hxxps://drive[.]google[.]com/file/d/1oCGtzrzqZsju5x6hv9lEAIXSo_k_Q2E8/view

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1oCGtzrzqZsju5x6hv9lEAIXSo_k_Q2E8/view

Score

8^/10

discovery evasion trojan

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 32 IoCs

pid	Process
2392	AutoHotkey_1.1.37.02_setup.exe
4488	setup.exe
4980	AutoHotkey_1.1.37.02_setup.exe
4104	setup.exe
4604	AutoHotkey_1.1.37.02_setup.exe
264	setup.exe
3096	AutoHotkey_1.1.37.02_setup.exe
1628	setup.exe
2292	AutoHotkey_1.1.37.02_setup.exe
4984	setup.exe
4516	AutoHotkey_1.1.37.02_setup.exe
4684	setup.exe
4756	AutoHotkey_1.1.37.02_setup.exe
1604	setup.exe
1212	AutoHotkey_1.1.37.02_setup.exe
3804	setup.exe
2072	AutoHotkey_1.1.37.02_setup.exe
848	setup.exe
2328	AutoHotkey_1.1.37.02_setup (1).exe
544	setup.exe
5184	AutoHotkey_1.1.37.02_setup (1).exe
5312	setup.exe
5464	AutoHotkey_1.1.37.02_setup (1).exe
5484	AutoHotkey_1.1.37.02_setup (1).exe
5536	AutoHotkey_1.1.37.02_setup (1).exe
5620	setup.exe
5652	AutoHotkey_1.1.37.02_setup (1).exe
5780	setup.exe
5876	AutoHotkey_1.1.37.02_setup (1).exe
6008	setup.exe
4048	setup.exe
5684	setup.exe

Checks whether UAC is enabled 1 TTPs 16 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey_1.1.37.02_setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 72445.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 130585.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
1016	msedge.exe
1016	msedge.exe
4312	msedge.exe
4312	msedge.exe
4920	identity_helper.exe
4920	identity_helper.exe
4372	msedge.exe
4372	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3100	OpenWith.exe
2392	AutoHotkey_1.1.37.02_setup.exe
4488	setup.exe
4488	setup.exe
4488	setup.exe
4980	AutoHotkey_1.1.37.02_setup.exe
4104	setup.exe
4104	setup.exe
4104	setup.exe
4604	AutoHotkey_1.1.37.02_setup.exe
264	setup.exe
264	setup.exe
264	setup.exe
3096	AutoHotkey_1.1.37.02_setup.exe
1628	setup.exe
1628	setup.exe
1628	setup.exe
2292	AutoHotkey_1.1.37.02_setup.exe
4984	setup.exe
4984	setup.exe
4984	setup.exe
4516	AutoHotkey_1.1.37.02_setup.exe
4684	setup.exe
4684	setup.exe
4684	setup.exe
4756	AutoHotkey_1.1.37.02_setup.exe
1604	setup.exe
1604	setup.exe
1604	setup.exe
1212	AutoHotkey_1.1.37.02_setup.exe
3804	setup.exe
3804	setup.exe
3804	setup.exe
2072	AutoHotkey_1.1.37.02_setup.exe
848	setup.exe
848	setup.exe
848	setup.exe
2328	AutoHotkey_1.1.37.02_setup (1).exe
544	setup.exe
544	setup.exe
544	setup.exe
5184	AutoHotkey_1.1.37.02_setup (1).exe
5312	setup.exe
5312	setup.exe
5312	setup.exe
5464	AutoHotkey_1.1.37.02_setup (1).exe
5484	AutoHotkey_1.1.37.02_setup (1).exe
5536	AutoHotkey_1.1.37.02_setup (1).exe
5620	setup.exe
5620	setup.exe
5620	setup.exe
5652	AutoHotkey_1.1.37.02_setup (1).exe
5780	setup.exe
5780	setup.exe
5780	setup.exe
5876	AutoHotkey_1.1.37.02_setup (1).exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
4048	setup.exe
4048	setup.exe
4048	setup.exe
5684	setup.exe
5684	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2616	1016	msedge.exe	84
PID 1016 wrote to memory of 2616	1016	msedge.exe	84
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 1404	1016	msedge.exe	85
PID 1016 wrote to memory of 3024	1016	msedge.exe	86
PID 1016 wrote to memory of 3024	1016	msedge.exe	86
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87
PID 1016 wrote to memory of 5068	1016	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1oCGtzrzqZsju5x6hv9lEAIXSo_k_Q2E8/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdac5c46f8,0x7ffdac5c4708,0x7ffdac5c4718
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe
  "C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\7z8B2A7958\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7z8B2A7958\setup.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4488
- C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe
  "C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\7z8BA8F374\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7z8BA8F374\setup.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4108 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,11259215628013980313,3145949067000725997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:636
- C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe
  "C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\7z9C480918\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7z9C480918\setup.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:544
- C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe
  "C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5184
- - C:\Users\Admin\AppData\Local\Temp\7z98F6E440\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7z98F6E440\setup.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5312
- C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe
  "C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5464
- - C:\Users\Admin\AppData\Local\Temp\7z9B3BD558\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7z9B3BD558\setup.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5620
- C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe
  "C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5484
- - C:\Users\Admin\AppData\Local\Temp\7z9B29856C\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7z9B29856C\setup.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5780
- C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe
  "C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5536
- - C:\Users\Admin\AppData\Local\Temp\7z9BE945A0\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7z9BE945A0\setup.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6008
- C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe
  "C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5652
- - C:\Users\Admin\AppData\Local\Temp\7z9B16F614\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7z9B16F614\setup.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4048
- C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe
  "C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5876
- - C:\Users\Admin\AppData\Local\Temp\7z9B2386F4\setup.exe
    C:\Users\Admin\AppData\Local\Temp\7z9B2386F4\setup.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1300

