ccc387ddd5f1bf
SHA512 8361e97d84082f8e888262d0657bac47c152bd72f972628f446f58cbeacf37c05f484dce3fb0d38c4f0da2a2dcbb0813639d201d127ec7f072b942d43b216755

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdateCore.exe

MD5 b07ab49ee8453853021c7dac2b2131db
SHA1 e1d87d6a6e7503d0d2b288ea5f034fe2f346196a
SHA256 f8535d5d73ebebed15adc6ae2ced6bb4889aa23e6ffe55faeabd961bf77b05e4
SHA512 5eaae533fbe71430ae2a717f7668fd0a26ec37624e198a32f09bfdbee7e3b6e93d64e4fbb78cbdb05c4fe390a864490ea997d11849ecd371f5153bc8bfafccc3

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\NOTICE.TXT

MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ar.dll

MD5 5de3f4dabb5f033f24e29033142e7349
SHA1 5c446985de443501b545d75f6886a143c748b033
SHA256 2533d443b68c5288468b0b20cc3a70dc05f0498369d5321368a97dd5bf3268c8
SHA512 c96296e6f67edeff2be5dc03014a8eb65fc287fb899357d4608c36c07b4610827aa18cbec6ccd47b66230a12341af488aca8bd02632fa768f84ca7b1d9c9d065

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_es.dll

MD5 6af05d448c842027f876e93f8ac58b65
SHA1 f34c988e3875a1d1b267b082476fcfb8d7505a73
SHA256 36876b14a214cf98dda5100a7e7134d7ebb78e895535d6bd7562099574607867
SHA512 412031db59de0367a102a026f73072244b33d726adc5bb9fd079db3dd37b5d6a24d7420a9811576d0a356933b5ba15cc9e2a92046d2d6e6d6fef37e9d840aec6

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_iw.dll

MD5 98f79d77ab05304bba8d60e50914418f
SHA1 957590adc0f8a7274e765e2a804c1de7c76e3040
SHA256 3764941b873ed59d5bc1097f6b9382ba59c06d443a96ff71ba6b693f161da522
SHA512 9ca6af5c14193dce7b50251f1b9205870435e60b5495ab1a9f0d42ca14b98b78fef51bf3cd4165394ca5ba28d0e98bea7642ec67039c0f146383136145c7de59

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mt.dll

MD5 11cfc0a8eeff082d17979d3968d5d110
SHA1 c963251af2d22fe7000d1eebe76ea44fb7da6496
SHA256 ce19cc60aceaecb34cf496857dd3698a2a5dfe88cb67bd4b7fd0a7ecc51c2ea8
SHA512 97c09f6a02e4469ee0a609d9d67e20111e2abf9c8672d0fcf8275d66d20fc92e61d8dcb88b3cc9a32d46391253ffff6157c5a7cff7fc9248af55ab3d3217a2ce

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ms.dll

MD5 47d8bedb506470955c8a1b973e34793b
SHA1 d322b0d0d0663bfb9fdd42d3955dede092a0c8ef
SHA256 d79365e02f80694a9a2d76becc6a203a758b4006fbb521453f943ace16d24c8c
SHA512 6b268a0c8c6b2e0f26657040799c8c1ec523882e4dfff3f8d1e2bdbbe47b800e390de0a6bbac7d6253ab84c60c4103b4687b3fbe84d6e289f25c19639d25bef8

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mr.dll

MD5 f94262bdadb5903e2e93a6cb6218fbe6
SHA1 c066be7fb4a1459cb62288e4799e268fcdb13ab8
SHA256 9e000d271d96f02bd0baecae07ef5b9a7f5f17d33733e2c9bb50f13e4c6e84b1
SHA512 11543d93e28e5616dd3aadd5e9b20b22b9160fb4117a0cc57971e5e46b52150c600bde161560410322b1db1c8a26e0c61cf9fdc761ca461a22f0c4eac16340b6

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ml.dll

MD5 dc1bb5db270c494456f49913e26f94b7
SHA1 73dd3db577b7bd6bdaf047cd2012c75cc2213bd2
SHA256 155abac08c35cb330d20aef6375dbe18421c042a2533da0c63535ec59009cadf
SHA512 2cff374df4f8f41961c6e26ce369fc07ad8881c2edbe85173b6982d393402e32a79c73b8c17cc786d27a1f0ee79475e4ef9b3238f8770a099bdb9c422caa1287

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mk.dll

MD5 f05d3aa1b51abeab311516368dddd8bc
SHA1 75ca6ae175a3ccc9f00d82afb4c6b673f396c6ac
SHA256 7aa26839a50ebc3ccb20ab5aebab432b695f0024d52529ef262f5eb8ef96d17d
SHA512 4ff88ba89823ad0c0ca2782c87bbdbc7fe738a161d5d4f674d7b9c97d491eb5aefc0430f34d3dfa7c2737f3484040894d81ac38135fc4ad3bc6cc0eb24e479f7

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_mi.dll

MD5 d8b6019ab0fa35c6e64b08f1453204be
SHA1 aea69732af642a0d13bc8feda2b25751196cc1c2
SHA256 0672e8b5be2da1042bf6c85611a0a89012496fbcf7d06a7f446b30997cd20eb2
SHA512 878dd4db34b1f501c37eacedac8eb0c87143189f7357fbd5bd97faac01ba98cebab56e2e3934af012de37d0f32fb91578b16504b12e34b5f448605a82cb8f054

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lv.dll

MD5 bf10592aafe1b8446c005ee9e5c305a8
SHA1 19b81a238e07c958f1757488440e42ba99b59b53
SHA256 5cb166b350b425009080d39efa3b6ff5c0bf78f4276cc1ffce3043d4ef1a687f
SHA512 b69d55757047170a7583f3f0525307e09e670adfe05906d30bf208dd78b70b3e18a19adf59aeccc861857c2e37cb08412e4729d597ffb45960d285e12357b4ff

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lt.dll

MD5 071ee832762aab532c59b858c7d3a46a
SHA1 0a976bd2c76d8db1f831a8912184d43e02ecf293
SHA256 a47e46963fbc7020dfc9dd08eb5d7d8c4c2a9f0b0a8f51f1256453058a6a19f2
SHA512 50ec7ff32da6f0d022ce067bcc160ccec00c4676ca56b789bc6ba1efc7f34ad485297f4cca6f6ed40be1c59018a7287c7fb490e6adcdd74f3f72b4526332a522

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lo.dll

MD5 6e6f49c35d2b74090529fc1d8d12eb2e
SHA1 5a0fc9397872d7d26803276292962cdb0a5e4739
SHA256 6a25fc0ab6e2c73eb938b8e0f38578b9a02feb3a0634a16ac41ebc2a9642d260
SHA512 d3838a88908b2ab9bf6018dfa4c6f784371774cc0bcc82e180761673a9e527e126fee17a150a51c6d0a1159575e2060c12f85ae751e7a95f0285e816799540bd

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_lb.dll

MD5 b61c9c9ea8340b6b3a873162a2710cfe
SHA1 5017b90dbd61add602681b76542b0bd3974639af
SHA256 f3eb2d26173d9ea8e26e234c3c5f91f9eb145fdf8b2b3e5011e0f33394fd8737
SHA512 0d32f6a880509472a51ceaa9539e3169505bc6b508664d28c9dfdd1a3a72abec665574dfb89e385c18522166221f1d73741fe62e4ea0860bc132e198614cccf2

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_kok.dll

MD5 c1557eba649fc78356ed198d6754416d
SHA1 1ab42e71a88b127c40f8dd6d1b0660f271442a11
SHA256 8c5a7b3e9f5a3a64214ca8e9d43ea152f69fc2633f47c0783b90385e00551ef9
SHA512 e2f92c8c6ea823e1d716732b4bb5295d34da02d270079f645d9290261728bcf822b7f845f4a37dc2ef844580d6a3650a53c3e80be875eac5dffef651e8607993

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ko.dll

MD5 f7dbd944a9126dbe568faf2489ecf053
SHA1 16ad534b4fa48d95224c74b8ca4d3d4533c76425
SHA256 b1dd9c0fdd11a5f83ed5b7d1fbcd417bfaa94e42035647ca45f20e332b531703
SHA512 0b6843fd208ea9448179e63b485c01b5ff824d555cad57cdb6575234bf43d6cf253e9494fa74150b9fa9ace9d1d1ce749e1a77c7b342c10498dd7bd3953d9a27

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_km.dll

MD5 126036b98853a9d31937f874484dcb83
SHA1 27ffb8f3f6e966c3b79824357e79eac4ec8ce0a7
SHA256 90908e9108adcb0b4df84e4fbd9724e5e7a2d2eb54720fe49f37bdce977be635
SHA512 b384657e0ca90270b96cb724aa55c52f5c8b569fdb1a7ee7085c18d6822c39fc81a490128bd42d0aec1c0ddac1853e30718710968f5921a5331211bd33e89316

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_kk.dll

MD5 1b1202fc3e46d7b46ce3cb46cdc5ab21
SHA1 e76d1065035d86eef011feb3cad3ac38eecd0b7d
SHA256 b660a0e1d5161765881e0a7fd9d714abce341403b21f63667ffdedf7d5a254d0
SHA512 7f11d5d6995f27bb4f8705ac7310273f070a71adc73cdb70d74766c89437b3e7a10453fc55588ac223fe3b449564758a49380168d779fdb6a4fac3b5cde767ea

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ka.dll

MD5 d464fd223ba898e6fef4e485a3118394
SHA1 59c78983ce859485fea5458ba4e7803c38012b9d
SHA256 066c5c4b4c87ffd201d0dbfc43cb7566cfb03a6ed2fbf8698220fb919637294d
SHA512 6ac1d5fc59e6b7a10532902b059ac25a2bf58b0a63ab586e89b293e2de732c1d5d580c75ff28e4a2660a6ee3f0389f49e388567bcc07dd6e1cfd5d019db3ea52

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ja.dll

MD5 b89ba9ecc6d4c77abff61b1c75fff16c
SHA1 f381408f26be2c77c7b59681ad6280a701ccb472
SHA256 bbd2c970f747a6ee8e4735939225f607ae630ddc6e2e39954e0300ca9a7a88b2
SHA512 53a3db82f4cf5a300a5eab7692f4084451b987ad72ae24d9118d80f18692ac3604981c0e871c7a7625c5153803aea0e093d91822d33af0c10a07bcb6e766a5b6

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_it.dll

MD5 26cbb965c6976f59ac385ef9408bf81a
SHA1 16bb0530338e600fdfd13a7b03523a715e633bcb
SHA256 bed996b25f77c7d4328d96147ed388f1b457abfc0510eb8956be4339d103821a
SHA512 1efb1bdf0276de17f8516cde4d435e0be8fd066f52fb5d4c9e2fe2e17a135296ab6b34f523284941beae438e97d7e65de26f0541b7c437bceff229b60da4bb0d

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_is.dll

MD5 19d44de8f930e07f41f9343478ed5c1d
SHA1 83ee0c5a86997dd491bd8312d221dde2b2e7d44a
SHA256 69d3a21b7723e4df8b7b97e39493081e41231e2d3a3f5a4de462db41339987ec
SHA512 4edb82aedfeca743a03815a889eca766fec8083afd0defa098593297a52edaf1780dbd5ad1d3325c614d815d34d8c57ec2283a0db215f94f42819f1890089c4a

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_id.dll

MD5 eacd4638369bf96ccc7c23af37e15b5d
SHA1 15c4878b78c06095981abcc589c4a6f265ef96a3
SHA256 a53c0fd74995090dbf48bbba4a00560e3cc344ce8120b8b2bfa1f9b953b536ef
SHA512 19cc8d25bd8fd84481f77d301f79636208df5807647ddc6cb6beff3882d94672db49daa4ddfff0c334b584742f9d2fea3af73977032d7dfccd0cfd1314af4ae6

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_hu.dll

MD5 ee19156c12d2d7cce9b12e515f9ac6c5
SHA1 19ad46e40b3c1cb6195231bfcf45bb68ee1b43bf
SHA256 c290883b4b99758792284755efa52c12eb09039f0f8027d8ba3b1d4bb2f3846f
SHA512 631364472a450519ad8959971d6c319610570ca37b4486ea12d6af5b46aaecbf336aadddd1f3fefba841534ff82adf905b1e1a008638ed784bf08870a3b86ee1

