dcrat | 7fd1dd60ec001addf3f66143d962dc393c68c00761257adbdc95bced6f4d684c

Analysis

max time kernel
1049s
max time network
1057s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-11-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fatality(ez cracked).exe
Size

2.6MB
MD5

56622002384049e2d2a6b70511c5e614
SHA1

8b1edded9e65ea88c555cd3d17a297f78e8862c4
SHA256

7fd1dd60ec001addf3f66143d962dc393c68c00761257adbdc95bced6f4d684c
SHA512

f4aa66667b578c510b99b6a464976fa6d0655f89165554f7fee4dfa4d03874007319ceb57316c73ac46c5d07961a9c198dd5866bfb6956d92895e91b54a68c7d
SSDEEP

49152:JbA3TLHcQogOnBJi/2Kw+gkKh2KXQ10fCB4h70ZE5v91aLAsOfM+JJ5tRTJUHt:JbK0gOn6/2Kw+gkKgmQ17Ba0Z8v91aLz

Score

10^/10

dcrat credential_access defense_evasion discovery infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	1304	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	1304	schtasks.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\MsintoNet\BrokerMonitor.exe	dcrat
behavioral1/memory/2844-22-0x0000000000F50000-0x000000000118A000-memory.dmp	dcrat

Drops file in Drivers directory 64 IoCs

Processes:

conhost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\NDKPerf.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\portcfg.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\WindowsTrustedRTProxy.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\processr.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\wof.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\hwpolicy.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\msiscsi.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\msisadrv.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\ndproxy.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\nvmedisk.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\IPMIDRV.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\http.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\winnat.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\spaceparser.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\qwavedrv.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\hidbatt.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\intelppm.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\isapnp.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\mssmbios.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\rhproxy.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\vwififlt.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\afunix.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mshidumdf.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\null.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\scmbus.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\Ucx01000.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\msgpiowin32.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\asyncmac.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mouclass.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\mausbip.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\xboxgip.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\nvdimm.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\mrxsmb.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\mskssrv.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\USBSTOR.SYS	conhost.exe
File opened for modification	C:\Windows\System32\drivers\rassstp.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mouhid.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\bthenum.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\mslldp.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\NdisImPlatform.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\npsvctrig.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\parport.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\bthmodem.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\netio.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\PEAuth.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\TsUsbGD.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\mup.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\ufxsynopsys.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mountmgr.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ndiscap.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\volmgr.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\PosCx.dll	conhost.exe
File opened for modification	C:\Windows\System32\drivers\hidir.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\pdc.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\tpm.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\UevAgentDriver.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\usbser.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\usbport.sys.mui	conhost.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\sdstor.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\tsusbhub.sys.mui	conhost.exe
File opened for modification	C:\Windows\System32\drivers\BtaMPM.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\kbldfltr.sys	conhost.exe
File opened for modification	C:\Windows\System32\drivers\WUDFRd.sys	conhost.exe

Manipulates Digital Signatures 4 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

Processes:

conhost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\wintrust.dll	conhost.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll	conhost.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	conhost.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	conhost.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Deletes itself 1 IoCs

Processes:

conhost.exe

pid process

4916 conhost.exe
Executes dropped EXE 4 IoCs

Processes:

BrokerMonitor.execonhost.execonhost.execonhost.exe

pid process

2844 BrokerMonitor.exe
4916 conhost.exe
1476 conhost.exe
4872 conhost.exe

pid	process
4916	conhost.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

Processes:

conhost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\OAlerts.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Application.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Security.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Device Management.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Driver Watchdog.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Key Management Service.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Internet Explorer.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Audit.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Audit.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Security.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Restricted.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Diagnostic.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageManagement%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\HardwareEvents.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-VDRVROOT%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	conhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	conhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 40 IoCs

Processes:

conhost.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.22000.1_none_30aefaa78211b646\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themeb_31bf3856ad364e35_10.0.22000.1_none_2d19446aa9bbed99\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.22000.348_none_5e9c11248df37d0b\f\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonprograms_31bf3856ad364e35_10.0.22000.1_none_a4d2399e2ef2be0c\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.22000.348_none_5e9c11248df37d0b\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.22000.348_none_5e9c11248df37d0b\r\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.22000.1_none_ad443680f74b3fb3\desktop.ini	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.22000.348_none_d5c2f424027f1f86\f\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.22000.348_none_5e9c11248df37d0b\f\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.22000.1_none_7a47cb5c18eed439\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.22000.1_none_425ab98abe32f108\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.22000.348_none_d5c2f424027f1f86\f\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themea_31bf3856ad364e35_10.0.22000.1_none_2d195b32a9bbd3f8\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.22000.1_none_c15b80aa83c606f8\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.22000.1_none_d8c36377b4a5396d\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.22000.1_none_ab5b9bd8136d6a0f\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themed_31bf3856ad364e35_10.0.22000.1_none_2d1916daa9bc20db\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.22000.1_none_f4c93628f8665e8e\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.22000.1_none_eb60fb76c15c81dc\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.22000.1_none_4967740657087a96\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.22000.1_none_d695fba48209fefe\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-maintenanceuser_31bf3856ad364e35_10.0.22000.1_none_5c4b3db25aa82850\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.22000.1_none_da2961292c6298e1\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.22000.1_none_5e882f2798e1d266\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.22000.1_none_cf5a34ed394a500a\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_10.0.22000.1_none_d4b0de3f8c6d0020\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.22000.1_none_3289a7001344c6bd\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.22000.348_none_d5c2f424027f1f86\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.22000.1_none_6d5619d8ba52aa97\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.22000.1_none_a514e307ccfabd4f\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-publiclibraries_31bf3856ad364e35_10.0.22000.1_none_6c2c3d6bec34b2ca\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.22000.1_none_b98817a80d8613cb\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.22000.1_none_b4ddd1a2a1f02731\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themec_31bf3856ad364e35_10.0.22000.1_none_2d192da2a9bc073a\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-programfiles_31bf3856ad364e35_10.0.22000.1_none_6bdf1ccd370e3a39\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.22000.348_none_d5c2f424027f1f86\r\Desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.22000.1_none_9741789b0187fcd2\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.22000.1_none_486cc349b51d4319\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.22000.1_none_5253db794fd19bbe\desktop.ini	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.22000.1_none_76ef4b64e8508b21\Desktop.ini	conhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 pastebin.com
2 pastebin.com

flow	ioc
1	pastebin.com
2	pastebin.com

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

conhost.exe

description	ioc	process
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	conhost.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_10.0.22000.1_none_d85560fac0cc6c41\autorun.inf	conhost.exe