C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe
"C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4604
- C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\setup.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:264

C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe
"C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3096
- C:\Users\Admin\AppData\Local\Temp\7z95922C18\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7z95922C18\setup.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1628

C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe
"C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2292
- C:\Users\Admin\AppData\Local\Temp\7z963B68F4\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7z963B68F4\setup.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4984

C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe
"C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4516
- C:\Users\Admin\AppData\Local\Temp\7z974401A4\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7z974401A4\setup.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4684

C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe
"C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4756
- C:\Users\Admin\AppData\Local\Temp\7z9AA15294\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7z9AA15294\setup.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1604

C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe
"C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1212
- C:\Users\Admin\AppData\Local\Temp\7z9BAD44BC\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7z9BAD44BC\setup.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3804

C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe
"C:\Users\Admin\Downloads\AutoHotkey_1.1.37.02_setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2072
- C:\Users\Admin\AppData\Local\Temp\7z9ADE0818\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7z9ADE0818\setup.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f74396e-4bbe-42b7-9b33-e3e1ad32ee11.tmp

Filesize
4KB

MD5
5e97fce74f925df116137d8be472c756

SHA1
adea3f06f72d5a119ec7805b478560a9f0d7d192

SHA256
6c30db03b70978b0cd571317e1bc1ed908b02f2ea9105535cd7cb493ce7ef4ec

SHA512
70384ccb25ae27bef5167247ccd46616aabddb0d655d1280572af03162929c0bdc5239e00a0a7cafa71766ddcac5e453e18c97b4ad4a7595b4c9cf5a9d88548a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1617fd900382b00ca07462c33c596f5a

SHA1
b24cdfedffe28bb950622502d010827f93727baa

SHA256
61927efa65e5cf1f545a8c576e2af4c10c3e4c91002760ecf61c571822315a5d

SHA512
db7f8d4d60194bec011b0b7e960bb19ae77581386cedaa6470c602513deef91d21e6d36390a0991e53c9f57dda4ab2cf155ce5af01ece7cf8fb5f3f83a81dd1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
bc0c8ea68e55a8592a82996b95ae76f0

SHA1
23f81d162756927ab8776c181e667e421116fd7f

SHA256
fa36f357d4d2f691417d079475f859a74a5bdefb13fb499bce17f25ae3542177

SHA512
481736c8559e1f78fabca6919a852e1c2d4bcf6f4cbf2347a8bbd3caa43709a6b806bfe5a8741ebddc2fae714031f1064dcc43cdd2b4ed667305e506c98ad70d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a224846844bc0937e922462109677d92

SHA1
eef59377bfa3ded020aaa763bf2b6f4c788a9cdb

SHA256
8a8d674f09022730a5900759dd4c9dae1c01e8e4364b1b0088bf79d21f181ba9

SHA512
184e95a7a41b345d89d51faa6d103ba7609cd0b6f93b46054ad52220673b20474c0db5029003c37663a6efedfcd1a3c2ef24965ff9531ba4b2951abbc3130597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39000bbf4bc343c488efb063733c2ea1