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_hr.dll

MD5 c09876a180731c172fa2532f8be90a3d
SHA1 4359c7840ddb23142a40aff85129b9920360e954
SHA256 50fd548ea12e2b72fc563bc082b870a89a523e8b3a4a0e9b65fe673384da2b58
SHA512 91cee1b10fc12a01a2a285e67dba583d6f1bee0716cc89103fee0c7d0f52fadc0f9ac5b13e833834e7279963726950d3897847e7acac61857257fc031692033e

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_hi.dll

MD5 a5544f517f7c1bfd1ec6a2e355d5a84c
SHA1 34a2a4a576300ad55b6757171bcba0fab005daa5
SHA256 8274c64bb778b55d912929625cd849adfe733b2dd674d94895d53af8dfaabeca
SHA512 9069bcfb736e13499250844dddef40e2cf64937e33ee1f81fc4968f024f7d7b89c6a778866bf1bff98d770686569e4752a473c0adfad4d4099cceda84da3cac3

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_gu.dll

MD5 c43c1ab37cd93e54068443bc330fb3d2
SHA1 ab51a2cbc51b3c17cf184c6d99ac480c02eb63af
SHA256 0c26a367355e766402c31fbab102dd1c35300d4a1301417c75be5fc4b3d54680
SHA512 ff0193189fb846eb3c4188bb599dad8e6f415ec9612da567d95c9c513defb148b6013208371798d174569b46f443a744e4e8b83aaf139d68c31f7de0f94e63f9

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_gl.dll

MD5 295cd30c00f43d9131621baf4859578f
SHA1 cab79a6263b7b0a799461f3e6df41f815029cded
SHA256 b851c5a60cb6d1e8dd9aa161106cba99ccea047d0b39d007beaa7b9ef4a83397
SHA512 5f5c1e62e6c0e11a63fad68928765e3f504f33cdbb1d9a05cd53cbc3ed145bf3528960a10e3d57e8c83b07c030c72257f403b9a57d12975d3ef8bc255418ad6c

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_gd.dll

MD5 aea23f526ef0c5bb3d2f8fdf192a49ea
SHA1 4d7695e33ed43c3efb95f304e29675ea885b2939
SHA256 3cfe866c151a7e8a208af725c0c6f2a47fc3ada35f9ad3509b16b8d5229318b9
SHA512 412e4742ebd46ce38010b4f6a46d8d524025f929ab4658040e271d768e79115d90903403b2f1e51ab910bbdf9677b49439eb3c8afc5959477af198efb0c7c3c9

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ga.dll

MD5 5bcc643a969559317d09a9c87f53d04e
SHA1 3602d51cde97de16d8c018225a39d505c803e0fc
SHA256 b48f57e90ea9db6d6a296c01e87f8db71e47ab05ab6c2a664cfa9f52cf1d2c18
SHA512 4c65772f77e61e64d572df5b1f62733aceb02a5c967c296b303ff17c5d49831e5b7fc3d662724ae3ae1e88cd0fdcb704e838af5d4ae20f2d82b9577f57159159

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fr-CA.dll

MD5 8993c0784111fc7cd6a90a82303e5f44
SHA1 8d1ff2fed98ebc608604c555ceb46ca628afb285
SHA256 3d0ba88267018f592141ea86592757cf1ecaac1a3a18f99203e0fc5c5eacbd62
SHA512 124d16d848dc8ea0a93b292b10ce1fbad23b56b13771d904cf14c19d54478614d214441b05f6cd9e1999b8310fdd26d1c6ecae784be00aecee7e80c96ba4ac88

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fr.dll

MD5 a640aa4ff33662e06a474765df0b2a8d
SHA1 c6265225532e389e48c6057bd717b69de2125b61
SHA256 078b1943bf7f7955b90abc40f691b27e04376f8c43dd3abc4791614286cd4f23
SHA512 59791eef021f94efd9c18737d6c46fbc45add582eec92d5b997cfd66993abc7da872720a037766c3c70862f0654ccf30d122d4a5a6b305151bf8bf1c053a466d

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fil.dll

MD5 84c4736cf301b93998028ed7678caec1
SHA1 3b6f1f6b9eb3dd7d9a13c11dfd3ac56c93f1b10f
SHA256 3c8dcb7e982dac3159298009a86909b1e1000ccf6f4d333341f16d4d6fbd84ad
SHA512 5a1b77ef9450c32802e94e473a5b4e43e892c923ef368ee9bbbbb5b0090429320263cc79a4da0b281930c1a60861519211abd0bd67a9d9ee370bdda2230d2e81

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_kn.dll

MD5 e20f7a758cc9bab3d458d89d828521cc
SHA1 cae0a6d29e5b3f0aed0db2d66fe19d5463c09cfb
SHA256 92858a377f1ddc353b51bb44ec04f571ff2b4913d3c8104aa01359b72f91f2eb
SHA512 8bf9b8c6765820db6dd95303cb996b97649796e14e67b465fded3c24ef180891d58f9fdcb06243ef1d4c5cdd4148f58f64d74d2ceb2cb214051718d33efc9707

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fi.dll

MD5 5a30bc4216af48a493eeb0f3a9f02607
SHA1 2fdf65a4002d91818d56a23fb8bfd08ab715002f
SHA256 5131c23915ad6b5b469bcbff31d0ae31ef34ded28ca0ffff9f1eb998bba98aa1
SHA512 34b3a4865f31ebdb8665780011b384ada768a0f71bff77f91706b140eb8cc07fff8787f710cdb1ee14a449cae8f22ee5fddadcc501cf1c921eea078e97dc2f89

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_fa.dll

MD5 367ea715e942c81dd3cb734274969a0b
SHA1 f92f1ec2a5be9b775e67c4252a07c37ed0ca508b
SHA256 082da1c09782c026c9cd73456dc12539a226f0bf5d113e59bc93b29c1e98b37c
SHA512 c94e787ba3bdb56d1827a0477461cbba6b7cc68986722275e0d04ea7dc70db83b5d03887eec810bf9b67f70b18bd3c7b7d28f0e554938b81d3501bc11f97830a

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_eu.dll

MD5 fe73dbc305da6223d1e94e1cf548c000
SHA1 b16f2c40d68cd9718eaaa9b6db9c8e5c4b6acb9e
SHA256 1ef64088a613a4e10b4cf4206f95f5414ee27872798747234a6574b7e5c70a7d
SHA512 d9900720d89defffa52198dbe63515995095c94aa0cbbe4f32a1c09d26809cec480e92926d2240702604b8c13fcdc0032cc46910ade8e4c1d2fc9a4bd1b63858

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_et.dll

MD5 ae9bdf6416c3630c4b0b5b119308a135
SHA1 d7218c677b098d2a93cc91ead39c83d3a2c653b6
SHA256 62da90c9417a70632aa190fecc17c31ecf433c1f84f82b08d7d7290669cabf32
SHA512 4333ac6cd3737f25e6e1d429b195da781ced4340b89808cbd5d5d2aae2e79bcc700419d613123d632252e31ac44d95b7718f23da5b82ab5054407e80106a64a7

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_es-419.dll

MD5 8f7f515d78d2df371993fd70f863ab8d
SHA1 dfae1b47e80f91abf2d9c2aac009c0a1767bc59d
SHA256 ba57fbb9d3a32b84d6a76054b9ad180b6510e53206b9804bb9ea18ff73c2ae3e
SHA512 308a62af00a4410551eac967bb9f2cea7adf7c13b471dd28b276bda40b1e4c0b4ebb60aec29b6165069d40180bc45b4f5da5baddc374ce7bc5a5bb223afb4e96

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_da.dll

MD5 b0ae9aa0d5c17ee7abfc57d21cdcbae6
SHA1 01019eb6ba9c123be528136e12192b0bb33df407
SHA256 d10938919e3d28d71e8e3ba2d8e02e0f9dc2faf148cdedc21c166fd994c603e2
SHA512 4cba25c8159df865231b08fe650eedfb92d54c3037d28b2b9af010c8a59fa23669041a6c393622fe69b0194c2532f71f02b740f7e26e0bbf7ef34a421d6747b8

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_en-GB.dll

MD5 74d4cf3b8efb6cc3d0acc3eac38bd5b7
SHA1 9337803aadad9042c895b6f418b4c733b81221e0
SHA256 b83c8981d8835e4c78250bf265faa6d64693204b77764c8e349abc4365ae9871
SHA512 e6112ef60d56101aa16327042162d6ef43519bc56668ca8eaa7fd3e1aaadc75c7df75c1e41583a292ff1a9bdc7d9ad9f5c0d97fa84964532dca2d5f3df604c23

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_el.dll

MD5 a7e64339a5314e3576c0d170171fa52a
SHA1 6c12aab6c97c30aff3245b78f7a3afeea604215e
SHA256 4e9ccecb8e4383395f2134347fbad00521345ec9c857d8fa102d5257c7bea9bf
SHA512 a4ca3fb60a7f4bda50847544dd1289d750f0d4b3565929290a8392b92822ef1856cec15a1f63f2c6fe1ef2e7cc0936a35bdb38ee5d904eb08cd32f05addc6ee4

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_de.dll

MD5 ad5b530eabff0540078c5d17f27b9610
SHA1 7e53dbbf64e70e561d37669e69f50eb0da8e37d1
SHA256 49f512316a51e51027b4e70de4ffe8c8ecb188e126439a90a5d12d52a0393966
SHA512 e1cc853d96589220676d39d91d4108633ce56304640f770e7d22b97a9b3be9452d5fb94e4e7fcd1400b62f0c398da8255c53a31853194a9e7b7784982b5ff40f

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

MD5 897712b508931dab76d39b209611740c
SHA1 9d80e07c2dc744e2efce3b67aa9876949fb9edfe
SHA256 ee64fdefdb3381ce61fc445190cc44b015e7b65a3a16d28f3477f68de6079f1b
SHA512 3329e37318dd9b11f282301e453af106168d3d10beff1ed62ffdcda60c6b4edb6b9c69ac6b9bb8abce3c9a9686a0152404524012dbff025e571de2cfcb3b5d56

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_ca.dll

MD5 e90155442b28008992a7d899ca730222
SHA1 1d448e9709de0d301ded6d75caaeba4348a4793d
SHA256 6ae98b5e2eda22a0236434b7e952d732e3cd5d9cae2e51cd70222f1fd5278563
SHA512 a91d8357ca976db2eb5a081077304a50edc1b55b2775c00cfde05e03831f98bd04e43f0dba5b3efd5a6370afcb10b23bbf307412467502e9ef57e0beae636013

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bs.dll

MD5 a0a1f791984f1de2f03a36171232d18d
SHA1 71f69d8fe47640ba9705725d7d627a05519c8016
SHA256 d2c7da8f4745b81874a9666c7d10a779a9956b4de0ebdaa1647bf78d4e17d85a
SHA512 a4267911846cd55eb91227b0117ccbfdf8ef6c4ed0b8935b08e5d41a91aeabd9259988c71da8606cfb2876c4d69df6ca5a246687440283f1625105624305eb33

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bn-IN.dll

MD5 051c429fa2beec9c2842c403a86c0e7b
SHA1 0a06a45200a1f5c81c48fbd2d03549fc9fac3a58
SHA256 1a8465922bbb05a97a24f6c2200fcc7afd8bd0ace245c2eda9d9d335d4fb9353
SHA512 bb59b41804328f27ba8861af32824266ca69ddcfdaaa11551b1edd4e129dbba630da8070abedb28e180045f8d0ddc1209cd901919f6b9aa421c457188af795c6

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bn.dll

MD5 82711e45d2b0764997abc1e0678a73bb
SHA1 47908e8885c86477a6f52eea5fddb005ec5b3fa3
SHA256 2bb7455999b8f53a2a0834588ca4da4703f4da362a127d01cc6bd60ca0303799
SHA512 4b517796edc954ab7f5a26a5d6605925dc7e84b611bcf59352b3b95f719cedc72c77a465fb1e7bc2d2f422d596c97968dac5b57292c82967d5cfaff980128fc2

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_bg.dll

MD5 ecf3405e9e712d685ef1e8a5377296ea
SHA1 9872cdf450adf4257d77282a39b75822ce1c8375
SHA256 e400415638a7b7dcc28b14a257a28e93e423c396e89a02cba51623fdfbdc6b0b
SHA512 37e5f1b3bdd97a4370718dc2a46d78ab5b66865d3cdb66a20a7dc20a9d423ccde954c08f97e574fbab24e8dfa905351cbfb94bd3e6692a9b6526097ea3dc911d