Drops file in System32 directory 64 IoCs

Processes:

conhost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\buttonconverter.inf_amd64_aa65ff63b69c215a\buttonconverter.inf	conhost.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\microsoft_bluetooth_hfp_ag.inf_loc	conhost.exe
File opened for modification	C:\Windows\System32\de-DE\FaceCredentialProvider.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\es-ES\SetNetworkLocationFlyout.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\it-IT\appinfo.dll.mui	conhost.exe
File opened for modification	C:\Windows\SysWOW64\en-US\miutils.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\cmbatt.inf_amd64_e8ce031773d264db\CmBatt.sys	conhost.exe
File opened for modification	C:\Windows\System32\it-IT\WSDScDrv.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\tr-TR\mlang.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\uk-UA\DeviceSetupStatusProvider.dll.mui	conhost.exe
File opened for modification	C:\Windows\SysWOW64\netsh.exe	conhost.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\VpnClientPSProvider.Format.ps1xml	conhost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nvdimm.inf_amd64_ccd884280893585c\nvdimm.inf	conhost.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\nettcpip.inf_loc	conhost.exe
File opened for modification	C:\Windows\System32\es-ES\fdeploy.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\es-ES\xmlfilter.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\fr-FR\chgport.exe.mui	conhost.exe
File opened for modification	C:\Windows\System32\it-IT\AppReadiness.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\ja-jp\uDWM.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\KBDHU1.DLL	conhost.exe
File opened for modification	C:\Windows\SysWOW64\fltLib.dll	conhost.exe
File opened for modification	C:\Windows\SysWOW64\WwanFeatureTests.xml	conhost.exe
File opened for modification	C:\Windows\SysWOW64\zh-TW\quickassist.exe.mui	conhost.exe
File opened for modification	C:\Windows\System32\ja-jp\Windows.Devices.SmartCards.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetLbfo\MSFT_NetLbfoTeamNic.format.ps1xml	conhost.exe
File opened for modification	C:\Windows\System32\Dism\es-ES\DismProv.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\1394.inf_amd64_1321f5d3cb2d9ef4\1394ohci.sys	conhost.exe
File opened for modification	C:\Windows\System32\en-US\scavengeui.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\fr-FR\mmsys.cpl.mui	conhost.exe
File opened for modification	C:\Windows\System32\ja-jp\winsockhc.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\Speech_OneCore\Engines\TTS\MSTTSEngine_OneCore.dll	conhost.exe
File opened for modification	C:\Windows\System32\Com\comempty.dat	conhost.exe
File opened for modification	C:\Windows\System32\en-US\msftedit.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\en-US\Windows.Internal.SecurityMitigationsBroker.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\fr-FR\fcon.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\th-TH\fms.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\wbem\WinsatUninstall.mof	conhost.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PKI\pki.types.ps1xml	conhost.exe
File opened for modification	C:\Windows\SysWOW64\CertPolEng.dll	conhost.exe
File opened for modification	C:\Windows\System32\SharedPCCSP.dll	conhost.exe
File opened for modification	C:\Windows\System32\usermgrcli.dll	conhost.exe
File opened for modification	C:\Windows\System32\WindowsUpdateImportant.ico	conhost.exe
File opened for modification	C:\Windows\System32\de-DE\fc.exe.mui	conhost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_69e8e0efb212ba16\ntprint.cat	conhost.exe
File opened for modification	C:\Windows\System32\it-IT\WiFiNetworkManager.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\uk-UA\cmlua.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmatm2k.inf_amd64_211fc32686a6c451\mdmatm2k.inf	conhost.exe
File opened for modification	C:\Windows\System32\en-US\sharemediacpl.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\Hydrogen\BakedPlugins\Physics\presetbodyqualitydebristrianglewelded.hbakedbodyquality	conhost.exe
File opened for modification	C:\Windows\System32\wbem\wsp_health.mof	conhost.exe
File opened for modification	C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\license.rtf	conhost.exe
File opened for modification	C:\Windows\System32\KBDSL1.DLL	conhost.exe
File opened for modification	C:\Windows\System32\PerceptionDevice.dll	conhost.exe
File opened for modification	C:\Windows\SysWOW64\Windows.Internal.Devices.Sensors.dll	conhost.exe
File opened for modification	C:\Windows\System32\SearchIndexerCore.dll	conhost.exe
File opened for modification	C:\Windows\System32\WMADMOD.DLL	conhost.exe
File opened for modification	C:\Windows\System32\Dism\it-IT\TransmogProvider.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\msaatext.dll	conhost.exe
File opened for modification	C:\Windows\System32\ShellCommonCommonProxyStub.dll	conhost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xusb22.inf_amd64_014a7240a2fa8453\xusb22.inf	conhost.exe
File opened for modification	C:\Windows\System32\fr-FR\reg.exe.mui	conhost.exe
File opened for modification	C:\Windows\System32\wbem\wfascim.mof	conhost.exe
File opened for modification	C:\Windows\System32\es-ES\CloudIdSvc.dll.mui	conhost.exe
File opened for modification	C:\Windows\System32\es-ES\diskraid.exe.mui	conhost.exe

Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol
T1021.001

Processes:

conhost.exe

description ioc process

File opened for modification C:\Windows\System32\termsrv.dll conhost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\termsrv.dll	conhost.exe