SHA1
e4ad83d2bdf806cebac4136bf3cdc6c91f55561e

SHA256
b8547334931222122e5671bd477ab0d627b04703d90209f1eb6936bb7665e536

SHA512
174e19a1e13760b5beb867bc4324e72de27d91bfe637e830099d826748683559d026225c9003b9ed7f0aec2c4f699829208d27aa27238f8aa18a0d59636662e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
93e908d4a7750c1f4c065a5b253fd419

SHA1
d58c168bba8ad9c52985164c21c3fcfaa58a5c9a

SHA256
3cdf294373dff087cbee2b99420c5e8e24b5eb39ef5213d3aa7cdb1db29599ce

SHA512
c2127e02d03ff96db938c563fb9c9cd2ccbdb53150b7ee91a0d14b04bcbfd50e3002ac85f1a8a839b0f24c93f93bb944b1876c1f9ddcfd149c79d6af1b239430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c48519b1738164d47b9a6adfed67e45e

SHA1
0740d49fb0d65ee4d67aee9c940a7fc5787e3ea9

SHA256
87646f40229f65d353096e7c18bd40761529803d8a86c0e62e281c8418a40a3d

SHA512
b13202b3ad511da2c060ea44488fa1c2dd0e67ae6aa41ab70dcde33899cb6201f196f52e341681641f4b1c087fc15883e02046c2a8b4f2b432505620aca44cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0e8fc2287ff898e370e50b0c0915c5e3

SHA1
d4d2c9505b922f7c39f35ec8b53c7257572ffa74

SHA256
2f3825471a278dd9495f9885445796db2255e5d17b418ea579bb0fe2f84cfe91

SHA512
6e2ce2cd5423d197fab6ab884ac256d82b686d88b810886b90c9a9fcf0f52ca01f4155dcf992ce21b161e84f8cf1dfece874fcfdfb766a6a1e86aabd5db580d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
51ddd9e396944e5123761cb782a8e527

SHA1
29565bb533038dab5bb2b5c73f6ead5f58ef37e2

SHA256
a9d90f5f81b4b07b70fecd081237733d2080b742c02c2ad3e922e50b19840a45

SHA512
1b53fecedf1a908ba7d74eaa0d75460bfdf1756490e71f61270b3fa9d8d3c1cedda394c88c87f0d0e6acc3fd836d9082416446513ec6314ef87ae7bdeb115a4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58817f.TMP

Filesize
872B

MD5
1d5f1eba09eef5a41e52107b5cde6f13

SHA1
0e9cd9d15ac6d663416296659eb9336a318e8a2c

SHA256
beed72651fe6f4efcf16c65445668e8384a44e779e7ba7222166bf99a9af3383

SHA512
ca07fa22a5f09ae3c66e5685c41936bc8666a1ab61241b298aa624cf0a37d2a30266348678fca483e8be4b438e8de52c75514e2aa4bfe69b06619064d25cd6ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90bc303e2eadc7a0a8b5e08840ceb04a

SHA1
27209a1748d52aec97f32acb439fe4c7acafc71b

SHA256
5f36d893263cd93236c6cdaa68365cdd964b0f02b413f797325511523043f9c3

SHA512
052a0b1e4b05e075ef09eaa8567f9e92401d87aab2131151743610c326db157e4af2b4b2f9c766f3ab9d569a98952f4aa2f75ffadd9bed72d59054c88679bece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf85d38933ee02ab93e7242232a47a05

SHA1
037714b6792210d9d0744cc0860be553b1751577

SHA256
76ff21e7b4e22780cee618fcbbb8e2c7a756c99fd9fe432c075f8c27058f9f49

SHA512
2259179ff93e80bb86a01494e19b27c47fcc49a73bf2a5cdd0a7fd02b50ffd3bec6e7b0c718cdfd698147535212e62c401bfcbf52bb3093af87b82416e4e007f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
73b687e65b99e44a4185be9f78ad3a0c

SHA1
299a750d13dcb07200c360dd54f8a555eb476b44

SHA256
058f7ea2c6e8be5bab7e3e4eb113314544743e27731b9f13f66b54df0140990a

SHA512
e3c27216f77b71fec810302db9b4440f6f8318579eb640b3f7cb65abc978337c85ead07d2f3292fcca03cc61ce08505a46ee80c6c0ecb9ca4f5ca9e6d46c4857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fc725f1ec193a9514b4f71c77fefc976