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_az.dll

MD5 d3345579310f3bd080b406de47b2305f
SHA1 16aefb27ea6d81c684f041aa50ebb49fdd403d83
SHA256 b4ea3c63fa0104093a2b2034f950428e66d2cf3d55f0fc5bd688483392d60d69
SHA512 65e4aa8587bc579b5109d91e02745f6de96a23b6ac2962cdeb6d9d536b51abab12b2bbaeca72572c3ae1971dac5bd24430eb2ae5ccf44a7068427594e4afdd7a

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_as.dll

MD5 1fb14c6c4fee7bfabe41badb7c5acff8
SHA1 953d94cd73951943db14c08cce37b2d3ac821b02
SHA256 cd32339fd7e4a5959e93eb5bfd6e009e4137e15c5e6c2e861d7891487216da49
SHA512 a93b081935fbe48fafa8071a9cd593ae7b19205c70eaf48c724397019a04161460c66d6d8c6ffd872f4d52a4a7aa25ba1cba04181b9ebaca04b76d111ea588d2

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_cy.dll

MD5 29f027d2d5fd486bdc20386ace925603
SHA1 66b8605f23871b4a8302bef0aaccb36ee1e72755
SHA256 03c8566f749e8fa349d97101849bc3b2cc0b7561b565a2b0928bf8fe901da813
SHA512 3348bdf10b2d964b34b791a774e28c97d3caf28d7f90e36b948cc2cb6c21e84cda933b7ddbd51c8fc604a450361cb834322c15ddbe0f4851154d05e5a2a2ea42

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_cs.dll

MD5 1de961b662a374c3af918c18225f4364
SHA1 e8f1c438e57b322f43b4b851698bf38c129eb6ae
SHA256 bb1365c5770dacbb918af27b47b02f269504f4d2396cf3f82bf5ecb2551c5021
SHA512 c6bf62b684039f62744f1aab07f4751948e0c175f7fb7fe126f20903ce23fcdd2e284f1b794922621dae7eaa15c6dae0177ad102289a18f967721486f21073a1

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_am.dll

MD5 f624de37750fd191eb29d4de36818f8b
SHA1 b647dae9b9a3c673980afa651d73ce0a4985aae6
SHA256 e284453cd512e446fcbf9440013f8cb2348ffd6b1acec5366f2511cdf88b1794
SHA512 d1d65e29ed59e34d4ff66df11a2368f1a724730e32eb245022d4f3d1fadf16d445ba8532460afb0e6e91f8be60a7240d13577403193042d1e912a67e4bf23b1a

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\EdgeUpdate.dat

MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\msedgeupdateres_af.dll

MD5 4f860d5995ab77e6efa8f589a758c6d2
SHA1 07536839ccfd3c654ec5dc2161020f729973196d
SHA256 9841d787142dd54fea6b033bd897f05f3e617b48b051de0ee3cf5865b3393150
SHA512 0b9a661b76360f1fb2eb3ee25c6bf2cbab7ec74e2363e0af321dc4d0afb3cad301dddd16ea367d588451a40a2c2ed41f21d7afae48307e1e4a4ec5b24165b378

C:\Program Files (x86)\Microsoft\Temp\EUB287.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 205590d4fb4b1914d2853ab7a9839ccf
SHA1 d9bbf8941df5993f72ffcf46beefcfcd88694ebd
SHA256 5f82471d58b6e700248d9602ce4a0a5cda4d2e2863ef1eb9fee4effcc07f3767
SHA512 bce1447d5d3210c22d52dec3b846db091b65ed03fd9d7cd11c6c4dbd2aa5a943d881360bc033c29abd61011581ff9354b35cbe421719d92568ed99997bfbbae8

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

MD5 2bda135a2d03cb1dceef4fd105bed99d
SHA1 13a6975afb646d091603f15d3b9f9b9f97b20c4a
SHA256 134bd8f0dee7197ac97741cf5a8fa03f68b9e9e5ca8ef9c9cd40e9ef472cba8b
SHA512 4b4c0a6c3744a6e8b9c07aeaff6d8c8d80066aa885ede94f3362a4d36c60235cbcd095a8fa5b9f1aa3732349825fcfdd6e85be678a333a4ec1385164a975fde6

memory/1256-192-0x00000000008C0000-0x00000000008F5000-memory.dmp

memory/1256-193-0x0000000074880000-0x0000000074AA5000-memory.dmp

memory/1256-201-0x0000000074880000-0x0000000074AA5000-memory.dmp

C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

MD5 d00c2bf4c7f0e8633f6990caba5d9170
SHA1 16611fd692edd93c75b8c1ad374596f2dcc4d3dc
SHA256 624023d4d93a969ef0ca70593fee2e000b128db696e070a10daf4524c045eb1c
SHA512 7151d8bc01770f125be98e676dad75ba0de31126775e1f1923df193637ffcf6ae9a9e91ed91e191db8dc93a7bffdffaf7b5d4d9125af82e3e3bfbfd2b5b81234

C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Installer\setup.exe

MD5 b621cf9d3506d2cd18dc516d9570cd9c
SHA1 f90ed12727015e78f07692cbcd9e3c0999a03c3a
SHA256 64050839b4a6f27d896e1194e902a2f7a3c1cab0ef864b558ab77f1be25145d6
SHA512 167c73cf457689f8ba031015c1e411545550f602919c35aff6fd4d602bd591d34e8c12887a946902b798bf4cf98aadfce3c2de810bf16c7c24a216bfd8abec19

memory/1256-285-0x00000000008C0000-0x00000000008F5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9de46c334178475092c41f68c8f42c52
SHA1 c8c231ccbd75eb4662ac85b820eeab2d270c0901
SHA256 e374abb4476272d0984c91c50ab032817fc85e12228d73a8c3ff1b5f2c387ba1
SHA512 9ac92561b873106700d2b17bf785ef42e7f66eac0725f611f1e48bb66bcba94e0f9f7b8552a9ddef7916687f73ddad41b5a683c600147075dd50460498a96402

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 713f4fedb555c4088d933f31d6425967
SHA1 970386ea8608678e82a18cc029a519dfffbb1aa5
SHA256 bd395a399a4c1e813c675f17eac7b3bd78a6a0cf3b6bf8f4455b8344d24f11b4
SHA512 dcd2cd70809187b233ed9f0413a11324a2d20b4c0da65a3f07ed4c840439b7ba3dd1fcc7a16d282795057e14bed6fb4240ccd4eff205439818edd42284f56043

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 844fa11c4cfa1f4568ddff373e28dfe7
SHA1 71e2897af107f230116a5153829dc43114658cd6
SHA256 feb5c2610d67e3f1c1d57596a2656ce3ae3fa33cffd3169fabd27049b3edb2b8
SHA512 436ccc316315e989922852f3a241d0d341a89752f70e061995966ed64f15a38565bfc2705a5db1338e6cb0694c4badbf685c21601db45dd235ac1b8fb08bd546

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f10a38c2154c655ff96d5c3baa8d0b6e
SHA1 ea37510ad4de13a134b245f37b4190c0e3a02cfd
SHA256 9b95b0634e7cdb4982db46982f856ba07c78b29e467f54d36e1eacd47513aa57
SHA512 3a66a3b70a823c1056c178f21e6894cddcd491565dc4cd0a2f27fa270d0e287f6e973fa06f4c843c77031a616c3c5c382446e8063335ba1bd7082e3d7c7efb9e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1748aacc37dd7560c83b03cd55d67989
SHA1 a64494dedab5e9d7bd2106e1c84d7ed622d55f8b
SHA256 250117b123684edc7478d4495e99d660bbcc8e7f5a9c97c83ba392cdef166d3c
SHA512 c4580bdd3742438b82b30af7ca39253b73a44fb83f12e52a9409898d7d6962c95e68821b812159fe17810b9e541be529f099d60826a2a15b1eafce487215e756

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

MD5 cce4e9b2141c9367b3e0bc520b219a9f
SHA1 b942fda586329493f88e156545e5dfc0872e2351
SHA256 678f0ab63070749eb60e6087562d7cf3fac0923cfdea9a134b1f3d5f1c590092
SHA512 dc564843fa2932b218d628f7f63a7b8323f8d902b7b53ffa0eb61a94a7ea1e7878e2203d103eff5e3daeef954273de168e37d91e46c7b5221caa31ae2b4c620e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe596d95.TMP

MD5 8b1da12c278c2cb85891dfc5350fc34e
SHA1 51e69367b4e510348a273c8d2b1725cd156151d1
SHA256 de02a9e0a6a4953460396904399dd9494bbf2d89c9a0cfdfe9caef4873eb7361
SHA512 d1a388bc6ff3be67454c2a739a937f0bd88654994014111b7a14edcf4699ddaacc96965ce860f0f03bad72d40c48f9ceb35bcf05f7098b28006f69959cba3303

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b736f4a4-f6cc-4dce-9180-2382405792c3\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

MD5 7b7ce0b2c0e39bcba44355cc7399031e
SHA1 44f76134e6410851b581474a5c5b08cc052bab26
SHA256 8cf2ce383fe973cdb27295dc2e9dda08b071d477953e10babebd630af4128085
SHA512 b279366818dd1d0bf9da35b571eefa2ba55e6d9dbe98e017354cc635050c81666e17431c39ae4d9619f535019ee2a3e03fd8d8ec66449a5e47f8019732cd7ddf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

MD5 a98d76efa7022f79cae18f3fcc55340a
SHA1 f71fa78a4e0a4d8183906b9d66df68d50309fc66
SHA256 5fb2ecd1129df375aab5a930bba5d2c0374e48645817c4e35238110e0d6b15ea
SHA512 6207c3cc9b87a0f08a4daa03df5b965c7dd516f86939c0a36f8721945efeed90f19ac4005b56b98aba9e65ee3e18c96ff1ce792aa7541f9ed7c7d1463f1278c9

C:\Users\Admin\AppData\Local\Temp\d0a0ebab-d2cd-4391-82c8-03a6733cb481.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Temp\ddf8ee8d-1534-4683-a0b3-bd32fae709c0.tmp

MD5 da75bb05d10acc967eecaac040d3d733
SHA1 95c08e067df713af8992db113f7e9aec84f17181
SHA256 33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA512 56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

C:\Users\Admin\AppData\Local\Temp\901c276f-5e85-4acf-8167-b48b48daa9ef.tmp

MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7edd2b2dca43592f66ca0f1edd021a6a
SHA1 225f803b4c2f0634441362d751ad493fe5f5cce4
SHA256 b74bccb48f4dd9d1c6e981b0458f053db95fc15e11833c00cd28187e1d4c23ae
SHA512 ac0da168a7b0b4cdc3481aa0233313b59b11cc798021d2d3a73a7996b5be51a1c164c5797df680cf8c271f5134affd02a823b96720b62347c9b0b59da9d0298c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 1a661adf68e9b405377c30835ea50310
SHA1 f71b6747a165d0b1a6be0fc98ea71e2904816df0
SHA256 a1f1e3af06c4c1628c47e3ed5dc8f1b4a9dec1f01aa459f490a21f0a24cb8c9b
SHA512 3241e4a4c0f3f25c428fed4f1c0aa4f7eb63f5f3c1f23730834020f85ab2ea4e54949ec096c16b028aa703a52b4bbcbf22199d66e3a6bf59fe7f6a957732e0ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2cc8c0b6067817294b30a847e66cecc4
SHA1 3740ec36f5c0d383faf15c4989e60014a83a28ef
SHA256 6ebc56435717d71f8766dd28288831dd1f7d3f0fb7e57073f22bc27334f7e1fc
SHA512 a7dc92fbbd34746bd8c6883cd80da8aab2555732820e3cd3435653b0e6ddc6c81601ed025fd22097283b92f5b8e325cda9432911b01a05589074476afaaa7f5b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 994b4dd6becc8021deab964daeab7567
SHA1 dd0f1f8adebb234af58daff84fee8676a851da48
SHA256 6a661ea18f9656c7d0b661651af0db99d275092e0509ca465278bd6acbe51599
SHA512 e302a5510c293cdc1a8b438103073545e6ab692295c2d7f9f27c0552654c6c55f43b184e8b197741bfce0893334fd8a0f5b2fd21e5c518412bef9ef7d734f975

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59bb96.TMP

MD5 c65c3240093a3dc0f82b955a4bea8faa
SHA1 11b05e7dcc8bb0f542d0c2e1bc499f8e40644b6c
SHA256 8ea1942351ce2f8dc08b1569a30f2ce83365d62a8a8c6ec796bd231fbdb10a81
SHA512 e822bdb4d3739a041e18041d2c1766c6142344b40b7f15aed1fb0282b70aef232b41038f5daf0495d5ca3444275338d2a9623989468a336c6f7526bc1904429a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b736f4a4-f6cc-4dce-9180-2382405792c3\index-dir\the-real-index