Drops file in Program Files directory 64 IoCs

Processes:

conhost.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-black\CameraAppList.targetsize-64_altform-unplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\ComboBox\VirtualizedComboBox.js	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DetailsList\ShimmeredDetailsList.base.js	conhost.exe
File opened for modification	C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateSquare150x150Logo.scale-400.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-150_contrast-white.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-400.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-125.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-48_altform-lightunplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\SplashScreen.scale-200.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-48_altform-unplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\DocumentCard.styles.js	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\warn\warnMutuallyExclusive.js	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreBadgeLogo.scale-200.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-lightunplated_contrast-white.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-125_contrast-white.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare150x150Logo.scale-125.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSquare70x70Logo.scale-180.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-150.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.targetsize-20.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-lightunplated_contrast-white.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\customizations\mergeSettings.js	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-72_altform-unplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Numerics.Vectors.WindowsRuntime.dll	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-80.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PeopleWideTile.scale-125.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-80_altform-unplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-125_contrast-white.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-black\CameraAppList.targetsize-40.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalApp\HighlightedTextControl.xaml	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\fonts\createFontStyles.js	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarBadge.scale-125.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\NoiseAsset_256X256_PNG.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.targetsize-80.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-256.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\Classic\Spider.Medium.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.targetsize-20_altform-unplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-125_contrast-black.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-unplated_contrast-black.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\compat\Button.js	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleStoreLogo.scale-200.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-32_altform-lightunplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-40_altform-unplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_altform-lightunplated_contrast-black.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\DateTimeUtilities.js	conhost.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlx.rll	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Icons\StickyNotesSmallTile.scale-100_altform-colorful_theme-light.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-20.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-125_contrast-black.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsBadgeLogo.scale-100.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-200.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_contrast-white.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-400.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Xbox_AppList.scale-100_altform-lightunplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-40_altform-lightunplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\Classic\TriPeaks.Large.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-32_altform-lightunplated.png	conhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-125.png	conhost.exe

Drops file in Windows directory 64 IoCs

Processes:

conhost.exe

description	ioc	process
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-ActiveDirectory-DS-LDS-Tools-FoD-Package~31bf3856ad364e35~amd64~pt-BR~10.0.22000.434.cat	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-Editions-EnterpriseNEval-Package~31bf3856ad364e35~amd64~sr-Latn-RS~10.0.22000.493.cat	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-Help-ClientUA-CoreCountrySpecific-Package~31bf3856ad364e35~amd64~fr-CA~10.0.22000.469.mum	conhost.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-PhotoBasic-PictureTools-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wsp-health.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_1a5367653c44a822\wsp_health.mfl	conhost.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\73e011c62d276cb496efde93fc745da6dc10b1988903e4bea8a54c1e0428bcb2.cat	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-Editions-Professional-Package~31bf3856ad364e35~amd64~zh-TW~10.0.22000.493.cat	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..ult-coren.resources_31bf3856ad364e35_10.0.22000.493_ar-sa_be245a12a1f2477b.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-u..aml-phone.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_e7f6bd9f13e1319b\Windows.UI.Xaml.Phone.dll.mui	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.22000.1_es-es_0754ba47ae7cc55d\ntvdm64.dll.mui	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.visualbasic.compatibility_b03f5f7f11d50a3a_4.0.15806.0_none_486b363680617174\Microsoft.VisualBasic.Compatibility.dll	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-g..shell-exe.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_398b7c7cecc3687b.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-u..assdriver.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_82bd029c8469e8f3.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.22000.1_en-us_65c329dc958282cd.manifest	conhost.exe
File opened for modification	C:\Windows\Fonts\jsmalle.fon	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-WindowsAppCompat-Package~31bf3856ad364e35~amd64~nb-NO~10.0.22000.282.cat	conhost.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0010~31bf3856ad364e35~amd64~en-US~10.0.22000.1.mum	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.22000.176_none_fded9bd0d2f09976\core.js	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.22000.469_none_fdfb724cd2e5c0ff\appObjectFactory.js	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft.windows.p..ell.consolesettings_31bf3856ad364e35_10.0.22000.1_none_d381af1b96665e09.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_rhproxy.inf_31bf3856ad364e35_10.0.22000.1_none_5f764c34f65fe432\rhproxy.inf	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.376_none_fbeabbf57111df0a\r\vfpapi.dll	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.22000.1_it-it_b7b5f50a969cc021\wmiutils.dll.mui	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-c..lter-html.resources_31bf3856ad364e35_7.0.22000.1_ja-jp_afc1ecedb807372b.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-hvsi-policy.resources_31bf3856ad364e35_10.0.22000.1_en-us_a2dede936c0e7580.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_system.runtime.dura..nstancing.resources_31bf3856ad364e35_4.0.15806.0_it-it_7a0ce20dd39af2b8.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-0000081a_31bf3856ad364e35_10.0.22000.1_none_5d27af438faee742\KBDYCL.DLL	conhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.22000.1_none_ca8b72bbd453db4c\TapiMigPlugin.dll	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.22000.1_none_049039c25c6cceaa\SxsMigPlugin.dll	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..input-adm.resources_31bf3856ad364e35_10.0.22000.1_de-de_8dad91fb3ce76cbc\TouchInput.adml	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_gameport.inf.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_6c3adeba5d408d2b.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit.resources_31bf3856ad364e35_10.0.22000.1_it-it_910a98aa763274a8\eudcedit.exe.mui	conhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-expand_31bf3856ad364e35_10.0.22000.1_none_b90ac474910a4673\expand.exe	conhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_80b1e6e78643569b\Microsoft.Windows.ApplicationServer.Applications.dll.mui	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-Lxss-Optional-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.348.cat	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-kdscli.resources_31bf3856ad364e35_10.0.22000.1_es-es_0c51a4f7b4d1a7da\KdsCli.dll.mui	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..rver-apis.resources_31bf3856ad364e35_10.0.22000.1_uk-ua_df9c6f8bd5e2a68f\smbwmiv2.dll.mui	conhost.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$_microsoft.net_framework64_v4.0.30319_config_a8a4d687ea5b766f.cdf-ms	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-OneCore-Wer-merged-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.348.mum	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-LanguageFeatures-Basic-rw-rw-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.22000.348.mum	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\f\Square71x71Logo.contrast-white_scale-150.png	conhost.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Presentation-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-dot3svc_31bf3856ad364e35_10.0.22000.65_none_4d8054ea8f7652cc\f\WiredNetworkCSP.dll	conhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.22000.1_none_19ec4b0d58c2755e\wbemprox.dll	conhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\1041\CvtResUI.dll	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a.manifest	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.22000.348_uk-ua_e8c3f47220e5344e.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.22000.1_none_15aeaaf4fb8fca09.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.22000.1_en-us_f2f733abe61309ed.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-g..shell-exe.resources_31bf3856ad364e35_10.0.22000.1_en-us_a15d53ec2e2b226f.manifest	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ehandlers.resources_31bf3856ad364e35_10.0.22000.282_sl-si_4c20044d7fa4f11d\f\MusUpdateHandlers.dll.mui	conhost.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-Compute-API-Package~31bf3856ad364e35~amd64~~10.0.22000.469.cat	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.22000.1_es-es_b297ae129328b56e\403-11.htm	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-d..ctshow-dv.resources_31bf3856ad364e35_10.0.22000.1_es-es_6e54a1adb5a91659.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-refs-v1-mof_31bf3856ad364e35_10.0.22000.1_none_908e7ec3e1a01bab.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-winhstb.resources_31bf3856ad364e35_10.0.22000.1_en-us_289e754632a72314.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_modemcsa.inf.resources_31bf3856ad364e35_10.0.22000.1_en-us_7d4bee1660c61730.manifest	conhost.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\CellularToast.scale-150.png	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..entsnapin.resources_31bf3856ad364e35_10.0.22000.1_es-es_cd5308d9f40eb51f\compmgmt.msc	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-enterprise-license_31bf3856ad364e35_10.0.22000.120_none_3c27141672890720\r\Enterprise-Volume-CSVLK-6-ul-store-rtm.xrm-ms	conhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_vhdmp.inf.resources_31bf3856ad364e35_10.0.22000.1_en-us_40ac20d8bdbd0646.manifest	conhost.exe
File opened for modification	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c.manifest	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-l..layserver.resources_31bf3856ad364e35_10.0.22000.1_es-es_b4c2aa4f882b7666\LanguageOverlayServer.dll.mui	conhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_518c740df132d17d\f\tar.exe	conhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.exefatality(ez cracked).exeWScript.exeWScript.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fatality(ez cracked).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

