cb43fff6739186bdf2af5d4f34624c020196616cdae86fb755bf3d250bbe9b12

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LB3.exe
Size

147KB
MD5

67008d6538e43ec4ef57359f7ca4f15f
SHA1

65078b6e640146bde300af0a6d70b91f45244343
SHA256

cb43fff6739186bdf2af5d4f34624c020196616cdae86fb755bf3d250bbe9b12
SHA512

9a9e281dcf6a783cb69f6ab9703af716dd304883ad1a92a17bf4498745b563b2560e4624d839cc7577776d31e22f596d821a183c4c4ec350d7fa7a8f0e44db54
SSDEEP

3072:V6glyuxE4GsUPnliByocWepTN5GqoLVB5FHONF:V6gDBGpvEByocWeX/oZB7u/

Score

10^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\IoBMyuygl.README.txt

Ransom Note

~~~ RdpLocker Recode the world's fastest ransomware~~~ >>>> Your data are stolen and encrypted >>>> Info Our encryption is undetectable and we can encrypt terabytes of data in minutes. A unique public and private key is generated exclusively for you. No one else can decrypt the files we have encrypted. Our services are cheap and reliable. >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can contact us using Tox messenger without registration and SMS to negotiate the price. https://tox.chat/download.html Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. RdpLocker Tox ID: CE93C52BFAFA16570B9821C7D0EE7999C78475AD964ACEEF80767B653210D27E3CE6C88F61A5

URLs

https://tox.chat/download.html

Signatures

Renames multiple (599) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	B509.tmp

Deletes itself 1 IoCs

pid	Process
2964	B509.tmp

Executes dropped EXE 2 IoCs

pid	Process
2964	B509.tmp
5948	LB3Decryptor.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini	LB3.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini	LB3.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PP2ow13tghdu299_p5_kfyp9yhb.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPz5nwhkyoc3mc0ernda2te345b.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPu_30o3vp4u_wik3msdx4jcggb.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\IoBMyuygl.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\IoBMyuygl.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\WallPaper	LB3Decryptor.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
2964	B509.tmp
5948	LB3Decryptor.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LB3Decryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LB3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B509.tmp

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\WallpaperStyle = "10"	LB3.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop	LB3Decryptor.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop	LB3.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1275686028"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb73de6dedeff944803e966ed336312400000000020000000000106600000001000020000000f4c49bf858b87ba66b35f0e96fe9c2fb922da45f982d8d449e6d3f7a0210ee0d000000000e8000000002000020000000d21918c937577042af71aaa246cd4ad4a37218a9d1a70bddf6763efdf743a0c42000000035be155d231242b164c80ae3291f1208de9fb2953a0500fae6db156ebddfaab34000000017ad6cc8949b0eb2be864976c96aa59d9c4a7a2dfe1e8ff7d070fabf041c32abe5d8ce7c7a55ffd12dd4ed50ae03607511cc96bdbe67545f53ccc8336e85f918	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1273845821"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1273855963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20341e492056db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31151648"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7465F43C-C213-11EF-B9B6-D6A59BC41F9D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31151648"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0261b492056db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31151648"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1275695785"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb73de6dedeff944803e966ed33631240000000002000000000010660000000100002000000024d9e547ed98253ac8c9f71bd60b79ebc1bba60ab7811a16e5a442869f4a9219000000000e8000000002000020000000aa58cfd8fc0a15252ab7c2cd29a6000c1d6fdf07c196c62e4b9e5d7d3b35263e200000008be88708a4ef132373ab3db434e301b3867414f89fff7fa799b7a317cb628e6540000000ed96499c0647ac564e211d7b3180eac3110b9e26f0ed52131bf23938b2b2201ac0cba8a5d35afd0e15c41aa880e79dc5a4829fcfaba2a8af74dd81f2dc97c53b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31151648"	IEXPLORE.EXE