MD5 05eb62043a0e8872a58de96410f4c0be
SHA1 0733e498b9c6a9aae3fad847ef76142406cdc8b2
SHA256 08f334a369933e338998bceba0b656a90595dcd3e125dd59d114261bbe96b44d
SHA512 c9d67ff3aad36a8b7f609602b12cc3dd7dd9f8fd45770298f87f0acf98657a9721cb59b03821647fd82bca85e97d1de77229388998e3c705d3348663acd78e57

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b736f4a4-f6cc-4dce-9180-2382405792c3\index-dir\the-real-index~RFe59bdd8.TMP

MD5 d24daf2cbee978b6a0d3be4587e78c7a
SHA1 4f96ff77db8cba13afa4da037fbcacffd012e748
SHA256 b10ac1387a72db8fd25b9592202b1bd9f81a729daad1cd7c5e552f92d30311cb
SHA512 f31d0be98d771473550759f9b6277b406c14748e6e258c82b6a67f740ef304e8ad9e108f290b77704fd3a733c9cb4307edda2b327b1bd6ec11e62c26c4b930ba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 fd05292edfbb15cf8024234d75cd70ae
SHA1 9cc4676b1b29d618d1f60454558b9bf243a8194e
SHA256 36567bfb1433f1b37c7a53483a7a33558b558c986ccdd6e8acb4462812f656db
SHA512 580176e3b68d622ca711a8823aad8a987bf2069ae91742e9bcbb486a6df2d7900c8232700cb7f420072d2a7e58bba67366aeec9233dec84394bf831af827ecc7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e697827f-d687-49f9-9b6f-2873a9e9ec01\index-dir\the-real-index~RFe59d7a9.TMP

MD5 29748d77e6553d735693d55a400299bc
SHA1 c3a49d6187a9dd75b5c3a57e563ea85077b81d34
SHA256 074d4ce297de739201df13f8e84c3333b17f5b22711344ef455573a21e85e322
SHA512 0c16bab719d596baff77d98e31d5e99c71d3f05543f09b08cea220d0ea75cb1c7d815ea49b6745719897642fbdd60c69b8b8fb8f5f6a0061c0aba31afd19d8d0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e697827f-d687-49f9-9b6f-2873a9e9ec01\index-dir\the-real-index

MD5 facad29d25739efb0dd73c04ae31c8b6
SHA1 d2b44f0fb95870d57447f2cfd25aaaa93c5ac083
SHA256 1511de493978472ef65dda25ab96bb39bcb4c41cb5213dc612faf561e77e2731
SHA512 fb0b600cf9ca71eb63bcc3e0c255c7625e45f2afbbfbc4544112616d5b38d0785665280dcf433621a57164a7ab9862250d8ebb1336efccecb5b0c704e091ccd7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

MD5 f7cb32a7c17fe33c6296475f65c14081
SHA1 c4352148810fbf94114df9b1287cbfbc6ebb431f
SHA256 dc1ff5829e4f7a48c0fc8f2b32e7e3be411a1423088d3c2f73f77d2468b2dc69
SHA512 fbab5e4abfad629881bc234a39831b12c7356e59aa196f524afaeb45477e714ac043c0d0f737d6c9193b2a2b929220abeec461e6a47b3bb4fdf0cbe0e44ef921

Analysis: behavioral27

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

149s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\perfh009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\PerfStringBackup.INI C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\PerfStringBackup.TMP C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\inf\WmiApRpl\WmiApRpl.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe

"C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004F8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /R /T

Network

Country Destination Domain Proto
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

C:\Windows\System32\wbem\Performance\WmiApRpl.ini

MD5 ffdeea82ba4a5a65585103dd2a922dfe
SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a

C:\Windows\System32\wbem\Performance\WmiApRpl.h

MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

C:\Windows\System32\perfc011.dat

MD5 5afbd30597a275ad6d5e98187742c01b
SHA1 4e9a82a388532a0fcb3671047504384e040b48a1
SHA256 26ee1d72642d1d79b307581e6027a259696d5e3299d9d6685153a68b8c58b61b
SHA512 6d2514d6a12809a7db4901b586b57e03b6e5b0cc4ecd1baeb4f5188ca033773f7ca077fa8e8beadcf82724fd16d9136c0fc252a0163b71a0ff0eae3363f2c0cf

C:\Windows\System32\perfh007.dat

MD5 3bd8043ff69087c78cf81f0aa082664f
SHA1 c669871201f05f6153dfa3f6a78d4609d818568e
SHA256 d1b8be34dfdff53435bcd3f176f7aa9f17aa8f1145c42edee1ed1eec9faf02b2
SHA512 a51d2bb5641aaff1ab091a1c331b6e515bb333d2dfa9f09662d35b2315e6fbd14932102167075cd8bdacf7c8f57fe7313f7b1639090070851c2ecf7662384d6d

C:\Windows\System32\perfc007.dat

MD5 6e71c59a539ba8c2d46c4c8f478edf8c
SHA1 868558341297d83b247f8be13b375541eb58b886
SHA256 4e4e1300a939cc5d58d0c6914410d5ad8eaf876571011fa1c6f0ce27bf59822d
SHA512 1a86ab970d99430334ba14cc14d75cb902f267e9e15019afcb64400ec6e4335adae3687a5916ccfec5fd0c82c89bfeeac2aed0c6aad693f35e7326f8fb158f9e

C:\Windows\System32\perfh009.dat

MD5 efeeda97e31eb12669293d78feaff451
SHA1 f3680730a9ed165f49be4a2b1be8477196f15afb
SHA256 a0ae9b96680526dd73b3469504eaeb3882c655e3f4557b9e120de1ddd8edb834
SHA512 452da0e9a2c17de87d5a0db150acf299310d684c50c4f16daa5f1c298267d76d990000a0bf4e5ffb2afe5769e74bfcdf351e8d68b933a432a9130cdcdd81f1b2

C:\Windows\System32\perfh00A.dat

MD5 ef8cce0162906b208cff1441fe71f927
SHA1 7a3f2d0dcb39698a6ec9190ea69f2ea01d76935e
SHA256 ba9df27d32c3fa43d6840146e28e5266908124efde25a4bf459d908c232a88a7
SHA512 35b3dbb9f5cd8b30aa0a26fdb29c562ae65ab9823ba477f082960a19d354a68729008e3c0cfce2f8cce66f6f5bab9fed7d6cbe62628c7a751bc4770a4560f5e8

C:\Windows\System32\perfc00A.dat

MD5 6c65a113c1d1dcbc5f7603db0134dcb7
SHA1 1eb93cc7aeb12860b63129a69b812b694748a816
SHA256 53d617778c1ba174c22b47fd2d84035aa28c58bdcab6c3f3224f3777d1d8e7ee
SHA512 67c438c141f7d6509db1d0bb17b312b66be8947a623580cc49fcb3000f7e402dda856ab1d422a68bbb25392d00902fef2bd31ce9cc491769205cdd7b31edf605

C:\Windows\System32\perfh00C.dat

MD5 f5fd5898bda4a68842ec6c6a9088adec
SHA1 f974a58b258b438e79eb4bea3ae54a91f516a10a
SHA256 e962a408ff9a789b92bc1429637cb30e00fc47bfa3b06a7fd7b22646e1f5b872
SHA512 932e551597139b85b4faecfa9156e7e98d33b5dad4bd6f4c40504ced7b032c8fed223b81f056654a75c66a8326c51b28fef102ad55d5b224722f90c778b6ed98

C:\Windows\System32\perfc00C.dat

MD5 ae40b57742832ddaf4efe6bee70ecb10
SHA1 ebc87ac614bdf44249300e73018686da5c31d7e3
SHA256 af503f9b58bc5975fc609c95c2edad09adb32c5633859516350546031e05b0ca
SHA512 6c875bfabbe94359fe36eb144a5a9828d6c9d20c5999149df0aaacc4c9be748b5b6bab4639c7ef9d7bb4886073771d7b73ea1190dac61b5220c5f852ef101e3c

C:\Windows\System32\perfh010.dat

MD5 a583c28c05f94a635bd67fee2d905a27
SHA1 a4af858c69297cb8a59cade7da6e5a36b43e7548
SHA256 c70b892d93e93c37c826ba97459e8fb724e6c5cf6dc2288613430fc59c0c1eb0
SHA512 06626f291b69e044e8e44fa46576c0287e4df434cd07b0bdb1b162fed25ddef652e5ad8d08d984f2d7d4c027c8ee032eef485f7269f0a83e11c1fa61f80a5d67

C:\Windows\System32\perfc010.dat

MD5 031bea42e7e7973aa6c0d637dce03edf
SHA1 293a7334cc55a4983a8d9b921393131463e06b7d
SHA256 1ffa15a5a579c6ce01140ce98a262db26735f5a1d3c1468c7000681d8486b91a
SHA512 d34d8400ba12461d154b50d8246a99fe9ea403160bb977a5612e8fbfbcd9636ee641e187d9a899208f7f43c60d7c6292c5fdbf7b0f61d8f5aa0339fb18dfd920

C:\Windows\System32\perfh011.dat

MD5 33cbb4d0e471fd527da2ded235fe9636
SHA1 aa9d9b062511eb38a1faf9a740f8fb709b02a7dd
SHA256 73174de99ccd45c2a8d818742ed313a55321186162005c0f2567e162954943a5
SHA512 a4c17182347bc3c5cce76562f26b27ac62e84c8589dd91d2840a452b6c593656f3d3a2fd5b7f207f32be0f5a0494bc44987fb70e6e8f3a756a0703df20baa93f

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe"

Signatures

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 928 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 928 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 928 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 928 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 3372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 3372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 1528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 4468 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2312 wrote to memory of 4468 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4000 wrote to memory of 4796 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://toxtweaks.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://toxtweaks.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd11023cb8,0x7ffd11023cc8,0x7ffd11023cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd11023cb8,0x7ffd11023cc8,0x7ffd11023cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,18418274203863478795,17633249085889777514,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,18418274203863478795,17633249085889777514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2028 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://toxtweaks.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd11023cb8,0x7ffd11023cc8,0x7ffd11023cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 toxtweaks.com udp
US 198.54.115.202:443 toxtweaks.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
GB 2.19.117.36:443 use.typekit.net tcp
GB 2.19.117.36:443 use.typekit.net tcp
GB 2.19.117.36:443 use.typekit.net tcp
GB 2.19.117.36:443 use.typekit.net tcp
US 172.67.75.106:443 embed.sellpass.io tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 104.18.17.146:443 payhip.com tcp
US 104.18.17.146:443 payhip.com tcp
US 104.18.17.146:443 payhip.com tcp
US 104.18.17.146:443 payhip.com tcp
US 104.18.17.146:443 payhip.com tcp
US 104.18.17.146:443 payhip.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
GB 142.250.200.10:443 ajax.googleapis.com tcp
GB 2.19.117.43:443 p.typekit.net tcp
GB 2.19.117.43:443 p.typekit.net tcp
GB 2.19.117.43:443 p.typekit.net tcp
GB 2.19.117.43:443 p.typekit.net tcp
US 104.19.229.21:443 hcaptcha.com tcp
US 8.8.8.8:53 146.17.18.104.in-addr.arpa udp
US 8.8.8.8:53 10.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 43.117.19.2.in-addr.arpa udp
GB 2.19.117.36:443 use.typekit.net tcp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
GB 163.70.151.21:443 connect.facebook.net tcp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
GB 163.70.151.21:443 connect.facebook.net tcp
GB 163.70.151.21:443 connect.facebook.net tcp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
BE 66.102.1.156:443 stats.g.doubleclick.net tcp
US 216.239.32.36:443 region1.analytics.google.com tcp
GB 216.58.204.67:443 www.google.co.uk tcp
GB 142.250.200.10:443 ajax.googleapis.com udp
N/A 224.0.0.251:5353 udp
N/A 127.0.0.1:8080 tcp
US 216.239.32.36:443 region1.analytics.google.com udp
US 35.190.80.1:443 a.nel.cloudflare.com udp