fatality(ez cracked).exeBrokerMonitor.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	fatality(ez cracked).exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	BrokerMonitor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
3048	schtasks.exe
1352	schtasks.exe
2652	schtasks.exe
4932	schtasks.exe
3164	schtasks.exe
1792	schtasks.exe
2336	schtasks.exe
2576	schtasks.exe
2124	schtasks.exe
3132	schtasks.exe
2096	schtasks.exe
884	schtasks.exe
3432	schtasks.exe
2532	schtasks.exe
4744	schtasks.exe
2536	schtasks.exe
1208	schtasks.exe
4620	schtasks.exe
4640	schtasks.exe
3704	schtasks.exe
4228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

BrokerMonitor.execonhost.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
2844	BrokerMonitor.exe
2844	BrokerMonitor.exe
2844	BrokerMonitor.exe
2844	BrokerMonitor.exe
2844	BrokerMonitor.exe
2844	BrokerMonitor.exe
2844	BrokerMonitor.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
1444	msedge.exe
1444	msedge.exe
3304	msedge.exe
3304	msedge.exe
2052	identity_helper.exe
2052	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

conhost.exe

pid process

4916 conhost.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

3304 msedge.exe
3304 msedge.exe
3304 msedge.exe
3304 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

BrokerMonitor.execonhost.exe

description pid process

Token: SeDebugPrivilege 2844 BrokerMonitor.exe
Token: SeDebugPrivilege 4916 conhost.exe

pid	process
4916	conhost.exe

description	pid	process
Token: SeDebugPrivilege	2844	BrokerMonitor.exe
Token: SeDebugPrivilege	4916	conhost.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

fatality(ez cracked).execmd.exeWScript.execmd.exeBrokerMonitor.execmd.execonhost.exemsedge.exe

description	pid	process	target process
PID 984 wrote to memory of 4616	984	fatality(ez cracked).exe	WScript.exe
PID 984 wrote to memory of 4616	984	fatality(ez cracked).exe	WScript.exe
PID 984 wrote to memory of 4616	984	fatality(ez cracked).exe	WScript.exe
PID 984 wrote to memory of 4820	984	fatality(ez cracked).exe	WScript.exe
PID 984 wrote to memory of 4820	984	fatality(ez cracked).exe	WScript.exe
PID 984 wrote to memory of 4820	984	fatality(ez cracked).exe	WScript.exe
PID 984 wrote to memory of 4392	984	fatality(ez cracked).exe	cmd.exe
PID 984 wrote to memory of 4392	984	fatality(ez cracked).exe	cmd.exe
PID 984 wrote to memory of 4392	984	fatality(ez cracked).exe	cmd.exe
PID 4392 wrote to memory of 1884	4392	cmd.exe	cmd.exe
PID 4392 wrote to memory of 1884	4392	cmd.exe	cmd.exe
PID 4392 wrote to memory of 1884	4392	cmd.exe	cmd.exe
PID 4616 wrote to memory of 3960	4616	WScript.exe	cmd.exe
PID 4616 wrote to memory of 3960	4616	WScript.exe	cmd.exe
PID 4616 wrote to memory of 3960	4616	WScript.exe	cmd.exe
PID 3960 wrote to memory of 2844	3960	cmd.exe	BrokerMonitor.exe
PID 3960 wrote to memory of 2844	3960	cmd.exe	BrokerMonitor.exe
PID 2844 wrote to memory of 4296	2844	BrokerMonitor.exe	cmd.exe
PID 2844 wrote to memory of 4296	2844	BrokerMonitor.exe	cmd.exe
PID 4296 wrote to memory of 4732	4296	cmd.exe	w32tm.exe
PID 4296 wrote to memory of 4732	4296	cmd.exe	w32tm.exe
PID 4296 wrote to memory of 4916	4296	cmd.exe	conhost.exe
PID 4296 wrote to memory of 4916	4296	cmd.exe	conhost.exe
PID 4916 wrote to memory of 3304	4916	conhost.exe	msedge.exe
PID 4916 wrote to memory of 3304	4916	conhost.exe	msedge.exe
PID 3304 wrote to memory of 2840	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 2840	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe
PID 3304 wrote to memory of 4464	3304	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fatality(ez cracked).exe
"C:\Users\Admin\AppData\Local\Temp\fatality(ez cracked).exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsintoNet\nHRdjr.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\MsintoNet\mIOQQzlA02ZU24pF0jGuEQEycJkgNN.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\MsintoNet\BrokerMonitor.exe
      "C:\MsintoNet\BrokerMonitor.exe"
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fV7HDFIPeQ.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4296
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4732
      - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\conhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\conhost.exe"
        6⤵
        Drops file in Drivers directory
        Manipulates Digital Signatures
        Deletes itself
        Executes dropped EXE
        Indicator Removal: Clear Windows Event Logs
        Drops desktop.ini file(s)
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies termsrv.dll
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pornhub.com/
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb5dd83cb8,0x7ffb5dd83cc8,0x7ffb5dd83cd8
        8⤵
        