Modifies registry class 8 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\IOBMYUYGL\DEFAULTICON	LB3Decryptor.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\IOBMYUYGL	LB3Decryptor.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\.IOBMYUYGL	LB3Decryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.IoBMyuygl	LB3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.IoBMyuygl\ = "IoBMyuygl"	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IoBMyuygl\DefaultIcon	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IoBMyuygl	LB3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IoBMyuygl\DefaultIcon\ = "C:\\ProgramData\\IoBMyuygl.ico"	LB3.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 868046.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2176	NOTEPAD.EXE
4456	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4920	ONENOTE.EXE
4920	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe
3284	LB3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp
2964	B509.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeDebugPrivilege	3284	LB3.exe
Token: 36	3284	LB3.exe
Token: SeImpersonatePrivilege	3284	LB3.exe
Token: SeIncBasePriorityPrivilege	3284	LB3.exe
Token: SeIncreaseQuotaPrivilege	3284	LB3.exe
Token: 33	3284	LB3.exe
Token: SeManageVolumePrivilege	3284	LB3.exe
Token: SeProfSingleProcessPrivilege	3284	LB3.exe
Token: SeRestorePrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSystemProfilePrivilege	3284	LB3.exe
Token: SeTakeOwnershipPrivilege	3284	LB3.exe
Token: SeShutdownPrivilege	3284	LB3.exe
Token: SeDebugPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeBackupPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe
Token: SeSecurityPrivilege	3284	LB3.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
10068	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
4920	ONENOTE.EXE
10068	iexplore.exe
10068	iexplore.exe
10156	IEXPLORE.EXE
10156	IEXPLORE.EXE
10156	IEXPLORE.EXE
10156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 1108	3284	LB3.exe	88
PID 3284 wrote to memory of 1108	3284	LB3.exe	88
PID 2636 wrote to memory of 4856	2636	msedge.exe	100
PID 2636 wrote to memory of 4856	2636	msedge.exe	100
PID 3512 wrote to memory of 4920	3512	printfilterpipelinesvc.exe	101
PID 3512 wrote to memory of 4920	3512	printfilterpipelinesvc.exe	101
PID 3284 wrote to memory of 2964	3284	LB3.exe	102
PID 3284 wrote to memory of 2964	3284	LB3.exe	102
PID 3284 wrote to memory of 2964	3284	LB3.exe	102
PID 3284 wrote to memory of 2964	3284	LB3.exe	102
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 4168	2636	msedge.exe	103
PID 2636 wrote to memory of 1956	2636	msedge.exe	104
PID 2636 wrote to memory of 1956	2636	msedge.exe	104
PID 2964 wrote to memory of 2944	2964	B509.tmp	105
PID 2964 wrote to memory of 2944	2964	B509.tmp	105
PID 2964 wrote to memory of 2944	2964	B509.tmp	105
PID 2636 wrote to memory of 4720	2636	msedge.exe	106
PID 2636 wrote to memory of 4720	2636	msedge.exe	106
PID 2636 wrote to memory of 4720	2636	msedge.exe	106
PID 2636 wrote to memory of 4720	2636	msedge.exe	106
PID 2636 wrote to memory of 4720	2636	msedge.exe	106
PID 2636 wrote to memory of 4720	2636	msedge.exe	106
PID 2636 wrote to memory of 4720	2636	msedge.exe	106
PID 2636 wrote to memory of 4720	2636	msedge.exe	106
PID 2636 wrote to memory of 4720	2636	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\LB3.exe
"C:\Users\Admin\AppData\Local\Temp\LB3.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:1108
- C:\ProgramData\B509.tmp