Files

memory/928-0-0x0000000074C2E000-0x0000000074C2F000-memory.dmp

memory/928-1-0x00000000006C0000-0x0000000002C88000-memory.dmp

memory/928-2-0x0000000074C20000-0x00000000753D1000-memory.dmp

memory/928-3-0x00000000185C0000-0x000000001A4D8000-memory.dmp

memory/928-4-0x00000000085D0000-0x0000000008B76000-memory.dmp

memory/928-5-0x00000000078A0000-0x0000000007932000-memory.dmp

memory/928-6-0x00000000077D0000-0x00000000077E2000-memory.dmp

memory/928-7-0x0000000007840000-0x000000000784A000-memory.dmp

memory/928-8-0x0000000008020000-0x0000000008234000-memory.dmp

memory/928-9-0x0000000074C20000-0x00000000753D1000-memory.dmp

memory/928-10-0x0000000074C2E000-0x0000000074C2F000-memory.dmp

memory/928-11-0x0000000074C20000-0x00000000753D1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f1d2c7fd2ca29bb77a5da2d1847fbb92
SHA1 840de2cf36c22ba10ac96f90890b6a12a56526c6
SHA256 58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5
SHA512 ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4c1a24fa898d2a98b540b20272c8e47b
SHA1 3218bff9ce95b52842fa1b8bd00be073177141ef
SHA256 bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95
SHA512 e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

\??\pipe\LOCAL\crashpad_2312_ENAHDDEFQQSHLDRI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\33473f09-166a-4155-8c88-5a6565afd171.tmp

MD5 ded656eb94a1f124c00051c01515c760
SHA1 b68f9db4e94562065fc188f76ddb9618c152edb2
SHA256 f4c8172b185b29654d99616cc52823513cf72c1564d218b1907682294f6de390
SHA512 1b208b387f2649c8f269c9c627c1851537333b569a92c612f567fef5247a214c8b628029f710450f51958be6c0e53fc26ada6c54ef820eb8f6359cd05b7f6bc7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 081e7cd2f42fdde0b0bb9b064bb38561
SHA1 bd54038a568fae09b70be9fff18bf0a0c63f4fa0
SHA256 c37ee73d92f3a1050d017ae6b72dc5df4af77c99d84aa086f78c9f70968ee6c9
SHA512 8cf4f2c5d66cd950b4f3d1f248ebb1baf6b191ebce3c156e56d6dd52daf77dc561e612355c328f8f17d48033727c478c4561435f61fa7164bccf49d5a211b9b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

MD5 675ff56eda9ae73f640fa87814e52cde
SHA1 9bd263c7df549aef43732744ea206c57cc3523b5
SHA256 ae57d8b9f66ab7515bce739bcf396038f119280c874da00f8b8e19ae57fa6655
SHA512 01018d577704e481f9e8e5d7978b271fcc7bb3faf66c6679c16e12e3814a3e849aa945e5971bdf76fc3b56ff0595778749000677c095631f5142d8bb6983e6c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 f16da84be1202d0699e048e537e091b9
SHA1 388696b703022bff832b4a1f4a7c3214aa6bd92d
SHA256 fedf77fce44d1ad7be6b23ecebcc7aac1cc402095dcb56681d98b3cfd6feabab
SHA512 406a99fe4781990744d531c46b3e0a9188ca7c815aadc0a9aa677badbd145efb0cb38a2f6e432d5aa66fb28e7af2c2a33d67383e32af7ba154e1f93ceb1f8d9e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

MD5 d55cc15b88ecb7f412069d06e16a37b6
SHA1 1a5f446dcf78fcd5fc0937a535ea86baf3a2885d
SHA256 fcf5fd94a3db59457564ec216447b292bc74067c9f2189b0b2d16746cea6f730
SHA512 1384e82e7566a801f36cf8dbea60b1b34bec6884d19126d158d1b651a20d1dcc6cb30101c72bd3cb222e9f8b22636857a78990ab7920b5b9c1c3aafc1a8f1be2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

MD5 9bde36fefc046788cbdb005c35bf27dd
SHA1 f657d48bec11fc3b8499d694ef8d14cd65181758
SHA256 0be06e07780aa24cc3e71a5ee188a2f565f0cc35848d660363f74239e22a72e4
SHA512 7343275ec09cb20a1a2a4a88a8a6497d4c407f0727d13e7b1816d071721fef01b70c61f463ceb0ab72ebf646a96453f6350f0daceddc438b9080cbe8f82b1d46

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

MD5 fc3f2aad49389f50a26bc737ffbc4038
SHA1 2e802979b3e574cf0e9f61fbda32c749515eff69
SHA256 9e3eee68a0302f3b0dfdc0e2d898cf239227f660c7e5a46246a39134193bbdb0
SHA512 9d944a745af3069b0f2f48c8ae0b5cc3f6a5efc28e7f6cbac01dcdf409b97a3cc45951dccc33150e4cee5f44410f6cbf33607fdd35555ba4e124cd47b33017e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

MD5 cb3aa59edde7be65c336ddbfc2954c20
SHA1 1f242feef06c70ad6ba15760020e3b0f6770a623
SHA256 32215603f05d79e46b5c5c97c4318f78a96402d45c27595a27432eeafac376e6
SHA512 890a275a25050556e44f7b201aa2614555f78d0a365b89064ac4e93de06733791bb92b14da7853e12039bb575cbde4ab0f82d297c62b6e59fb4a5c9d8e766aac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

MD5 b5cad4f0a11768848cd75d6c72695411
SHA1 a3e2daff00659c8a5967306512bc0cc019b6b039
SHA256 dced4293844836837e8783050635c2a5743b65649e18e42f48b75347ac06c396
SHA512 7ee5ff007ec9ac3423ba36c032e07ce0d2b3740a9407edb8e8ef8bb79b530ac9573bf20dadadddde4301842cb6ce4401e706b1252c01e99bba3bf57dac985453

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

MD5 f70baa579d763f4bc2df9911cd97f38d
SHA1 cb6ff1124c247215383843cb88bf36473aac769f
SHA256 69c6971720ae95f2ce455328db7afc3b142f1c2861abe1048a48c6efe72c1816
SHA512 2b320b07715c8326f870a649853aff109d1bc3fbd4b7e79363dcccb79a42d3ad6302e56ef95d769a3a37db7a5c606164cc2098f6d3e4354d04ba2b197dbdf775

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

MD5 87e8230a9ca3f0c5ccfa56f70276e2f2
SHA1 eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA512 37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6e86257c8aa7f49995f258310ac5f3ec
SHA1 38b802b11af21aa95bbc804d18f3e73a05b865f9
SHA256 f956e8c738779bf864222146a57dd3e62d7996116613c0ee19c8c23c8155698b
SHA512 472f6d44f621ef8192003553d57d96173fbfa8cfa479f23d859c2274eed7f6cbbe52c9b27b6e86da7f84685e6135c91af5b7d21dbb13003fc0cf1929b671706e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 693a6020f71c7f33f7bf22c73581bfdf
SHA1 630f3b00f338ddd1db73da62ef167e91fb89ad92
SHA256 6bbd1615fab1d5ea1d46029b6f7bda51cf3884534d836e85c1db44dad7768abf
SHA512 56235496fe1690a872ad3777913adb5760a49934f34e8ee5f582a1d234e15637297ff9e962b7ef3d8b875fcfa493ae278d862d37bb891014af49fe9121726542

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b3439e6f4b490d570e6078e555d8d41d
SHA1 7a2a008446763747a9361f6522b50bf757be7e38
SHA256 66ff1f92396a8a95705d8d75012c497b3a45326d83020c83595a5f4f1966344b
SHA512 92723605962ac904e104b07b2eb2583517c560fceb5d41b33560622c296f9fabecd6c1c23349189b08fbbb48485ae977135d18e12d6b5d63385a1e4ad23e53c5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 78ed463c68337cc57f3448490fcabfd2
SHA1 2299cf0933c6910cdd3704927b7bfd518272b7bc
SHA256 0aec20c0c0e5ba0acdecd64899bc0460a16e95e1998ddc18714778ddda8e3dfc
SHA512 8ddf03adf8a0bcc05f10b0750774d3da0958b80f322950baa6092f0487c49e4a5284938ec0bcd4787d2f4e069a383cd587752b03babed63a7b82b81fc02e569e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 afa125d55a150f40642d82baec12fb62
SHA1 4fcd617d4b45e3a709f09080bc47bc4a41d01af6
SHA256 b842930dc611b973927cb4a2688ecd365387cdd69c089e4779820fcbd4f30afb
SHA512 98731e3d711633318b29972ef300f892238e2d2ddff38cd9405f6fab8efb1260694667480d153c3c9dd1a2e86e9be0f9f3a9d13b94026f2cac1f3276749b033f

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\NSudoLG.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\NSudoLG.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\NSudoLG.exe"

Network

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

147s

Max time network

152s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Export.bat"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2176 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\fltMC.exe
PID 2176 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\fltMC.exe
PID 2176 wrote to memory of 4456 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\SCEWIN_64.exe
PID 2176 wrote to memory of 4456 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\SCEWIN_64.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Export.bat"

C:\Windows\system32\fltMC.exe

fltmc

C:\Users\Admin\AppData\Local\Temp\SCEWIN_64.exe

SCEWIN_64.exe /O /S nvram.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

91s

Max time network

95s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\amifldrv64.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\amifldrv64.sys

C:\Users\Admin\AppData\Local\Temp\amifldrv64.sys

C:\Users\Admin\AppData\Local\Temp\amifldrv64.sys

Network

Files

memory/3796-0-0x0000000000010000-0x0000000000017000-memory.dmp

memory/3796-1-0x0000000000010000-0x0000000000017000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241023-en

Max time kernel

146s

Max time network

152s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\amigendrv64.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\amigendrv64.sys

C:\Users\Admin\AppData\Local\Temp\amigendrv64.sys

C:\Users\Admin\AppData\Local\Temp\amigendrv64.sys

Network

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

90s

Max time network

99s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\amigendrv64.sys"

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\amigendrv64.sys"

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\amigendrv64.sys

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\amigendrv64.sys"

Network

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

87s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe"

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000067\00000000 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\ C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000066\00000000 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29} C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\ C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LocationInformation C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ClassGuid C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000067\00000000 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ContainerID C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000064\00000000 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29} C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LocationInformation C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000065\00000000 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ClassGUID C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29} C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\ C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ClassGuid C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067\ C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\ C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ContainerID C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Control C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Control C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\ C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000064\00000000 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Driver C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000065\00000000 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ClassGUID C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\DevManView.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:01

Platform

win11-20241023-en

Max time kernel

145s

Max time network

159s

Command Line

powershell start shell:AppsFolder\Microsoft.UI.Xaml.2.8_8wekyb3d8bbwe!

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell start shell:AppsFolder\Microsoft.UI.Xaml.2.8_8wekyb3d8bbwe!

Network

Country Destination Domain Proto
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp

Files

memory/240-0-0x00007FF834CF3000-0x00007FF834CF5000-memory.dmp

memory/240-1-0x00007FF834CF0000-0x00007FF8357B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vkaghu1s.zxy.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/240-10-0x000002AD366F0000-0x000002AD36712000-memory.dmp

memory/240-11-0x00007FF834CF0000-0x00007FF8357B2000-memory.dmp

memory/240-12-0x00007FF834CF0000-0x00007FF8357B2000-memory.dmp

memory/240-14-0x00007FF834CF0000-0x00007FF8357B2000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

147s

Max time network

151s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Import.bat"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3472 wrote to memory of 4692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\fltMC.exe
PID 3472 wrote to memory of 4692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\fltMC.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Import.bat"

C:\Windows\system32\fltMC.exe

fltmc

Network

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

92s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SCEWIN_64.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SCEWIN_64.exe

"C:\Users\Admin\AppData\Local\Temp\SCEWIN_64.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

150s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\SetACL.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\SetACL.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\SetACL.exe"

Network

Country Destination Domain Proto
N/A 192.229.221.95:80 tcp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241023-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\bfsvc.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\bfsvc.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\bfsvc.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CRU\reset-all.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CRU\reset-all.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CRU\reset-all.exe

"C:\Users\Admin\AppData\Local\Temp\CRU\reset-all.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\openshell.exe"