        PID:2840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,12958918633961969945,18126500234379581226,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
        8⤵
        
        PID:4464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,12958918633961969945,18126500234379581226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,12958918633961969945,18126500234379581226,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
        8⤵
        
        PID:4552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12958918633961969945,18126500234379581226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
        8⤵
        
        PID:3976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12958918633961969945,18126500234379581226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
        8⤵
        
        PID:1156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12958918633961969945,18126500234379581226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
        8⤵
        
        PID:3860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,12958918633961969945,18126500234379581226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
        8⤵
        
        PID:4808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,12958918633961969945,18126500234379581226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2052
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsintoNet\file.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\MsintoNet\nrQ99sdYMIej7R1eVOn.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "echo Cheat broken. Reinstall"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\MsintoNet\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MsintoNet\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\MsintoNet\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 13 /tr "'C:\MsintoNet\SearchHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\MsintoNet\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 13 /tr "'C:\MsintoNet\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MsintoNet\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MsintoNet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MsintoNet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MsintoNet\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MsintoNet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MsintoNet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Windows\Globalization\Sorting\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Windows\Globalization\Sorting\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4740

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\conhost.exe
"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\conhost.exe"
1⤵
- Executes dropped EXE
PID:1476

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\conhost.exe
"C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\conhost.exe"
1⤵
- Executes dropped EXE
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MsintoNet\886983d96e3d3e

Filesize
737B

MD5
f984b4ab2968ee1b9153c5cc48507b63

SHA1
1284339fd1f36944f99ef3a62de3f6e89822c252

SHA256
e4a5a56f8c314b4024ca9b65a97f18dac09b5579aa7072101af70ff90b2975f7

SHA512
3bb2687b9eac72ef55bec891c246bab6446c35b4ee38ea70ccb4a80adbdf47bd8eb9035656717852b66dddbb17a41dd91e0801131093a7f41db0ce7a1fbf3d1c

Download Submit
C:\MsintoNet\BrokerMonitor.exe

Filesize
2.2MB

MD5
5dad48abf6a08af9901b21354338aa30

SHA1
8e0b275979fcb32c5bae5fa477a377d107d3667f

SHA256
6baabc2e0b5cd8b060225d61eb62cad086fafa50a6137cee4329ebf6546ec3bd

SHA512
e7bb25f4c7b2c2586138af9d732d8cfebe2eb9f8c07c3dab8aad464f9967f06b7e36fbe4db65659a506783904056fc8424121a3c14b7189994d65da57c9270d8

Download Submit
C:\MsintoNet\c5b4cb5e9653cc

Filesize
660B

MD5
88c71de1bf4197b8ad4c46df3f258937

SHA1
77670d15936bda47f9e41cadd4ea0755f7539fd6

SHA256
c59c371a9e3b0b8746cbe1747641a1406d42e85a9499c591f14c8407eca775b4

SHA512
a36ac9121414a68ce8a9a2134dcea72337825740721ffe6a4103c3098c949aacb19f8c18cf1bcd8973dd32aab453737d6efe8040b080127f0ff74ca4edba726c

Download Submit
C:\MsintoNet\cfa885d449487c

Filesize
694B

MD5
441e9a29a05827fe3a9bfe7c6aa65469

SHA1
7d6ebf4be2e6ffaf4d3deec7da6aaa507cbb9387

SHA256
536ed498f302831baea14e1b786e29ab0477278aa71d821e1072c6d80338ab86

SHA512
acd3d76413b768bd1f6a58d446967373d6fbdb0c39f0c62eae5c64e602e35ebe595a852b86d21315f4a764075787c0729971b65d9aa14613bbb97db90a959c45

Download Submit
C:\MsintoNet\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\MsintoNet\mIOQQzlA02ZU24pF0jGuEQEycJkgNN.bat

Filesize
32B

MD5
af2588f35c830f0576b666f81cb23a03

SHA1
4492c3dc6ce0cac0ff0eff2312a9a57919e39041

SHA256
5aa41b30140a305e598523ccd646b3fa92bd1c3fdb61797e2d64fa0dde191b63

SHA512
7d57468b8f2965a1ac184cbf91cff5a664e2ce9a1679a9c0af7f69b36a547509c35f15c43c9d1ab0f0e568ae53c04d0e4edca2972b9a7a2edbac191d330e7e7f

Download Submit
C:\MsintoNet\nHRdjr.vbe

Filesize
217B

MD5
08b7454316740f2927ea707a5ba3c79c

SHA1
c9f00505ba4cbd8b1a330d2e67ca76c14b73ce4c

SHA256
3f8d0e7e8c3822b1c4867d44543ed1d03e1f7c3c6d1a481524cced05900fd5ea

SHA512
c303c7a1069b88315a0645e88e6668b8fd6e8fa80550bd98389ceed70fb872cc974db15315764eb8bbe16c7f0eb2cd75c28c3838c2211f253d65f63bd54c6628