  "C:\ProgramData\B509.tmp"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B509.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2944

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\IoBMyuygl.README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2176

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\IoBMyuygl.README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:736

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{45E5F7A2-F276-44C9-89DE-05C024FA223A}.xps" 133795309448000000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe2e2446f8,0x7ffe2e244708,0x7ffe2e244718
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:5396
- C:\Users\Admin\Downloads\LB3Decryptor.exe
  "C:\Users\Admin\Downloads\LB3Decryptor.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2993792738435374992,5891833902706462937,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  PID:5868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520 0x508
1⤵
PID:5232

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\Desktop\MergeLimit.xml"
1⤵
PID:9996
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\MergeLimit.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:10068
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:10068 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:10156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini

Filesize
129B

MD5
3ec1ea645c1d336e1cda473bf88b0890

SHA1
8c50b7628d6bfe1a4cb13cb932e8279859f225fc

SHA256
f4d917a3232643269649f409feeda83b5ee094b60016291865b163112543429b

SHA512
a8ee4027711b2eb1e73b2350659b833a438a8c66efc9b4c7422325b5ac4025aa2992877b17ca1a03cc80cd428bf88372da051324004b39e0f92c9e9dcd39b32c

Download Submit
C:\IoBMyuygl.README.txt

Filesize
1KB

MD5
0fc102c3422c21c1aadfaa1a656dc970

SHA1
49cc540c7a5eaa4f12cacdb21e788335d535ccc0

SHA256
fe49a063ebe0b4154321062c1110876bab03710ab367d8a5e3dee6e75fc79029

SHA512
8cf822ec2d69b4f4bfdc3303b142ff21315d6e5483a98efa834d039f68a6f57e249d374d3c127a65f524123464532afa5700b4dd4808236b082f7a420a260ab0

Download Submit
C:\ProgramData\B509.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1

Filesize
264KB

MD5
e8e0483c1fb791eb9451839273cee4ac

SHA1
05ee3c57d07a548b95fd3005c2e7ff5fcbe9067a

SHA256
fcdded4b86c9dbfe1cf537d6aa7d185e994d1b2d92a3132262c15d8da662eab2

SHA512
95e378a48fa52e787ad9a58c4261ce81f5320c64e109585601315c207fa3c390b7fffc6d394173daba74622c21f685f3af8cf8e2f46fe5edbda8dd9d3934e5cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Filesize
3.0MB

MD5
d1dd210d6b1312cb342b56d02bd5e651

SHA1
1e5f8def40bb0cb0f7156b9c2bab9efb49cfb699

SHA256
bbd05cf6097ac9b1f89ea29d2542c1b7b67ee46848393895f5a9e43fa1f621e5

SHA512
37a33d86aa47380aa21b17b41dfc8d04f464de7e71820900397436d0916e91b353f184cefe0ad16ae7902f0128aae786d78f14b58beee0c46d583cf1bfd557b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
da70677c05ec5ef6177f8ebb8c598e79

SHA1
9b8ceb288ff9828251986e7085fc2f2fbb62160d

SHA256
9ee2ff2f988f01257eee14330c1d2bd11db9bdbc94bae13426a3d5d691c20e48

SHA512
e6fda6cb51aa7ca8828f77bc7254d063de3e412c16912f54684229fcdaa8bcd10fdc50fa1914cacf54501aa13e8ddaea18d70db9a4448b5f5f337ae913047b84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
327B

MD5
a31a41e344e8eda0c38af95a871a8b85

SHA1
164ca8224bdea640607d2a6c5cc1b29f2f8b48e9

SHA256
06d8145da05e9e196454e9822afb690123fb2b6d47b3b3d10f4e6bf704a0efbb

SHA512
c71e352ed62d812629602aeaca35e9078c5c97489a4b573c2f6f8249d76a27fa18e3511507c49e8b4c2f481d7f7313234583891e42a16de59fdd5c61649f8c3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7943088cc67e702417f74347f807bec0

SHA1
dd80919e01f1bb39246d631153d68c6753e7225e

SHA256
beb09df5d937c792a26398bfda23818ebe847b2695a21c195676a7e003f7f85b

SHA512
5fa0f0aed0a6d6597c23b4e557af4c82d58fc10f7f30b445a8cdd968db27a8dc6b1b9bc1e21d89ca3bdafc685f0b7f48ddc56ac9260be4d61cac6ab48a6091a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75895006391bb29cd7a5f08550ab03ff

SHA1
b348f71dc84800a599a587345e4e46020495ef8f