Signatures

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Open-Shell\StartMenu.exe N/A
N/A N/A N/A N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}" C:\Windows\System32\MsiExec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}" C:\Windows\syswow64\MsiExec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}" C:\Windows\System32\MsiExec.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Open-Shell Start Menu = "\"C:\\Program Files\\Open-Shell\\StartMenu.exe\" -autorun" C:\Windows\system32\msiexec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\msiexec.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{449D0D6E-2412-4E61-B68F-1CB625CD9E52} C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{449D0D6E-2412-4E61-B68F-1CB625CD9E52} C:\Windows\System32\MsiExec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\StartMenuHelper32.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\StartMenuHelper64.dll C:\Windows\system32\msiexec.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Open-Shell\Start Screen.lnk~RFe57fc71.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Classic Skin.skin C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Windows 8.skin C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\PolicyDefinitions.zip C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Smoked Glass.skin C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Start Menu Settings.lnk C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Classic Skin.skin7 C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\OpenShellReadme.rtf C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Midnight.skin7 C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Update.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\ExplorerL10N.ini C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Metro.skin C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\DesktopToasts.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Metallic.skin7 C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\ClassicExplorer64.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\StartMenu.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Start Menu Settings.lnk~RFe57fc52.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\~tart Screen.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\ClassicExplorer32.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\ClassicExplorerSettings.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\OpenShell.chm C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\StartMenuL10N.ini C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Windows Basic.skin C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\Open-Shell\Start Screen.lnk C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Full Glass.skin C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Immersive.skin7 C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Windows 8.skin7 C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\Open-Shell\Start Menu Settings.lnk C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\Open-Shell\~tart Menu Settings.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Start Screen.lnk~RFe57fc52.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Metro.skin7 C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\StartMenuHelperL10N.ini C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\~tart Menu Settings.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files\Open-Shell\~tart Screen.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Windows Aero.skin C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\StartMenuDLL.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Windows XP Luna.skin C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Start Screen.lnk C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Start Screen.lnk~RFe57fc61.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Immersive.skin C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Open-Shell\Skins\Windows Aero.skin7 C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\{72CFBE38-4ACE-4D41-81FA-B01D8C4FD590}\icon.ico C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFE8FAEAB577495FC1.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{72CFBE38-4ACE-4D41-81FA-B01D8C4FD590} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF32853D491E25A252.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFA36C9BB8F5255424.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e57fa1f.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{72CFBE38-4ACE-4D41-81FA-B01D8C4FD590}\icon.ico C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e57fa21.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIFAEA.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{72CFBE38-4ACE-4D41-81FA-B01D8C4FD590}\StartScreen.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF551609769A431F72.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{72CFBE38-4ACE-4D41-81FA-B01D8C4FD590}\StartScreen.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e57fa1f.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\openshell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msiexec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\DllHost.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000097e32746e391c5270000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000097e327460000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090097e32746000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d97e32746000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000097e3274600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar C:\Windows\syswow64\MsiExec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{553891B7-A0D5-4526-BE18-D3CE461D6310} C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar C:\Windows\System32\MsiExec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{553891B7-A0D5-4526-BE18-D3CE461D6310} C:\Windows\System32\MsiExec.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}\VersionIndependentProgID\ = "ClassicExplorer.ShareOverlay" C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}\TypeLib\ = "{BF8D124A-A4E0-402F-8152-4EF377E62586}" C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\StartMenuHelper.DLL\AppID = "{62D2FBE4-89F7-48A5-A35F-DA2B8A3C54B7}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ab14324-c087-42c1-b905-a0bfdb4e9532}\InprocServer32 C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3214FBB-3CA1-406A-B3E8-3EB7C393A15E} C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82e749ed-b971-4550-baf7-06aa2bf7e836}\ShellEx\ContextMenuHandlers\Default C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E00B97F-A4D4-4062-98E4-4F66FC96F32F}\TypeLib\ = "{BF8D124A-A4E0-402F-8152-4EF377E62586}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ClassicExplorer.ShareOverlay\CLSID\ = "{594D4122-1F87-41E2-96C7-825FB4796516}" C:\Windows\System32\MsiExec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83EBFC27ECA414D418AF0BD1C8F45D09\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ClassicExplorer.ShareOverlay\CurVer C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ClassicExplorer.ExplorerBHO.1\ = "ExplorerBHO Class" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{553891B7-A0D5-4526-BE18-D3CE461D6310}\Programmable C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ClassicExplorer.ShareOverlay.1\CLSID\ = "{594D4122-1F87-41E2-96C7-825FB4796516}" C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ab14324-c087-42c1-b905-a0bfdb4e9532}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\syswow64\MsiExec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83EBFC27ECA414D418AF0BD1C8F45D09\Language = "1033" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C83ACB1-75C3-45D2-882C-EFA32333491C}\TypeLib\ = "{BF8D124A-A4E0-402F-8152-4EF377E62586}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{449D0D6E-2412-4E61-B68F-1CB625CD9E52}\TypeLib\ = "{BF8D124A-A4E0-402F-8152-4EF377E62586}" C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E595F05F-903F-4318-8B0A-7F633B520D2B}\ = "StartMenuExt" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8C83ACB1-75C3-45D2-882C-EFA32333491C} C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{449D0D6E-2412-4E61-B68F-1CB625CD9E52}\ProgID\ = "ClassicExplorer.ExplorerBHO.1" C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{553891B7-A0D5-4526-BE18-D3CE461D6310}\TypeLib C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ClassicExplorer.ExplorerBHO C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{553891B7-A0D5-4526-BE18-D3CE461D6310}\ProgID C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{553891B7-A0D5-4526-BE18-D3CE461D6310}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF8D124A-A4E0-402F-8152-4EF377E62586}\1.0\HELPDIR C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BC4C1B8F-0BDE-4E42-9583-E072B2A28E0D}\TypeLib\Version = "1.0" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{553891B7-A0D5-4526-BE18-D3CE461D6310} C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82e749ed-b971-4550-baf7-06aa2bf7e836} C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E407B70A-1FBD-4D5E-8822-231C69102472}\LocalServer32\ = "\"C:\\Program Files\\Open-Shell\\Update.exe\" -ToastActivated" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{553891B7-A0D5-4526-BE18-D3CE461D6310}\VersionIndependentProgID\ = "ClassicExplorer.ExplorerBand" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC4C1B8F-0BDE-4E42-9583-E072B2A28E0D}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83EBFC27ECA414D418AF0BD1C8F45D09\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ClassicExplorer.ExplorerBHO.1\CLSID C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF8D124A-A4E0-402F-8152-4EF377E62586}\1.0\FLAGS\ = "0" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E595F05F-903F-4318-8B0A-7F633B520D2B}\InprocServer32\ = "C:\\Windows\\SysWow64\\StartMenuHelper32.dll" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\83EBFC27ECA414D418AF0BD1C8F45D09 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E00B97F-A4D4-4062-98E4-4F66FC96F32F}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ClassicExplorer.ExplorerBand.1\CLSID C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{553891B7-A0D5-4526-BE18-D3CE461D6310}\VersionIndependentProgID C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2576496C-B58A-4995-8878-8B68F9E8D1FC}\TypeLib\ = "{BF8D124A-A4E0-402F-8152-4EF377E62586}" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2576496C-B58A-4995-8878-8B68F9E8D1FC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{449D0D6E-2412-4E61-B68F-1CB625CD9E52}\Programmable C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ClassicExplorer.ExplorerBand\CLSID\ = "{553891B7-A0D5-4526-BE18-D3CE461D6310}" C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ClassicExplorer.ExplorerBHO\CurVer C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{449D0D6E-2412-4E61-B68F-1CB625CD9E52}\ = "ExplorerBHO Class" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E595F05F-903F-4318-8B0A-7F633B520D2B}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt C:\Windows\System32\MsiExec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82e749ed-b971-4550-baf7-06aa2bf7e836}\ShellFolder\Attributes = "2684354560" C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}\ = "ShareOverlay Class" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\ClassicCopyExt\ = "{8C83ACB1-75C3-45D2-882C-EFA32333491C}" C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2576496C-B58A-4995-8878-8B68F9E8D1FC}\ProxyStubClsid32 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}\TypeLib\ = "{BF8D124A-A4E0-402F-8152-4EF377E62586}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ClassicExplorer.ExplorerBHO\CLSID C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8C83ACB1-75C3-45D2-882C-EFA32333491C}\ProgID C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ab14324-c087-42c1-b905-a0bfdb4e9532}\ShellEx\MayChangeDefaultMenu\ C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECD4FC4D-521C-11D0-B792-00A0C90312E1}\TreatAs\ = "{D3214FBB-3CA1-406a-B3E8-3EB7C393A15E}" C:\Windows\System32\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{449D0D6E-2412-4E61-B68F-1CB625CD9E52}\InprocServer32 C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC4C1B8F-0BDE-4E42-9583-E072B2A28E0D}\TypeLib\ = "{BF8D124A-A4E0-402F-8152-4EF377E62586}" C:\Windows\syswow64\MsiExec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{553891B7-A0D5-4526-BE18-D3CE461D6310}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} C:\Windows\syswow64\MsiExec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\ClassicCopyExt C:\Windows\System32\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF8D124A-A4E0-402F-8152-4EF377E62586}\1.0\HELPDIR\ = "C:\\Program Files\\Open-Shell" C:\Windows\syswow64\MsiExec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E00B97F-A4D4-4062-98E4-4F66FC96F32F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\syswow64\MsiExec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\MsiExec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\MsiExec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Open-Shell\StartMenu.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\openshell.exe C:\Windows\SysWOW64\msiexec.exe
PID 2672 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\openshell.exe C:\Windows\SysWOW64\msiexec.exe
PID 2672 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\openshell.exe C:\Windows\SysWOW64\msiexec.exe
PID 2964 wrote to memory of 2552 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 2964 wrote to memory of 2552 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 2964 wrote to memory of 4528 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2964 wrote to memory of 4528 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2964 wrote to memory of 4528 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2964 wrote to memory of 2968 N/A C:\Windows\system32\msiexec.exe C:\Windows\System32\MsiExec.exe
PID 2964 wrote to memory of 2968 N/A C:\Windows\system32\msiexec.exe C:\Windows\System32\MsiExec.exe
PID 2964 wrote to memory of 1576 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2964 wrote to memory of 1576 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2964 wrote to memory of 1576 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2964 wrote to memory of 4652 N/A C:\Windows\system32\msiexec.exe C:\Windows\System32\MsiExec.exe
PID 2964 wrote to memory of 4652 N/A C:\Windows\system32\msiexec.exe C:\Windows\System32\MsiExec.exe
PID 2964 wrote to memory of 2708 N/A C:\Windows\system32\msiexec.exe C:\Program Files\Open-Shell\StartMenu.exe
PID 2964 wrote to memory of 2708 N/A C:\Windows\system32\msiexec.exe C:\Program Files\Open-Shell\StartMenu.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\openshell.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\openshell.exe"

C:\Windows\SysWOW64\msiexec.exe

msiexec.exe /i "C:\ProgramData\OpenShellSetup64_4_4_190.msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\Open-Shell\ClassicExplorer32.dll"

C:\Windows\System32\MsiExec.exe

"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Open-Shell\ClassicExplorer64.dll"

C:\Windows\syswow64\MsiExec.exe

"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\StartMenuHelper32.dll"

C:\Windows\System32\MsiExec.exe

"C:\Windows\System32\MsiExec.exe" /Y "C:\Windows\system32\StartMenuHelper64.dll"

C:\Program Files\Open-Shell\StartMenu.exe

"C:\Program Files\Open-Shell\StartMenu.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}

Network

Files

C:\ProgramData\OpenShellSetup64_4_4_190.msi

MD5 971e810ca9478a41252ff920520f108a
SHA1 5d0919ba92d0983afa4754c1659f5db619c84f1a
SHA256 7a22d669ffdd65e71c15f517af6c8013931a61e6da67b5642604fef61038e85e
SHA512 4c7b8a396ad3eea6f7294add7d2696240fe40910d166e59f51611cbd020430a675fb266256c09f95728fc7db563430ebc6c5d7c0d10bf8942c8406aeaf85d931

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Update.lnk~RFe57fbf4.TMP

MD5 2e8d7601da2c712845b0a619623236d0
SHA1 ce61d9972004df2734a4ce0e04b575f626b74a06
SHA256 d8adb9fe6ef74affbc2abddbaa6d5400cf5f74df2d402eaa465a7f79ec05d75a
SHA512 b45d8fe822ec60bf2e91648424e105f267ca54de9a2855289f8d0f7c5a0d15a192a3ab7c293b2aa0131cf69c517465fceea5c8a8afffef54928f34cb66c7daae

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Update.lnk

MD5 3834ad08c1a6b29c8d936a5dc4cd7b05
SHA1 fa37c192bf8c91a56ac552134c59d5e36c7418b5
SHA256 205e91ed199eddb1d4d9019f1627d3af222f6c0fe25315a78c4009ad7104a15d
SHA512 93373574080c7b98b2b593180b4f4ed4b8ca2fb40e175b601a206d9190c7cbdd3ddadaee255feef10357e6a781b47ac8bf90f1976e45308b546db96ccd82147e