Download Submit
C:\MsintoNet\nrQ99sdYMIej7R1eVOn.bat

Filesize
41B

MD5
97b3f1e56dad34be4cb84e244cfd4a4e

SHA1
818bdc90e169c9bbc4f4562bd0969062b026ecb7

SHA256
f226101fdf7399badc937d237887e4257d59277ac33de6dff6704866889ee2c7

SHA512
ce79928b03564978bd53201c63f1fb2f1ac7d3a3794705fbf6a9b790f8339d875c37890052639bbd84261b545eb8ca5d7f89345f4377eb9137283aa3884ec97e

Download Submit
C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\088424020bedd6

Filesize
523B

MD5
ef99beec0e67c449aeec33493b3faa1f

SHA1
ad8c587e48e3b0a65f5a7485961bd8355f4083e8

SHA256
d3d8a0149ed4d099a7f032c18400d49f37eeed9892aa9afa4a500542e795dff0

SHA512
6e85bec427809f8acb3f46c6ef027e072eb7f06a9874d803d4a7ab84c623098664ba16553dd9c8828f271b8685f9117ba1f40c6d007797ea48b2c659f6313f86

Download Submit
C:\Users\Admin\886983d96e3d3e

Filesize
473B

MD5
49a1fb5c248be31f91e402858c482fc0

SHA1
02cd86a5c5df583b45e144b5021a978f88268838

SHA256
bb4195b384401770a98fc49b98cb93d1ea9eb6263fdb6261f847ed9284f3c327

SHA512
5376d1f410e552af47b9e72378b17ad4eb6fccf1692a213094f5ce1bb01675507c459eeae33a82a5c1b0f68b8bb8fab1f7cd1b45bbbbc2ae92cbdf915af1cde9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BrokerMonitor.exe.log

Filesize
1KB

MD5
4a154b138b22d8614bea6d4aa8bffecf

SHA1
e234d740d83d68c2233e8bf3ffd65406d5ca9563

SHA256
0c84f439b774b18f2f98ff2bd65b31a7540a064ec20aed0b5cd5fdd7546d56f6

SHA512
c3f7dabc72ddc377d50843b5e3a2bdc1600cee7d5dcdc52b7db9c675fbc5cb510be01ffe911462fd4e5af95737108ae1b19d006c00be5217f489c3772b7a68ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
a0bcb99a4562a0a6b6fc8be840d10ea1

SHA1
6c80ec71ec3f6a6034a4705a6d7780c1de745d38

SHA256
fca58c1cee36764762c34b1b794e277cd10aaa7d03223a1cd17f2eb9e1a9c80f

SHA512
5afbae2fd21da084524b6aba8089cfa98679f744fb93409e66b03c3542cc05f31db444a400c316e7a8f87350d6a5d7163fa033c1e5460c70b419c5e89cbbe622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
a28445e2d9c9bf3fe2b73d8e6bc1b460

SHA1
88048775ebdc6649391325962c7724aa8f9e59ff

SHA256
63c655981b9d65d4115bba9d5b4bda44754254bcb869123bb50401404ae96c2c

SHA512
572911b164ef790c7ba05a2b354763b533de01e1d6722730fd77d16ff29bb53e369f1624e318773df11f88431b935f5e822dd0a7b1e2a8ebd0869e418968c814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
025e6625238c3dac1e48a515bc977f4e

SHA1
ee6cb4c81ff544a895c142e0760740b82f4b13eb

SHA256
ad61fd1b33ad7ce19d1cdab02718fbdab043647ab3595c25f659450b302e6be5

SHA512
d34a6aa3350fb8c399aa18b3af3f7d2208998a562ed3ae76f530032ea9a6bf74aa4e91c4127001e0675dc08095275cf9e5742ce4868c39eebb583ad94f1d7e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
8f707470446ac249d56269d0e317da70

SHA1
e56b8ff22efdd093e375b41c66205f0c4b44bcf5

SHA256
7eeff19c97571b1414aaa5506db2a335a7c7283216aa72e2117eff88cc38ca72

SHA512
2053d0df563d90a1ab401d47d086127fb730c5746b17f9ae74a9f4dde264d3f7c46f5fa3288e439852d321f80d19cd783640d2c579663bbc1b0206ec15dca8a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
27KB

MD5
cacfb74b6db8ec937cadbd7a4e239694

SHA1
059f1501f9536c549448169c293d0fa1e3d00031

SHA256
3c21c8fd28579bd102c6d48522db328a689c5c8c6048453bb736a1f0d27567cc

SHA512
4765d09795339da2afcd22f305b9c595921b6071f8766bfc0285ab6e8e1589a0c262bd86f20caed7258bc2fedfe6e81a1f649dfe25bbaa75569340c8c7ba0c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
65KB

MD5
6fed6f379c347f3e13081accabfa5ae0

SHA1
03a586dc033247078c2498bcda52ebd13489b4f4

SHA256
d52a6b87275f80c95d322890c63d9429ce3cea8f8a2fb8566ac46fc85e53487e

SHA512
e4a922c08accc6ae44b7aff76290e0b8e3e1a74078adb9f6b872fa26db1ead7950b8dec2804a6f5c6e161f5ca94a33731f507ef4f25e69a0b7d93c453365abef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
29KB

MD5
cf776b128a74f76a26e70ddd68b46b61

SHA1
24c15fb603cd4028483a5efb1aecb5a78b004a97

SHA256
346cbe6774bf3bf9f3a5aacf287f859103045b0dcd4a32839b00be9f391259fc

SHA512
20751f34d1a3a63e580581d36902928c7780dde70fafa75b87e406965f2dde501b9821cd45c824584d1ece21566eb5fa501d1effdfafff0b2e27ec806bce8f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
9d593315fa2109a2fb1211e3af21ad7d

SHA1
c8dc1f6f53984315799cb4ea26d5d9ee3d574963

SHA256
36175644777cd6ac9726bfb7e985628ea1d47f3862f4ff7aa1d3b6211646e841

SHA512
9cd1b2f9681180bde2928e5df703023072d6e205d1c0b6fea888ebcca417d3d13a3b248a669b2a53d0b64a242b4b68d69154ac8e20342d6abdd5145bec0f9233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
1a740e669923a56f289c936cc835e527