SHA256
f26d46e5be03669216cea9a3642d77ccb2a0597eb24760d0c1ea9da7b3fd70aa

SHA512
6922cd68e4b8adf66619c789ea7d6f9bdd985e60d89b79c6b86221c90a1d925ad5c38649f5d14838777ef6e6b742e7de57c65d2fc17b6456a1f412d130c26091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cc1b7b622e7ba82e1dd71b7a304e5b1

SHA1
c010abb25d26e27cd336fb809ce8bfc087c1d60b

SHA256
0418376bac1741cd305020e5a9e164e2b677299eee8b02e56f4890d0c9c850e0

SHA512
ba671b32ec850e37f72035fa60ecb431a5baebff6e534eaf0192eaa741662ef30a009f9a02266d36bce5286d59782394602550eac0e14857fcbe83f089535369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8a940b1caf26df9f479e8e6a3b20af0

SHA1
99f45798d53e8c902fe63cb57153849fd9885283

SHA256
7af6d6723f63dcab6e6ab5ef9ee0c25c6103cc22f406fe3a043f294237cfd835

SHA512
a602ad194b5ad35dbaacb27f6070b920266659235343943bf3f7ed11e3ba8acb912183f9211214ec0548a73f66389cf67f21fa2acb9ccbf2263bc2777838c8c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ad0f7ef43d41bb169a00a706a7ec8f16

SHA1
0b54d2b27c45f23dd0f4fc4f8413e5beebb88eb1

SHA256
dcaa72fe9d9476cbfd66e01c4a9fa41ea20b6ec70dbecad86a5b9e0da5da0bd3

SHA512
8a310115c3d6b61d4adaf1dcdda630cd4eb10c0fda14163c9aba9a74f3f28a0da6dac5932eb676a8f7dddfe99d6239afdf0a8b661ba52e581561fa43e230a31f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5885b5.TMP

Filesize
48B

MD5
1b44f5dce1bafe3a9aa437a5f3b2f1c0

SHA1
712fd891253bc59e674621938455278b73e158ed

SHA256
50fd8c57877d16ead23aa497c610e107a96b8f556daacdf691260a667b733857

SHA512
d44871895339c0621d469a8d462e7cf592c78b0ec96b62a3e83d43091b7603397018758967fb6e246c350b18b5ec6ee11ef229f987f55855f208d292810e652d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
88302224288602d2a50458bae6f1ca47

SHA1
f9a4fbffe95c52a5f5ad6e44490d98a7b27d4606

SHA256
743021061dd5586d961c873b84b544ea53419c86b1906df5efd8a520206ee47d

SHA512
a224fad9e3041f14fbbc7abc5f9809cbd7c9b5450daaedd2e46de27d140f17fd5f2c08b897e1be834337f1758c35e424e495996de44eec83044d3165f720ae78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fa4538cb48d1b77819d7c85b4fbeec82

SHA1
9f8315d90dac5185b019de474c00022602fa9b33

SHA256
a79cfe85d2adb20befc89c2954d58271081174613c8f9df11ef40a6db88200ac

SHA512
1fa6f22acf2016a90fce952f9e58ffc607dbafda6d07cca2336f3b22c9587c0a5320a6bb7c2d15e2cb50cf159a9416cf6f30670c2f5961cadbad8cb344e2eb2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver7536.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
e7de8149851582667c68a59bee5ae5ea

SHA1
9fd0c283476e4daba971878d325087a0a7c648f5

SHA256
1d85abf01f4cac61daaab1d3d1fca2fee46a8efcad7fda8e1fbbfc0fb4aa2871

SHA512
1151d4b8f3065a3bdcab45b5a185c040e590f414d49115f0211ace260e45b1beb49005e3431f4e3229be8a78ebdbba5b6afa0c22de2469dc089d2128dd2671ed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3

Filesize
16KB

MD5
7809b8545000e18fb8c8838d2921204c

SHA1
1497c5431050746eef75843a4d48153a21b78af9

SHA256
05ac6279ad4ffde0b76a3fdfdd7c35e18d9bf430171c33ddc3a8c31b3ea24414

SHA512
b38cd96f349e5a02f1b683f8aaf34cf32cba90d74828fc6a9a057e286397b1dad469da3bdd9c80e556fff3ad1638160da7765c9268522947ced5d557e5376fd4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{30BD9A02-CB9A-93FD-A859-09C8803F2346}-0

Filesize
36KB

MD5
8ab0ccfe101f2a223bf9fc11f910ec64

SHA1
86a7cf51b399bb786896fb77f59ee8b4844f5afe

SHA256
8cc15be591c4f70f964d3554be30283f925747d09eb71692bf40b8125e2bb68a

SHA512
b862068ea8bdb828186c2bc693b1e99d622a48a82eea13886090c44e17d132ad1a96bae4a96214d9a8abeb22f7c85f4ef25a000cc1bf977fd43e67bf1064a61e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}-0

Filesize
36KB

MD5
8aaad0f4eb7d3c65f81c6e6b496ba889

SHA1
231237a501b9433c292991e4ec200b25c1589050

SHA256
813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

SHA512
1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}-0

Filesize
36KB

MD5
9f1ff11e31c55a87372e85612ca3c290

SHA1
c94dc58d7e8f070d3eeff5bc8ecb3a2d7008323d

SHA256
0c650065d284a6a0f6a17ce2250214b40219b7082e940689a2cd2948162fd893