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Update.lnk

MD5 a028ddf0e146f0688204cffd0045e094
SHA1 e41751da4bb3bcb45698e9e91ad9acb417b0b7ae
SHA256 009cde3813240f22eb47821b27e5b87e52f58b4b54c439a128784c29bf0da653
SHA512 b9aff4c0ebf6f3c35894ee46b9bbb110acc03faa7bfd5f4e05375c251dd4c9961b9194406819a837ea0311a669f4608a1eed32856449a3abad2e2a02c9cbf110

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Classic Explorer Settings.lnk~RFe57fc32.TMP

MD5 1e46fc6993bc30e59779d8defc41993b
SHA1 1a6ef1c1600d2154261bd83dfa7816b76d493037
SHA256 8ae9d0ee7884564160f5fea841276e180888f59c9e2f6a2233bf3d7ae4c44b78
SHA512 3293e02928aea6c15dd295606a62e9e67e0818cea9bc0edff61019e6e39f2e444724d58286440ea0adf1a4f346fa2807bddfaa1a0fe435299b613e0e513b2020

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\~lassic Explorer Settings.tmp

MD5 4861c64735506e5e2f3a5f42fd9799ef
SHA1 f0266194a9575b2d2130ba6d71d41ef6e1e8413b
SHA256 5340d65c9b67531d5a4e90d234da33c409f8842477ea47fcc9e4ae04881e8e68
SHA512 43572c72a82e570dfb55cc5a60cf27655aac02502a2d65f1c6e794dd152e7331c26e0e10904595d13887e1922ad9987b3b4c6138908cf1ff1de032d9a03c23bd

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Menu Settings.lnk~RFe57fc42.TMP

MD5 f0309195576983f1a4fa09560ff0802b
SHA1 f1b6f1e2fb8f4f092c4603b5ec352802da1eaf4d
SHA256 ee82805563dc448be0b00ab94b5c2b5d32a4016c1887e2ae4e9d5acf9268b029
SHA512 9fdf3a62cca05cff4fc830cfe6bf2f2a629ec36bdb5c92d4eb4ab3bf2c125cc1abad6b81d8ed6367f69b31d4732bb665c3867d13b3bd38912f2de9eb13d06e25

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Menu Settings.lnk

MD5 5d5c28deba7c8bfba062fe68f00090d6
SHA1 f9062f7cb4180c0a4796695b216b3380c0b136ff
SHA256 af6538484093c0cd2e5521bdc516400806a888afbcf82ace8a482b93d5d7265c
SHA512 7ec10beeb1de9bf71f96a94869b403a2cba4a4def6cf785fc146e190aab2698cf6a8b48636147c13f469192efaa8524b98c635572f23bbd9d05a9200ac1695c3

C:\Program Files\Open-Shell\StartMenu.exe

MD5 6f7907b4b6e7332fdc29835198fe98d4
SHA1 4c7447137678209a1acbe58ef91db60f706e2b50
SHA256 08f505b325a67b61eb997cd45d61fb04851b6e6477110739a7cfc1ef5d290fae
SHA512 030f3b80f320005a27cab243573a704a46ed6cc342b2f9aef128511f132b9e1ffcf3759c44fe6252e045ce6368376cfddca5a8fab07664d9ea89acc9666e48b2

C:\Program Files\Open-Shell\Start Menu Settings.lnk~RFe57fc52.TMP

MD5 011c61cee2c0116002f87d2947921379
SHA1 3d71959a7003aa87f5b8bac6d9e834729793a531
SHA256 48e2e6aac16e91fbe4398117d1cbd70453beb9f76e4bec48ad4b8b00a541d483
SHA512 c34b163e9fa332f091a2627f70c5f9d47383f328dc6d5198de32e2e4412847e874938d37a036372a97190692d5c39d26d5d0081fd4f596fb1ddfd228935cec9c

C:\Program Files\Open-Shell\Start Menu Settings.lnk

MD5 9ff8d9f5ff227d88c315b1cb039e11f4
SHA1 8b6949cf642f2fb4d81954b6b1e8d381aba03681
SHA256 50c2f6f5db017b37ca6723686c7ec179dddff386da8997b2d052f2d331f620fe
SHA512 143fbeda526bb827bf5b86eb29b79aaccc41d9a5977c13e647306831aa3b704d7d979ac1f99278017e83f88c6994ad106aa938b559c4c40ea595bd18a1f2f7af

C:\Program Files\Open-Shell\Start Screen.lnk

MD5 9ad98868b08f5e5d2d246925b94b9597
SHA1 c013f49ccf5dbebca809d22912e138629e53fa1f
SHA256 aef790d9a3965418cd943c8d7659254ebde36a873ae26edd4498227753d49823
SHA512 3c94bd00f13b19b62162487d14f0ae143b7d6b7fe775ae469ad8001cae743ed14fdb04d2307d005b5098e50a722bf4101270892cf4e5e3213e06db5808154038

C:\Program Files\Open-Shell\Start Screen.lnk~RFe57fc52.TMP

MD5 ad4181d7679e67532c0c14217c874c4c
SHA1 831c8c2052a94cea1b039f1fc31f8baa1d32d849
SHA256 e082f4570256edc5c29a71195ff563fb9540edd137e15816666ecc3bd73c3b12
SHA512 0216c6f34011253c385179dcd901d05f57bb9dff841f76313cd2fb8bbcd431b83618409608737e7325e131e023cb019b152cfec0d870db53c6202b796247a744

C:\Program Files\Open-Shell\Start Screen.lnk

MD5 24d4501d9dba54cd2379ba838586a72a
SHA1 1ed50051d23d199afbaabf60d14934dd59e7a55c
SHA256 32caee90aebba381dd7fac40330ac8e571a229a3895791160b26f6f3e0d49df3
SHA512 f987c1e1dbb024a7e25a0157276e00ee11d65e79994571a24a19a7528c00f670f096f5bdd8cc39081e0e5ba3f338b501b74046ec1929b30f482cba18481fa246

C:\Program Files\Open-Shell\Start Screen.lnk

MD5 a50994ee7bbb23ac9a476e20b452836b
SHA1 27e9c84e5c924a777ae5b120ce0c338b7b1ac0f2
SHA256 52fc2bf080040b906f9a4b40bd22ed8e139359e42174c1785f013871851de019
SHA512 cae4ca12bcd3c908bf7d8537f743f322bca8b9765860381507238e511c7b9bff43c1399a6dca4f5d0d4f2b015cff23be8b6402b69659ee9989786a4782da8fbb

C:\Program Files\Open-Shell\ClassicExplorer32.dll

MD5 4e8857fb490c01a686095785bbef5896
SHA1 975dd96ce38ad1ec0b25decf4c8d36d583a9f02a
SHA256 ba769f3ac5d06433babf0c260f9e6178834ebdad5bbd43bcdabe5ca3ea140d77
SHA512 e23bcc3809fa35a99aabf1fef54faeeaff491e5e7afa0e1a69c5ff2ee95fac02d6111fda6831964edae6b3cadaf17553a9cb4e1a0fa39e942e303b264f2c0f66

C:\Program Files\Open-Shell\ExplorerL10N.ini

MD5 6ed13b9c1719b252e735ba7e33280e67
SHA1 f3753deab4d99dbee4821a8a70fe6e978e1a45f6
SHA256 b351158059f3d94c112863defad9063c5cdb81dea0b47530809ef4d8de4b68ab
SHA512 f529034e5853624f7bcce9a7ab93c205ec8fd1c671009e0a0b767f3268525ec2b91e75eeda2eb5f9f4c58a6d713b56e09a23aefd52d4b51eadd1fcef2c016afc

C:\Program Files\Open-Shell\ClassicExplorer64.dll

MD5 e668a04a52acc169c16717d4b1184f17
SHA1 1f6e4293c919bddc9e3cfa324724a07f309e95e0
SHA256 9c52a38e89a954d9e200fcd3a8b29fa92dd0239945902b817732e45c3a216f1f
SHA512 5f09aabc536b593c043b32a7d2400cbcd4e9b8e5346c116ff58337a30c6b8704e91551fbae57d3afdc32e14446c39f85ef4d2839fed9b6ab6c9fc0fa453ac720

C:\Windows\SysWOW64\StartMenuHelper32.dll

MD5 4bb413dd44c6cb51d04095d45c7ff040
SHA1 8048d8c2c012a7d967f9201b5be51221b0ed0afa
SHA256 4677b065ed62539047f893f96691ae07570b1ac7c2172c6705c053ba6f75a277
SHA512 9d4344dbde6ad8a8fab66c494ce13f8cf3b79b312a65f71c559093179a95c155586ed532fc3d8c34363bd0aea53236e3a2552371230c3c57071eab493a77572f

C:\Program Files\Open-Shell\StartMenuHelperL10N.ini

MD5 29221f620ea6b5893add15dd6c307684
SHA1 97c31bb9585a0896e1fcea8efa3f05ff16823da2
SHA256 53cafbc10e671b2885775dc7d7b66e93156a4fb661aee95e03c2dd74ea99fa84
SHA512 b4c98f1352d7f8c60eb785b1849673bfa880242fe3daceb2bf9e69ec7ddd6c707df905c7b18b2888d87ba47a36f967761c8ff69d8082ebbf5dbf3a21aba55f42

C:\Windows\System32\StartMenuHelper64.dll

MD5 efb282fe9c98bfac6480575a211b02ff
SHA1 0b0a2e34f00c985a0574c47ff0c950f5e9db3f40
SHA256 84782c13c8d9fc68c2e86c204c2be99b846e39824096f64dd06b578841467d65
SHA512 7180ea2ccb5cd47398a009903450c9b4370bda4c73ddd5c11e4be5f6e0756e0466770df2ca82a1d5b78b619a90ffd17a88e15a9a5d073c3b5e97be9226c5b994

C:\Config.Msi\e57fa20.rbs

MD5 f36eb96628f1ba54dedc34d5f5648dcb
SHA1 9747dc8ec6c5266db2681ed3b7a041e4988396b2
SHA256 aa0a59364983f6b7f5bfb02feaa374af6f6517b5b39e8a2d8fdfe183177de655
SHA512 7a2dd3bdb36affc8c7ccb5017b820948f643859e25e89e0cac4723dc8adae2e88909419ce48c41d279ea1a706a89bf7f0007ccb16a8f7572a4905922322d3ec1

C:\Program Files\Open-Shell\StartMenuDLL.dll

MD5 1a4b83094fa595506d8d33663edfd64b
SHA1 49956cacdec572f5311a23fcc9499a63943df0b9
SHA256 3a2898c5a1c71c42a95583ccd2ad72e30f43d815b3da3452b3d245ba5c0aa1e5
SHA512 ac48376c9085976eff72702136a94ff66c53ca58624b00557e39ed1accc4de074c9f7fed877f030b4936dde41faa627920a9b7332dd721adc38871778f08f6b3

C:\Program Files\Open-Shell\StartMenuL10N.ini

MD5 673bb428b6d3fab8cba07890cad09d0e
SHA1 45039820289bdb485bb761e9b267f6de9e18a26c
SHA256 ff4ba6dc92215a59e2d84e2ec489bb5cdc3b3799f08d83a0b27639117e25ce33
SHA512 2da16a2be769290f457b471155b6da838ce089c85a8d0fdd8c65b58a20212eb719893a16cbcb9510f01c6a10eb23c7b53e396f97445cb802a39b9c8ed4f0962e

\??\Volume{4627e397-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ba5c64ac-94a0-406c-9d52-92ab82c340d5}_OnDiskSnapshotProp

MD5 72d7187019a10ec7abbc644b6f84c9bc
SHA1 7f6b79906d304dce52510a2e654f7ab40e0d043f
SHA256 e528e1522270804a5e5d948217fcac95d4372224bc49b24d0103e18f00dada85
SHA512 5886b024309e92382244cff00cc7e2cd2daf0c65180604984222c4138802de49b5155d4b90226f3cb61314825c111c90a6fa6b4e32899cc2da00ab9c0a50fcc2

\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

MD5 294519130546a80466ff3c0e2a5946f5
SHA1 b8cb2ce5f8f1f88dad6f5b23e0e04a7e3e281fca
SHA256 885d1fb6a6ad0f7e9fca4398f98701b7fb7a51643bb6abde6ca705d0f7d30cda
SHA512 daae8e17ce6dea907713d50218bc3a5bf37c0dbf216b4f9db44b396531ad2dfcce948e3435a18f97d6fa266c39d814d28b3815609e548fcc04bbd54705c0178e

Analysis: behavioral31

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

149s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\procexp.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\Drivers\PROCEXP152.SYS C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\procexp.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\procexp64.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\procexp.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\procexp.exe"

C:\Users\Admin\AppData\Local\Temp\procexp64.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\procexp.exe"