SHA1
dcf09723a9de64272e986b6453f7580d6af2e9a9

SHA256
3775022708af5cdd00454cbc079b3cb62b3dc092e56910f3c783b2eb34d8770b

SHA512
33f4cce24b8ce403a864223d30cd9e29b769dc12f3255243bc4f78a4e9f7a762fd2088b37856a9f27d353c94109c40e4f8cfc9141a15e739018f46b9f183fdac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
944f811e71e578cc6d885de7497d0aee

SHA1
20d6e7ce3c17984b262d37130f16d04f4f39d394

SHA256
90db6e8b1d8ed7e7746b65caef21a4c028887807a5513449e53271fb89cfa5c1

SHA512
67ed4ddd453df974f3b7ddd338ce5b9f4419af6672572b803169d14473037645616bb11a4658f092f4b76b71cab9cd6bc46d437e8fdfe124f67efceb8d68eb03

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\AutoHotkey.chm

Filesize
1.9MB

MD5
17d5e275dbc8278d888f7da1d681d7e3

SHA1
245cd35e6caa42fdd3936d2122c7464c877d6591

SHA256
de37a93068ca25701b3413eab0f01fa1646d2dab0346d78494192e95d94ad521

SHA512
041420c5fcba5d2fa5e2d549319948eb77b416cb32ce848218b2681f3bdb5a7ab50d795cfdabd068330f6a4f16812ae91564d654a958b0f0bb188d11890c4ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\AutoHotkeyA32.exe

Filesize
775KB

MD5
fd94b77958305a1ac3eeac27ee765256

SHA1
bdf7f5633cd529186c7c9c87c120a58c35515d2e

SHA256
6a98b438b67da7316e9251eb1a92cd5384a8349d239a77903f7282fa076a77c3

SHA512
1e97ddbe9374513ec9a1f51313efb3621f81a309bf78982688b4c19aa389f0b422a604d8adcd84dc1ba28f44135d30edde06e32705fe02762e92cf2bbc725a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\AutoHotkeyU32.exe

Filesize
893KB

MD5
b6af97aa32c636c3c4e87bb768a3ceb7

SHA1
83054af67df43ae70c7f8ac6e8a499d9c9dd82ec

SHA256
ba35b8b4346b79b8bb4f97360025cb6befaf501b03149a3b5fef8f07bdf265c7

SHA512
54d2e806503f8a4145ee1519fc5e93cef6bf352cf20042569466f6c402b0a402bce99066decd7729c415cd57da7a9923a1b65926b242672731fe2f9709cf6920

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\AutoHotkeyU64.exe

Filesize
1.3MB

MD5
2d0600fe2b1b3bdc45d833ca32a37fdb

SHA1
e9a7411bfef54050de3b485833556f84cabd6e41

SHA256
effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696

SHA512
9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\Compiler\ANSI 32-bit.bin

Filesize
704KB

MD5
31ed560d3edc5f1eea515c4358b90406

SHA1
36efc45f806ee021ef972dc80932f13f532d9ccd

SHA256
f5a5c05bf0fedcc451ade5676a5647e828a6f08cf6c21970e6c035f4311b5a3c

SHA512
cb410bad3297493b68e51677b920a808393a30096eefd1cb2c7cf07c8432c78658e803099841be8167eff3f42475b765992da7c11a31e39108ba49010b07ba6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\Compiler\Ahk2Exe.exe

Filesize
972KB

MD5
78515b1091f74c0f828aed92d3c972b0

SHA1
0103e030518db102631310ce4e2eb7673d7a1994

SHA256
754a28ed76a7b4eba7909b146cfc4c4c2aa43aff54e10a5cd6dbc939c0732b6a

SHA512
8edcfe6a59d56d69f0fb7672410fcb24fa0722a5d651f076a3b76a424140e162a213fb038c995ae9c2024929c88aa1fbd979694a485163c2d3f8ca3be75502a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\Compiler\Unicode 32-bit.bin

Filesize
822KB

MD5
db213c2dc5d0f542a1e925f09c021e05

SHA1
41bebccc1dd9c44c4407892daa3d3fe44c2216d7

SHA256
2d193510b56fbdb8530f8ded2f1c9fb982df971dca5fad1f24f558be16a4f804

SHA512
dd0977a599359f577c5a52d0f86092a12488f291613a0d4812fca64e0553c4d61501d5213e7afd1a62c62da8470e4453f8d1ea2bbea0be74ab223bd4b47e97cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\Compiler\Unicode 64-bit.bin