SHA512
dd490e167b4455aace73dda6d9ec6b90aee5e5994701c249a44d316b17c3f8a8f5e776e9ecb6d751dfbed8e74743a3f13d95edbbf3b09998e148bfcba1ef721f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe-0

Filesize
36KB

MD5
2bd136eb4cb4539c66599b66221dbbba

SHA1
22532c9b312cce5d6e593955b795cb2ba2857124

SHA256
aec7c44a6c41813e7a0df059f38d60c3a4fbe51683d3f9d17e8daf67c0a5c8e6

SHA512
22ef6a2565c30912f65e7b6f5e53981d514f3881e457dd7761bb4e7e286f22bba5e3ce6d0a2f7c02971d801a4e999e0d6ca4aa6b7bb935249cc947e2b3d2766a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc-0

Filesize
36KB

MD5
eab75a01498a0489b0c35e8b7d0036e5

SHA1
fd80fe2630e0443d1a1cef2bdb21257f3a162f86

SHA256
fdf01d2265452465fcbed01f1fdd994d8cbb41a40bbb1988166604c5450ead47

SHA512
2ec6c4f34dcf00b6588b536f15e3fe4d98a0b663c8d2a2df06aa7cface88e072e2c2b1b9aaf4dc5a17b29023a85297f1a007ff60b5d6d0c65d1546bf0e12dd45

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe-0

Filesize
36KB

MD5
53397b08309ff534a07d24635ba224ca

SHA1
acb7765998078026e0b6ffbe57e72d8d454bc54c

SHA256
5c62803659067e9c56afca377104d8f187d0393f629ecd6863fb165cff588ad0

SHA512
bdfd047f5678f72e612875b69f1944b9afd94cc6b61740ff32380a22e37b9b86ca59efe52b7a58358c15f75ae7c04221a48060d1c0f338cf40c156f9187501d1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_Documentation_url-0

Filesize
36KB

MD5
bad093419be1135cfe9694ea77088c78

SHA1
76204c7ca72cf666add9c9931389d635c82e8af0

SHA256
136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c

SHA512
3b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe-0

Filesize
36KB

MD5
6f0d8710c462b5955d9d16745bdb1bfd

SHA1
ed0545934a28799ef27dddcc0439d05dc40c47ac

SHA256
342f29784a85f25ec119d85e39267ec57a4c803fbc099f6c5ceb7761f8896cfd

SHA512
404085314a3cf37e8e66aecd314d63ea9711d05c1ecb714d531126e61b7bb9929e59e4a42cb736ddade1ac416d76477881d18b428bfd603fede3e9eeb7b6f8cb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{175f03d7-10d5-44d9-b745-1aafea784896}\Apps.index

Filesize
1.0MB

MD5
9dfafe498add3d29708eecb00967371a

SHA1
47ad4bade78d04a2a460daaf54b4b11211bec88b

SHA256
031e536c2dd798a3ba693e4b5ffb014ba06b9175e45b51846f663c318e1d0bef

SHA512
4de96f5d4bd63c36b72f4598943f5ee61e7473567cf904f06292fe3fcc0a4e31eccab3115c98d6000799a05aff8e21587f8feb38cc7cc6484135df788f66c823

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{47a3ed8c-d235-4688-93db-9b6b2f0abbaa}\0.1.filtertrie.intermediate.txt

Filesize
5B

MD5
34bd1dfb9f72cf4f86e6df6da0a9e49a

SHA1
5f96d66f33c81c0b10df2128d3860e3cb7e89563

SHA256
8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

SHA512
e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{47a3ed8c-d235-4688-93db-9b6b2f0abbaa}\0.2.filtertrie.intermediate.txt

Filesize
5B

MD5
c204e9faaf8565ad333828beff2d786e

SHA1
7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

SHA256
d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

SHA512
e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662143668243.txt

Filesize
77KB

MD5
21166b37f0e2f99c918f06af28d63be0

SHA1
fe26a7dca038ecf6b36a03058b44f3966919eb1c

SHA256
13e1ea8b5bc56db2e788e42efc71b2104fec392368c935be3f585f9ca67c803a

SHA512
8f13fea331e639dec1a15a51aa8ef3c72c533877994fefb4961dc41f54a43de4a6bdb269ab5aeaa01ca6fcf53891f6a865461076139e3536c50dcd2b12b44727

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663723895380.txt

Filesize
47KB

MD5
cb3c835fc52da4547a6cb9897ede57be

SHA1
9c24d5ce02566c79f727de45379dffdf62ebe7f1

SHA256
f4909f72e99bd64fdb03a651e54b8a4f7a1dd165215778e1ea5f4e922d40aa61

SHA512
88b0556be5937735d1f1749430862e10dcd99b58eb8d79c7b217039289fdacc4c9a5017bf7499a7e01673801d71c80b7069c6863e39238a42f88552dde10845e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727668321811013.txt

Filesize
63KB

MD5
63e34bf08fa7ea066623a91d65ff502b

SHA1
7a47215a94fb10c199e9b95cba44423d8893335d

SHA256
63c807de52658342ddf024ad11994acb25f26478875f6bfd64f21d6a30dda893

SHA512