Network

Country Destination Domain Proto
US 172.64.149.23:80 crl.trust-provider.com tcp
US 172.64.149.23:80 crl.trust-provider.com tcp
GB 23.194.11.2:80 www.intel.com tcp
GB 2.19.117.94:80 certificates.intel.com tcp
US 8.8.8.8:53 94.117.19.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\procexp64.exe

MD5 29da4e6b4b4325651fd4e1a87d333b22
SHA1 d3dc46078a137f17c50887ff6f17be40dab20626
SHA256 77358157efbf4572c2d7f17a1a264990843307f802d20bad4fb2442245d65f0b
SHA512 12f3d75d8b0f2d32a06d8e52eef1364dd219ada8fcaeda997d68a792413744cb5d66b2cf7aabe6bf9e56f54f348680b8101ec04353842ef0b08887f6eb6b4b66

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\Emu\KeyAuthEmulator.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\Emu\KeyAuthEmulator.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\Emu\KeyAuthEmulator.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

146s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.UI.Xaml.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.UI.Xaml.dll,#1

Network

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe"

Signatures

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe"

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe" /P:590310

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe" /P:590310

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.exe" /TI/ /P:590310

Network

Files

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\PowerRun.ini

MD5 48369a4319816579ca01c957f4ba70cc
SHA1 f93e76bc3ae9083c37ba34cf9e866b229dce34f3
SHA256 bd838b6574bd31c7cb218be76a30cb9b0e049f32eaccd61e399c12ff07a12b49
SHA512 04ea2a4d46a63e069e3ee9485caf840c59c135553134e6f984c22ee122ba7c89f625ef6662f4e03c59dd4bf02d0f9e3613785b9247aa99642b8324efdccec3f4

C:\Users\Admin\AppData\Local\Temp\tnspqdu

MD5 0b1607979373b4ed50c6d0b89eb157ab
SHA1 7c2f77f58d5cfbbddd572cef7e23d537567a7942
SHA256 1c80f750068ed4ca51348b189016113559a740215c4ff6593156fd5225272690
SHA512 3f6641421e8902432da2bedde2c870b3ed02a9f1e0ecbef78d66c968712817cdce37b6f4b74d666bb061933842e8ad62c5491ba44a38b3052296c74004dd9c56

C:\Windows\Temp\autCCC6.tmp

MD5 1ae3520c92409d09b2596b55abcd1429
SHA1 89dcc61c00aa4244e166653dc31092350d868a66
SHA256 e0fe5cc20fc6257d8373a36cb2c87f4bd6ec9a97961ed0f795e48958e477fe78
SHA512 c8626cfd2b6ac659af8e627f08e32051e39ed06875ffb71acca6014ac104ac60c1b0de1cf397fa16146734eb3e5cfce4ae3b75843742ec89577330d6235d0845

Analysis: behavioral26

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CRU\restart.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\perfh011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\PerfStringBackup.TMP C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00A.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh007.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfh00C.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc009.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc010.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\system32\perfc011.dat C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\system32\PerfStringBackup.INI C:\Windows\system32\wbem\WMIADAP.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\inf\WmiApRpl\WmiApRpl.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.ini C:\Windows\system32\wbem\WMIADAP.EXE N/A
File created C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A
File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h C:\Windows\system32\wbem\WMIADAP.EXE N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CRU\restart.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2944 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart.exe C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe
PID 2944 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\CRU\restart.exe C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\CRU\restart.exe

"C:\Users\Admin\AppData\Local\Temp\CRU\restart.exe"

C:\Users\Admin\AppData\Local\Temp\CRU\restart64.exe

restart64.exe

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService

C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /R /T

Network

Files

C:\Windows\System32\wbem\Performance\WmiApRpl.ini

MD5 ffdeea82ba4a5a65585103dd2a922dfe
SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a

C:\Windows\System32\wbem\Performance\WmiApRpl.h

MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

C:\Windows\System32\perfc011.dat

MD5 5afbd30597a275ad6d5e98187742c01b
SHA1 4e9a82a388532a0fcb3671047504384e040b48a1
SHA256 26ee1d72642d1d79b307581e6027a259696d5e3299d9d6685153a68b8c58b61b
SHA512 6d2514d6a12809a7db4901b586b57e03b6e5b0cc4ecd1baeb4f5188ca033773f7ca077fa8e8beadcf82724fd16d9136c0fc252a0163b71a0ff0eae3363f2c0cf

C:\Windows\System32\perfh007.dat

MD5 3bd8043ff69087c78cf81f0aa082664f
SHA1 c669871201f05f6153dfa3f6a78d4609d818568e
SHA256 d1b8be34dfdff53435bcd3f176f7aa9f17aa8f1145c42edee1ed1eec9faf02b2
SHA512 a51d2bb5641aaff1ab091a1c331b6e515bb333d2dfa9f09662d35b2315e6fbd14932102167075cd8bdacf7c8f57fe7313f7b1639090070851c2ecf7662384d6d

C:\Windows\System32\perfc007.dat

MD5 6e71c59a539ba8c2d46c4c8f478edf8c
SHA1 868558341297d83b247f8be13b375541eb58b886
SHA256 4e4e1300a939cc5d58d0c6914410d5ad8eaf876571011fa1c6f0ce27bf59822d
SHA512 1a86ab970d99430334ba14cc14d75cb902f267e9e15019afcb64400ec6e4335adae3687a5916ccfec5fd0c82c89bfeeac2aed0c6aad693f35e7326f8fb158f9e

C:\Windows\System32\perfh009.dat

MD5 efeeda97e31eb12669293d78feaff451
SHA1 f3680730a9ed165f49be4a2b1be8477196f15afb
SHA256 a0ae9b96680526dd73b3469504eaeb3882c655e3f4557b9e120de1ddd8edb834
SHA512 452da0e9a2c17de87d5a0db150acf299310d684c50c4f16daa5f1c298267d76d990000a0bf4e5ffb2afe5769e74bfcdf351e8d68b933a432a9130cdcdd81f1b2

C:\Windows\System32\perfh00A.dat

MD5 89960dfe2687d730daf52de34d2eb15c
SHA1 12f26da7ede572765e1b26cd08753ed39cc62ca6
SHA256 26ff30f2296fe28893dbfae42c4a702f7c8935d04ff4a42fb96fc8a92c6f2e5d
SHA512 e9d6a576b8aa1eaefd4afff6ee417b0ba6aa58f8b133afe32738e23255bada5c163e2287ff1cef03fe1645088dcd4c2bd6b3bd2364772eec447554bf2072edb2

C:\Windows\System32\perfh00C.dat

MD5 4fa344b5f9b3efdf965f7d9f32abd9ee
SHA1 dd884d88f8b0310147a08f66b253d4bec8727c0f
SHA256 f7aed0dbe8b5a73416dca6b1cd1024ba31244bbabebe79a90edcda383cb8399d
SHA512 1a952aae612a9f72c252b870d121a0c9d52e66e509214ae03f560abacd6a02cc62e39c03753b25e017bdd65905b99f9f67e4e67bb49355dde9b45708324ddb33

C:\Windows\System32\perfc00C.dat

MD5 ae40b57742832ddaf4efe6bee70ecb10
SHA1 ebc87ac614bdf44249300e73018686da5c31d7e3
SHA256 af503f9b58bc5975fc609c95c2edad09adb32c5633859516350546031e05b0ca
SHA512 6c875bfabbe94359fe36eb144a5a9828d6c9d20c5999149df0aaacc4c9be748b5b6bab4639c7ef9d7bb4886073771d7b73ea1190dac61b5220c5f852ef101e3c

C:\Windows\System32\perfc00A.dat

MD5 6c65a113c1d1dcbc5f7603db0134dcb7
SHA1 1eb93cc7aeb12860b63129a69b812b694748a816
SHA256 53d617778c1ba174c22b47fd2d84035aa28c58bdcab6c3f3224f3777d1d8e7ee
SHA512 67c438c141f7d6509db1d0bb17b312b66be8947a623580cc49fcb3000f7e402dda856ab1d422a68bbb25392d00902fef2bd31ce9cc491769205cdd7b31edf605

C:\Windows\System32\perfh010.dat

MD5 a583c28c05f94a635bd67fee2d905a27
SHA1 a4af858c69297cb8a59cade7da6e5a36b43e7548
SHA256 c70b892d93e93c37c826ba97459e8fb724e6c5cf6dc2288613430fc59c0c1eb0
SHA512 06626f291b69e044e8e44fa46576c0287e4df434cd07b0bdb1b162fed25ddef652e5ad8d08d984f2d7d4c027c8ee032eef485f7269f0a83e11c1fa61f80a5d67

C:\Windows\System32\perfh011.dat

MD5 33cbb4d0e471fd527da2ded235fe9636
SHA1 aa9d9b062511eb38a1faf9a740f8fb709b02a7dd
SHA256 73174de99ccd45c2a8d818742ed313a55321186162005c0f2567e162954943a5
SHA512 a4c17182347bc3c5cce76562f26b27ac62e84c8589dd91d2840a452b6c593656f3d3a2fd5b7f207f32be0f5a0494bc44987fb70e6e8f3a756a0703df20baa93f

C:\Windows\System32\perfc010.dat

MD5 856012ea58e361f0f04f88e6fa29ae3a
SHA1 8866aca13626d450eb65b12a86fde1cf2ff6d94d
SHA256 ba0f96d41b93fc7eeda6bf74a24291d50281ea66c6c1af140c7c527911b2aff9
SHA512 8cc8831ef97f0e51dbf17c8f2c2fb74ef82f157fb1735fe1e76b35333d71bcd279394bdc249286a376281f4f5830a7bf92b405ac3dbb0762e84a0780526e9887

Analysis: behavioral21

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

87s

Max time network

93s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\amifldrv64.sys"

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\amifldrv64.sys"

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\amifldrv64.sys

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\amifldrv64.sys"

Network

Files

memory/3108-0-0x0000000000010000-0x0000000000017000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

92s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\Emu\KeyAuthEmulator.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\Emu\KeyAuthEmulator.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\Emu\KeyAuthEmulator.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

91s

Max time network

94s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.UI.Xaml.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.UI.Xaml.dll,#1

Network

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

88s

Max time network

93s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\SCEWIN_64.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\SCEWIN_64.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\SCEWIN_64.exe"

Network

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\VC_redist.x64.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\{E32AF2A4-DD70-47F3-BD4F-9764BBD2AC4C}\.cr\VC_redist.x64.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Temp\{E32AF2A4-DD70-47F3-BD4F-9764BBD2AC4C}\.cr\VC_redist.x64.exe N/A

Checks installed software on the system

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\VC_redist.x64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\{E32AF2A4-DD70-47F3-BD4F-9764BBD2AC4C}\.cr\VC_redist.x64.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\VC_redist.x64.exe

"C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\VC_redist.x64.exe"

C:\Windows\Temp\{E32AF2A4-DD70-47F3-BD4F-9764BBD2AC4C}\.cr\VC_redist.x64.exe

"C:\Windows\Temp\{E32AF2A4-DD70-47F3-BD4F-9764BBD2AC4C}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\tox tweaking\niggers\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=560

Network

Files

C:\Windows\Temp\{E32AF2A4-DD70-47F3-BD4F-9764BBD2AC4C}\.cr\VC_redist.x64.exe

MD5 b73be38096eddc4d427fbbfdd8cf15bd
SHA1 534f605fd43cc7089e448e5fa1b1a2d56de14779
SHA256 ab1164dcaf6c7d7d4905881f332a7b6f854be46e36b860c44d9eedc96ab6607a
SHA512 5af779926d344bc7c4140725f90cddad5eb778f5ca4856d5a31a6084424964d205638815eab4454e0ea34ea56fafca19fadd1eb2779dc6b7f277e4e4ce4b1603

C:\Windows\Temp\{01984AFD-9B2B-4FB2-BAA1-47612ED754FC}\.ba\wixstdba.dll

MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

C:\Windows\Temp\{01984AFD-9B2B-4FB2-BAA1-47612ED754FC}\.ba\logo.png

MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Analysis: behavioral24

Detonation Overview

Submitted

2024-11-08 14:57

Reported

2024-11-08 15:00

Platform

win11-20241007-en

Max time kernel

90s

Max time network

93s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CRU\CRU.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CRU\CRU.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CRU\CRU.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CRU\CRU.exe

"C:\Users\Admin\AppData\Local\Temp\CRU\CRU.exe"

Network

Files

memory/2536-0-0x0000000000C80000-0x0000000000C81000-memory.dmp

memory/2536-1-0x0000000000400000-0x0000000000552000-memory.dmp