Filesize
1.2MB

MD5
30da2df436169d6f09732e61d8849a05

SHA1
25694362dfa391caf55733772ca61a95978d507c

SHA256
6e7c9ae1daabdb958a4d9c8e7297ba956c9504b5f76ce61fc31281f5bb0b0b55

SHA512
134b616b01a18f9451cbfd947d6dfcba21a31615a5cb513a29c6e5f77d8bb2776e868a215f7f533b1bac6a82536cd8838db7b1f69025735cbacf94afce158066

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\Installer.ahk

Filesize
65KB

MD5
015d8f0a9ba93e41f418b8db8bef6a10

SHA1
06d35e419dc82f91d123f129b88ff46511d1cf2b

SHA256
ef88ba74aef53793937ddfaaca4908772fbaf2e7c9bfb5fdeb3c0a6b95755cd0

SHA512
cd034768b35fdb96251563cb87cddbfa63c55bfb798aa8ec6fdd9faa6b0155d6b42bc30ace6fe9034aac45ba3abc434613df2cb0e07a4b1b0bf0ed8ebb2e71d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\Template.ahk

Filesize
324B

MD5
a85eeb1dc6f9a33897c407b4240dc20f

SHA1
be409c1ba630f2f11ab31e5f42c8a90ab49e8d8c

SHA256
23e5115a25e2d539057443b0f0e9740b9ae85d7de0da204f1d739c9b2e206058

SHA512
9ecaf71105745739d79207313bc837ecb9fe63cd1cb66e75808e615dc58f5d931f9744fbb04c74085a8cb03142ce43611af7763e8b21e4821a32a58b0d64f77a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\WindowSpy.ahk

Filesize
5KB

MD5
32020e55548b1e9e7ce22899617d5cd2

SHA1
6aaeb5009dfae698449449e560feda2257187fd0

SHA256
4688629be394986c8dbe6517032429e6e8cdd9f5801ddb1ac1f53e6fe86eee7b

SHA512
12b5ec622a7f5d3b07d7db821002e4d7886095be0274509d721040812bcf01348daa6a6c9db485d6ac6b58f9684443db0a31963433a33cd3e8a3c7c2e3119475

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z89CCC1FC\license.txt

Filesize
17KB

MD5
e3f2ad7733f3166fe770e4dc00af6c45

SHA1
3d436ffdd69f7187b85e0cf8f075bd6154123623

SHA256
b27c1a7c92686e47f8740850ad24877a50be23fd3dbd44edee50ac1223135e38

SHA512
ed97318d7c5beb425cb70b3557a16729b316180492f6f2177b68f512ba029d5c762ad1085dd56fabe022b5008f33e9ba564d72f8381d05b2e7f0fa5ec1aecdf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z8B2A7958\setup.exe

Filesize
872KB

MD5
b98ee9e00b5546763f9c6e65e436f6e6

SHA1
a28e2b0ba6cc748d166b2eb6d0c8acb0bd3b9f3b

SHA256
6d876c526b5cbc5dc5341c1011b1c91639597f46677a1d42426f4a52dfea6756

SHA512
556e632fe39231622398c5afccc51d01f25bc430705a126737877ed9f354c7076b5bf3cbac27f8a1c4db4d326b6a8848fae4b8d6046f816597c370d06e824591

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 661367.crdownload

Filesize
25KB

MD5
36ddfbe29f2fd3366ca298b350a6cb19

SHA1
0b5c4d270dc47b4ae1b1f59f85b8617bf8a7b036

SHA256
4acb8e96da33a31d5f8384635cc994bebac071f16093ae6ed7f909f6a3bf7218

SHA512
54760d5e130e90a07c238fceee800da27d567671a22bdf6ab7f6f21a148f072e7b2f07d7e74e55f32d7d8e4c52779882ae6681a0653e2fcd564a7dafc94593ae

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 72445.crdownload

Filesize
3.3MB

MD5
c2e8062052bb2b25d4951b78ba9a5e73

SHA1
947dbf6343d632fc622cc2920d0ad303c32fcc80

SHA256
49a48e879f7480238d2fe17520ac19afe83685aac0b886719f9e1eac818b75cc

SHA512
c9a5ea57842f69223bd32a9b9e4aaad44d422f56e362469299f56d8b34b5e8bbf2b51d4e64d2bebe6c95d6d8545a8a88e6107b9b0a813e469f613e1353aad7a4

Download Submit