0f314f16fa732989234f6396ce6475fa60139484528d0ea9cc9fec2615292daea10971f396daa80c009c13311de676baa2b39db7021d61e537e9150ca36f7501

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727669696291990.txt

Filesize
74KB

MD5
cb9e64e710095006c6ed625827539a0b

SHA1
b584ed7b2b22cb91fd2193dff71472ab312d2518

SHA256
ac756a77111eb5355c23a7b17434c07f126be4e91b1e8ad9f249d9e7bb14b058

SHA512
bc5d6bf9713961a0729408b8dbbfb9f15b30550ca12859cf69d2149c99465be540b56bba9c4247dd7ce8c2a0126a644f0ba6d5956c31d54dc7426c07d6ac831c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\settings.dat

Filesize
8KB

MD5
a8308d2f3dde0745e8b678bf69a2ecd0

SHA1
c0ee6155b9b6913c69678f323e2eabfd377c479a

SHA256
7fbb3e503ed8a4a8e5d5fab601883cbb31d2e06d6b598460e570fb7a763ee555

SHA512
9a86d28d40efc655390fea3b78396415ea1b915a1a0ec49bd67073825cfea1a8d94723277186e791614804a5ea2c12f97ac31fad2bf0d91e8e035bde2d026893

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDD

Filesize
147KB

MD5
daeef4aac632004c90fc13924911c51f

SHA1
d49a1b009c693f54f9353aaf945bcc0e681f24e0

SHA256
7e2f945785612066602d85aa4a053b4f363ed01e557ff3756c54f1b920b8e2d1

SHA512
2c6f05d0c4fcd5637dfcd0d93a118ae346a04c528dbe48fe13fe7e0c5fa4e628dbf9fb815b92cae6e88908f0e3982378defa2ba9fefe7f3979b4870380c96eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\wct1E1D.tmp

Filesize
63KB

MD5
e516a60bc980095e8d156b1a99ab5eee

SHA1
238e243ffc12d4e012fd020c9822703109b987f6

SHA256
543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

SHA512
9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9FF7E952-2130-4F57-AE66-F03512E27369}

Filesize
4KB

MD5
39d55ffbcc53865a5967aa4443ba4074

SHA1
2adc43ffbd0a07facb6a8bf721f9d981c718f97e

SHA256
f9d1b80bd7188f2aa27e21ef42098db65889c85407be47f501568e2786a1a73f

SHA512
a0e207930e64b2ed09576f5cfae1977d3334302c5b53151ba0da673db3bd3d137b48cad51130757c040f36acbb35c170eb8d5762a71ebb9dc18f0578c5e34a5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\8n5w9qlh.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\compatibility.ini

Filesize
200B

MD5
cc26e3da3f8a18ab0edaa8ba362f9efb

SHA1
4141308059d17d5d2d075bbbbd93450e2e1d1844

SHA256
c17ced564ba3438bd8fa8ca7d3c94897882692fa8676b4ea6bf4e260e971dedb

SHA512
a5d1c757788a1b38e2f96cbd814961402bbf0a690b86ccf2a7793aab22e51dc4b5d3a2e18ec6a79fd15126955200b56f12f189e924cd0f6ccaeebb4bb5f9ae34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\sessionstore-backups\upgrade.jsonlz4-20240401114208

Filesize
869B

MD5
7fa800b4c031b777684b86823d05fe66

SHA1
00f576c4d766c8737252e99865ea7d0550e178ad

SHA256
843de2dbbc42c4ee96ebf5bc05e24283eacac1c08b3e89e7d42163d3a0777c90

SHA512
507a6c33d5382236e742b1b0171461355575efd0b3647c61af586c04447d9b9f88a6ca94c51e68b364eaf285a73167b4812cb16b7119abec1a31600f596c9d7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Filesize
32KB

MD5
b7c14ec6110fa820ca6b65f5aec85911

SHA1
608eeb7488042453c9ca40f7e1398fc1a270f3f4

SHA256
fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb

SHA512
d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

Filesize
48KB

MD5
279ff644886e2850d59d68fc513b2e38

SHA1
cf6e37bb8f070d1b13238392f13221dc9aa4bae4

SHA256
73a8746acc2f518002f603e8e4655ea9d45fa00a9440fb588654428aeccbda66

SHA512
5545d716cd6c390327e6182fc84a720e3fb054579c3ed216abbe14a3485806c57e491da2f17d0d030579b8ccc6e898fa30d1c3711d56a5576ada65606b0d2d51

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

Filesize
4KB

MD5
c9f82fcabccfa2c6131116c43acdcc54

SHA1
39d1a407adf7afb4e8b215568fec1f2f609d25a1

SHA256
f26b2e485622c582b839d5dfd0a0c916fe2f28bc6924c9b091b667977b812217

SHA512
b3588ad2ee1fd3346103ec00dd4231e3dd42411f6ed93ff7d455cac2a06b074b654de44226481fff785aaff22b874ea565e721ca4cf4a72ce618338554315273

Download Submit
C:\Users\Admin\Downloads\LB3Decryptor.exe

Filesize
54KB

MD5
e6f0bd14b9317b1120d9620c1fd5a5e0

SHA1
a34a49dc4726e358be5de7ea48dd5da2b8991bf7

SHA256
b8ffbc5e1be082689f94df49a1cff036f091086839e037b42851968afc07e26a

SHA512