SHA1
6b51ef0dce6a5a40a6c10ef591764a45f8eabf2e

SHA256
1c27d670352c05ac2d37d919044cae6c17876d0e5074747f1d040a94d5cf9c61

SHA512
ee90ba108696be27b4fce4328e7eeedbdce15d1a889a6b854d96b96621b3b232e1b9b063da44b4c750c74a082538b5d2a9c43207d5928d0b68ed831a0bd03f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
b4dd26643dba55eec51b16bf11088c3b

SHA1
d06085010308b1fa734ff6694f4c5093573933d0

SHA256
79777e3c9c9e938c21af7f1a8f0cfdfde0aa5c5b63c61de7c0fda5c06a190985

SHA512
1cf191b2467c8de253c801f2ac554cc80fdcd93067df6cdcf622d9a15d4c1a49203964135e87de2830662bb75c6e6ab1fc8af4f471116a245a36444592056160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
a4e9ca0d1ac66fa0326cd3d6c01ed0ec

SHA1
4a7b7c08970b9ea386964aca8f9bef6374482555

SHA256
f030232a4bf01cd5fa898b6c778d39e9278865dd81fa3fff29238061e863504a

SHA512
313dbe099d0c8e7ecaf4f4fcba9eea1995486777ba3b95d2b9bf5e0ae1f0edb64fc3b671dd3da587aca24deda0b754c0f4aedfba0d2294c15de36778cea77c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
1024B

MD5
db2d8ae41935b25daaeac6250d73e527

SHA1
81328e261cbb7fa0f9f8281a835a8e9d27daee23

SHA256
4e7631bc49bccbe81471171d27cbcd53aba8c1b280edc4151d05bdfd4b136270

SHA512
9153ed71dcfc362df5971fe18cc0771982ec4c6043ff7e0ddc43c4d473b7733b68eb913cf7b99a0c762d0aa77e9d87da3b4b30929251f53e52066e501734524d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Filesize
36KB

MD5
5d352a03280eba57cb274d27ba6c6b7e

SHA1
8887766642a81a1248dd5f93239ce63e93839900

SHA256
3b358849502f5cfd881dd035ff274a5753f90047a131884838c677e22f2305ab

SHA512
b8037a046c4be7be120bbfddedc780a4175fc8e6c863e9095e39a4e16d2e8ced27c40f38c569a79df990057175e3db6aa35eac645598af3647caa5744052bb1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a043a12c844ace224c745c1b61bfd8dc

SHA1
81b291c1d20b6429d05fb38d5b1baa5c3a755da0

SHA256
ab14290f0794d5652a923d125e9bf709e819e71ef323b9572df7f4f220971e83

SHA512
c6535efc2a72f1b4f933407cd3266c33b81daab49a78468b3a46f30cfbc4a14fd82eaf2d633c4f7605f9bb49837ef489388f8535dc221af0ebae3a475f0cf667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6b3204cff3c2a6a01166d5790c8cd33

SHA1
3e2a15f698b3504bec77440c5f947afeeea1b0b9

SHA256
271521b642ba67864390461e0466e4436ec445e5bfaf110dc26e8108326a54e7

SHA512
0c30ef30d288802d80c3ec9661012402b4d2225fddfc0b0756119061ca1cbd84f4c7ba4713aec153ee5012bc577cd1a60fc3b6846f7b0f78accc782d9ac4dbe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb442f43b3e3704c709a468aa186df98

SHA1
8ae2aa9c1a5434a29567ac35b76aac2982902fbd

SHA256
919d8ee02699c676b8b675baaaa45c1bf7af67a6deb3ad54fdb1f55f0d893ee6

SHA512
7f3ab8affdebba04df19bd2079e6f2f1fa7b5352dbbe65235302780927edd5067050e83ccdbbf9d972fa0486ba58e773a4e7fea3b38b7449a3cc404a64845606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Filesize
33B

MD5
2b432fef211c69c745aca86de4f8e4ab

SHA1
4b92da8d4c0188cf2409500adcd2200444a82fcc

SHA256
42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

SHA512
948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager

Filesize
52KB

MD5
e929382ba18101d4478690153eab4679

SHA1
eaae8658dc00d88591d8099f1e985235a5491c50

SHA256
62f09737c1009164e877dbf4f20612b75e750e36e4ad77bec2de1a2736d5c827

SHA512
81eb005e9878b480cd1de7381020158c896a4e47b4b05cc862b99bf725e80ee69b241dd515bdb82a0df09ace9f894698477d09a60a274c3889c65846541e008f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
c1df671459d1c3e34cd8f60e199c11cb

SHA1
5920ad2c52bd9c4b4c873381370d4265502f2214

SHA256
9d21070cbfb1ba920d1f4ee5c5eb1ba8f29f9bba98c9b13fe5a305a787bdbfcf

SHA512
fab34d6d0b41f45e5fee4cd6800dbcb57468a07e12a88678b3f34a5fa57b077ba2779b5a3ea8cd5fe0ea9801e1ed9f3f2c07754087d75e11da9b67f1b5377155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585261.TMP

Filesize
48B

MD5
46c71879c5d065ccb84c9f77ae961f47

SHA1
c94a7a50ed6b90fbb59f994d11668cbdd91fbc31

SHA256
f9968ed35eb25c2a7d8a2a8c5b6c7b590df921f7d91263a74dfa6ea89ff3afbb

SHA512
190f8c69996cb24f9e35e1d2bb0bff1f84f780b8353773aa6a83f8baeaf3e1670c3a79258df393de8d175b0b83f1fbbfea9b91a536ece500f0f08b6ae12ee827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Filesize
20KB

MD5
8be985ece811ba0a3f10087f5f4e6fd4

SHA1
c87c84d4fe182ffb8362f3cabd33349af94e9b55

SHA256
da78d36c765d3248b1a72ead5f83b7a58cba7d361f17a6831332ee994cee939a

SHA512
901932baea8712e89188cfce00a6b2388ba38697bcbfeebcf8b83b88b0cb26c7323b098ba6983c312ded1041f6e297412010113a32e99a9350aa4492ca40efa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
d8e840c7e0aeda85d13d698415e4686e