4b193ae8810f4ba2a03926aa664bc9a269e065bda62ee5a023bc45838501a7c471a081b1c0075b186d28c957fda4cf01b8e5accfe646d8d2ca879d8529dce64d

Download Submit
C:\vcredist2010_x64.log-MSI_vc_red.msi.txt.IoBMyuygl

Filesize
380KB

MD5
897348f7efb05937218a07cf5a187d11

SHA1
4efba660788b14049630de38b7287ea24c178615

SHA256
00ead19bdd710d5f1ce54297842995aa687280a0156396acc17c301547af655e

SHA512
7bc443261915c4c4c386ec99fa54e62e35815bd2647f86e86db5f6a26db3a8216f9689b3e37705b1350983f408ca767c0669a4df20fcadd7a72fa94effca1dc0

Download Submit
C:\vcredist2010_x64.log.html

Filesize
86KB

MD5
447c4c2d121997527442fd47860af010

SHA1
e96165987d8845f660b76a50469b79376d3f3117

SHA256
ee3ab81487f92011c32a1820db5bb88b2149dae732ab51c19f0222976f58b642

SHA512
00cab6d35a739302fbb10654222b7e2ebc8ff877ec40d51fcf1846004f5ff6ced034074a0418cd6046bf1f85ce81a1d99c625f791b19c0bdae986e4fcd0972f2

Download Submit
C:\vcredist2010_x64.log.html.IoBMyuygl

Filesize
86KB

MD5
b4e50d56e5a617cf75eefa116b321fff

SHA1
0c14131a06be84914e3774c6f656c9ac18b8624d

SHA256
b13860a2b4a04f912496ba56a56e5cd4b8b707ddac7c0fb2a558f044dbce98a2

SHA512
5dfd99e28aa173f5235472e81efe47758ba4db523a80a1abb8f08c284a502b6ec548c0d1965a93ba44c3bd68476426bca614fe28d40f8e4716d5c60f3b901779

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.IoBMyuygl

Filesize
395KB

MD5
faa3c1429ea180389d983e24344e3b8e

SHA1
ce43ba110ede2c2036ba7ec2fb765d9dffb361ca

SHA256
d915d199f91358d7580a1c49fd2316345e3de1e3fa8a736ce2f3cf3012fd6b8e

SHA512
4d6ad47e4c64d241a5e7b83c6960f88ddceebb866c91fd987eca6fd1a28e4f167f465c5963d3e7c6caee902bcc84015e6905426274d5916f4e674c3313add00f

Download Submit
C:\vcredist2010_x86.log.html.IoBMyuygl

Filesize
81KB

MD5
8f562f898fb0fa72c85cc3d838b1570d

SHA1
19dc28528c0cbd036fad34d3a821f4b205ae4c64

SHA256
f57202d01d491b926619e86801aae433d14fa4a713edf9a8a481a5d2f9af3c7b

SHA512
d879d4cc197cd8792bb8b8715959dd788f4a0a1261d0aa60d7039a43bd713c073c51ef63635c9e571c8f6f8c55c31a316493b051a1c4941fd81276e824b50353

Download Submit
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.IoBMyuygl

Filesize
168KB

MD5
336593c080f4f28e2281b400510bd5d7

SHA1
db4c0077fa740190f95e5f56245d036de85f746a

SHA256
7a62ea12406adc0a91709808544e3e533848b58f169fb070b3371e9772e68e09

SHA512
70b0c29afab932550c7aca8bc088ed8f4f5da725be232364272c5396de51c49fb9c4ea8c0286684445c6abc5a84392ca9df9d0c387d0fec0c7d9f55821ec86b0

Download Submit
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.IoBMyuygl

Filesize
195KB

MD5
1143b27ecc4fe32cff29ac4d707b804a

SHA1
3a8d7f2eafa1051153c5c779efed117c70d4de57

SHA256
a892022656870b8cd8d3d7dbd4733723a29aac8a6ad4e1e8ad8f5fb1e8c1b3f4

SHA512
12e519bab773b41e71006caa0f432f0d415f09bdde58d07617d80709d5a91549f3f255b398a0f1cfcd6442603930e77d2f229d1dc4d28c60499df3f0118491ba

Download Submit
C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log.IoBMyuygl

Filesize
171KB

MD5
8f503b8efb486054b02338f46e4bdcec

SHA1
eb42ede076a41161c21551aabdab03081272a85c

SHA256
2dc2d2fccc29c7254b167ef8d9887fd659ea42269dfcbd7f9f2162623f17318b

SHA512
ad27341474109c1ef35cba0e989af6886199d719f32b10c80c021571afce1da98c8b2fda593039f6a274258dd681423d68f7a815c37a66a40fd175b3d0ad2cd0

Download Submit
C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log.IoBMyuygl

Filesize
208KB

MD5
34365f4c6c34cf62f9d4ce330b604758

SHA1
ca29dc995fd4c5de1adeb7c41ed00166b506c087

SHA256
429e6ac3576fa82b5a624be6cfe5c0b5c52e5127632436297bd3048c4a868aee

SHA512
40c7b3954f7c8c668dcff20815caca199980ce4d3dba6dccbb5362a47856ead50fcdce4fb14b40bb1015735aa24493dc9a44e281318402ed1a1220bd4dbb67eb

Download Submit
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.IoBMyuygl

Filesize
170KB

MD5
f306efeeaba2c94b4257904de9970b0f

SHA1
6cd7d45092ae0e725b59275c0fce4ba3d448b94f

SHA256
573b911c0a1143e1befbcaafd9dcc12a03e2728be196a7f647ad632a7fe45b62

SHA512
632de87f655cf3e997853826369bf0eba5c9b3b39ca92316103b2e0c7f03f8e2d16930adf740eaae651a3f64ccd0ee94af693d4dae1aa8b0b020c47dfbcb6085

Download Submit
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.IoBMyuygl

Filesize
191KB

MD5
cad77591456a627cf77c428db38f78b2

SHA1
550bea3c4a6e946826a0135534e6f20e22a825d3

SHA256
00db352e6e73216777f05c3a5feaacb975527f82227087d351ab12fc2b93d904

SHA512
0ff45687c48ce1e3f8a9b1830fb7a43d2b72acfdd8efe636904848827dd674786b8bcb552e38acf448f2d3a619864a6d79a2314544cc4c69d5fb68e0794407c8

Download Submit
C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.IoBMyuygl

Filesize
170KB

MD5
5bb2a4cc5a23f1e257d25d5f5bbbbf48

SHA1
df711acd21b13049023d7a9a3a32491dd5679570

SHA256
158f0b6cc192632835c1c0b73519e5d576d960ce41cafdc06d038101a1c282bb

SHA512
6816170873fdba87c26d747b96a41f6b1be7b9b20fd4e7621f0780506c66b463026edd6128cd37efabb44c8a389571315adf99723bb214ec462495ed84f01a0c

Download Submit
C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log.IoBMyuygl

Filesize
198KB

MD5
0b000ee1611285380276499da75255a6

SHA1
af0c0355dedba8741a888696f223e4304983cc21

SHA256
c8825fd094ef427350b080fdacd4320010d691b512339dafc7b24f182ed36694

SHA512
17d69d5ab598569e9c57621c59ef4779177ffebcc57fa344bcdbe1c0f14e92a8f0431b9878879b2d62949977de6115a4a509c5bd1c90cd4de74b11426e3d0d9a

Download Submit
C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log.IoBMyuygl

Filesize
123KB

MD5
02f4346462876af64acc4f5deb9e4b35

SHA1
ce4d1a5f3147deb34cb28541380d13ec902a2648

SHA256
e6648bd2395d794b9d390fa9e3d0976e2526e195f17027f81ed983aee9877d7b

SHA512
607192b398612a3152457448d75076fcb4b139f5515932181dc48b6711a0b91ab0fd302a1a55a420f37dc6709fa9aa1bb69170ea4af6966a39d13ada0af04985

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1045960512-3948844814-3059691613-1000\DDDDDDDDDDD

Filesize
129B

MD5
4f9a737fb5c792d113d4ad73767346fd

SHA1
bd50543c46e7e370b188b6b4667888e93e347739

SHA256
7276695653cf7850d8b446e69432d42a95f8f0638d3f7bb2f5fcddbe8ac46a1e

SHA512
c34cec1a1ae66deed02f91d0aab2113cde1829be0937cf81c11e10679e9aa42ade47d689b90fdff39018ad835afa82f15db048c1eec473d7ad7329c64dcee683

Download Submit
memory/3284-2938-0x0000000003400000-0x0000000003410000-memory.dmp

Filesize
64KB

Download
memory/3284-0-0x0000000003400000-0x0000000003410000-memory.dmp

Filesize
64KB

Download
memory/3284-2-0x0000000003400000-0x0000000003410000-memory.dmp

Filesize
64KB

Download
memory/3284-1-0x0000000003400000-0x0000000003410000-memory.dmp

Filesize
64KB

Download
memory/3284-2940-0x0000000003400000-0x0000000003410000-memory.dmp

Filesize
64KB

Download
memory/3284-2939-0x0000000003400000-0x0000000003410000-memory.dmp

Filesize
64KB

Download
memory/4920-2958-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/4920-2967-0x00007FFE0A260000-0x00007FFE0A270000-memory.dmp

Filesize
64KB

Download
memory/4920-2960-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/4920-2961-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/4920-3260-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/4920-2962-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/4920-3259-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/4920-3261-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/4920-3258-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/4920-2959-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/4920-2982-0x00007FFE0A260000-0x00007FFE0A270000-memory.dmp

Filesize
64KB

Download
memory/9996-5120-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/9996-5121-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/9996-5122-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/9996-5123-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/9996-5124-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/9996-5127-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/9996-5126-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/9996-5125-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download
memory/9996-5119-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

Filesize
64KB

Download