SHA1
0d93e55fee3569321426101d18c8eb5d401a5ae1

SHA256
dbf9f7c88102d154ceffd3754d137b74d68a0c5a2578bc4ac521e7c7330a45c9

SHA512
fa1256cb36b6e1c0289542003e3f51f8896d5202b06cc1985b9d62a829656ef0063caca810029fb7c16cf6241c1aa6f8f8429fafa956e681bf73c71b53d123d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
bd0097d6d5d2568281db0393db79061b

SHA1
b261b1e4bdce26e369727ce65fbf54ddbedea295

SHA256
a472562d6f2ed4b1a52697f6ed232eeed086cb4196a04cba7dfb32b6b6a66a89

SHA512
83c852c6c01db8f37adeb21ea0b1ce5b2e184c0531ab4cc74ff00a8f1751d47ffa7f4e9de478487236dac8e67014b5e8d22b720fe9f4048d61781c39ec594712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Filesize
16KB

MD5
9a8e0fb6cf4941534771c38bb54a76be

SHA1
92d45ac2cc921f6733e68b454dc171426ec43c1c

SHA256
9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

SHA512
12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Filesize
1.5MB

MD5
8f77aa2804b58fdd191a1996bac8f343

SHA1
d7632bf8bf2c0d36d8afed95e4f83f2c0e1201c5

SHA256
89431b593fc2268297cc89e10b34b7f762c9f146599d10656a6ee37d0e4bae27

SHA512
91fe7f5d3d0f1467819ca5c8010d03d4d9d39fcf283161bfa54fa2019c6146c5e508a198354c2c5928b5b3fedcd3a95841a984d7b6095167e36f2dba19aa9a67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\previews_opt_out.db

Filesize
16KB

MD5
d926f072b41774f50da6b28384e0fed1

SHA1
237dfa5fa72af61f8c38a1e46618a4de59bd6f10

SHA256
4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

SHA512
a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8075481382503fce18395412fe7a6625

SHA1
5ffd11a1687ae0727757165e853886a8ad2bccfe

SHA256
9ee378de0f88c35492809443cbfc6781b07c94755dd2704290ad996b6b642c5b

SHA512
dbe65eff89d2801c12918cc4f8853aafcd1898eb351e251aad6d9504ee7f4b4da30d94a313b537889d23b90c122ab8ed3f8cfb7cdb4585f39178308cc592d444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
279625354479eeffdb61d75e667605e3

SHA1
f4c9be4c47965bb07097abd84c7ac18f426d5d4c

SHA256
e7e65594d95fcd49b8a9ab50a87a24759e50da835a2ea73cde93587d7a16203a

SHA512
7222d55a0b52de567b0540a363cc61ff259ba950f0b0ffd68f9346c578092d0984348319d01655dd71ec0a4f067ec7c9767fdc585324490c435bd21b74226ab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\fV7HDFIPeQ.bat

Filesize
250B

MD5
26152e45952bd7d36c7065a217490f3e

SHA1
fbd7c971ef0592a2e79ec2c7f3d072eb23477797

SHA256
859b918c61d020263dd0a51f04cf657db848da95b4a9587bd6d7f5af8b784a96

SHA512
6d047eb1205df0ff3faaaae0f03bad34e9ca39d0d6f71ac559738aebc59e3aae3da8f183f7498521794572aa6bd5b3d9cbff8454c3ed0da174287b010bce2258

Download Submit
C:\Windows\Globalization\Sorting\ebf1f9fa8afd6d

Filesize
978B

MD5
20c0b8147ad4226eef90a61354edb4ad

SHA1
8c60885c0b373aae9d5263750e55c77c3aff61e4

SHA256
0e1b059fe4a32ebee2b50fbefaa1cdd82a3b128e7d3e017a88305815929b9214

SHA512
6791f72feb816fc6187c394ce0c7ceff3773f7fb1dc7cd9ff16814e2966b1989697f39a5bd2478bafdb73957d932486678ed0961d197de03eeecc3edf3f04df2

Download Submit
\??\pipe\LOCAL\crashpad_3304_LLAHJRPDRGBKEGHF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1476-630-0x000000001BB50000-0x000000001C080000-memory.dmp

Filesize
5.2MB

Download
memory/2844-26-0x000000001C480000-0x000000001C4D6000-memory.dmp

Filesize
344KB

Download
memory/2844-24-0x000000001C4D0000-0x000000001C520000-memory.dmp

Filesize
320KB

Download
memory/2844-29-0x000000001BD60000-0x000000001BD68000-memory.dmp

Filesize
32KB

Download
memory/2844-27-0x00000000033E0000-0x00000000033EE000-memory.dmp

Filesize
56KB

Download
memory/2844-25-0x000000001BD30000-0x000000001BD46000-memory.dmp

Filesize
88KB

Download
memory/2844-22-0x0000000000F50000-0x000000000118A000-memory.dmp

Filesize
2.2MB

Download
memory/2844-23-0x000000001BD10000-0x000000001BD2C000-memory.dmp

Filesize
112KB

Download
memory/2844-28-0x000000001BD50000-0x000000001BD58000-memory.dmp

Filesize
32KB

Download
memory/4916-108-0x0000000003190000-0x0000000003199000-memory.dmp

Filesize
36KB

Download
memory/4916-109-0x000000001BDA0000-0x000000001BDAD000-memory.dmp

Filesize
52KB

Download
memory/4916-111-0x000000001BDB0000-0x000000001BDBB000-memory.dmp

Filesize
44KB

Download
memory/4916-110-0x000000001D790000-0x000000001D7AE000-memory.dmp

Filesize
120KB

Download
memory/4916-53-0x000000001C3D0000-0x000000001C426000-memory.dmp

Filesize
344KB

Download
memory/4916-107-0x000000001D440000-0x000000001D486000-memory.dmp

Filesize
280KB

Download