f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214

Resubmissions

13-01-2025 01:41

250113-b4f6csskhq 10

12-01-2025 23:10

12-01-2025 22:49

12-01-2025 21:15

12-01-2025 20:53

12-01-2025 20:52

12-01-2025 20:50

Analysis

max time kernel
842s
max time network
826s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
12-01-2025 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Size

136KB
MD5

bfb932c0c15243704cf27cb8c7eff520
SHA1

8c9e5e096e0f5855e435978b932d8ab63e859a29
SHA256

f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214
SHA512

b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5
SSDEEP

3072:3LVoDvPd+A4WhkhXDl+i1lApwH08TdpIIIIIIIIIIIIIIIII/IIIIIIIIIIIIII/:ZopGGgbiwU8JY

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spooliw.exe"	spooliw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spooliw.exe"	spooliw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spooliw.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spooliw.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spooliw.exe"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	spooliw.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Disables RegEdit via registry modification 4 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	spooliw.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3506525125-3566313221-3651816328-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1700	spooliw.exe
8	spooliw.exe
376	svchost.exe
2796	svchost.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\spooliw.exe"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3628a120-1930-4cdb-af4f-731b00aebc81.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250112205411.pma	setup.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Studio MX 2004 AllApps Crack.exe	spooliw.exe
File opened for modification	C:\Windows\svchost.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Crack.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Crack.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Keygen.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
File created	C:\Windows\message.htm	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Crack.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Keygen.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\	svchost.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Keygen.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Keygen.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\	svchost.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Keygen.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Keygen.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe	spooliw.exe
File created	C:\Windows\spooliw.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Crack.exe	spooliw.exe
File created	C:\Windows\svchost.exe	svchost.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Keygen.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Keygen.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Borland C++ BuilderX 1.0 Enterprise Edition Keygen.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Keygen.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Keygen.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\iMesh 4.2 Ad Remover Keygen.exe	spooliw.exe
File created	C:\Windows\message.dat	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Borland C++ BuilderX 1.0 Enterprise Edition Keygen.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\BearShare Pro 4.3.0 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Crack.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Studio MX 2004 AllApps Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NetObjects Fusion v7.5 Crack.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\BearShare Pro 4.3.0 Crack.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Keygen.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Keygen.exe	spooliw.exe
File created	C:\Windows\spooliw.exe	svchost.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Crack.exe	spooliw.exe
File created	C:\Windows\spooliw.exe	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
File created	C:\Windows\svchost.exe	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
File created	C:\Windows\spooliw.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Crack.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Crack.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Keygen.exe	spooliw.exe
File opened for modification	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\iMesh 4.2 Ad Remover Keygen.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Keygen.exe	spooliw.exe
File opened for modification	C:\Windows\svchost.exe	spooliw.exe
File created	C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NetObjects Fusion v7.5 Crack.exe	spooliw.exe
File created	C:\Windows\svchost.exe	svchost.exe
File created	C:\Windows\spooliw.exe	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spooliw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spooliw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	spooliw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	spooliw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System	spooliw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	spooliw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	spooliw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000fbcb0fe3365db01	spooliw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	spooliw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	spooliw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	spooliw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	spooliw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "3"	spooliw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	spooliw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	spooliw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	spooliw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	spooliw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	spooliw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	spooliw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	spooliw.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S"	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe

Runs regedit.exe 1 IoCs

pid	Process
4536	regedit.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
3220	msedge.exe
3220	msedge.exe
8	spooliw.exe
8	spooliw.exe
2332	identity_helper.exe
2332	identity_helper.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
8	spooliw.exe
8	spooliw.exe
8	spooliw.exe
8	spooliw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	taskmgr.exe
Token: SeSystemProfilePrivilege	4032	taskmgr.exe
Token: SeCreateGlobalPrivilege	4032	taskmgr.exe
Token: 33	4032	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4032	taskmgr.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe
4032	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1700	3920	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe	80
PID 3920 wrote to memory of 1700	3920	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe	80
PID 3920 wrote to memory of 1700	3920	f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe	80
PID 3220 wrote to memory of 5028	3220	msedge.exe	93
PID 3220 wrote to memory of 5028	3220	msedge.exe	93
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 3040	3220	msedge.exe	94
PID 3220 wrote to memory of 892	3220	msedge.exe	95
PID 3220 wrote to memory of 892	3220	msedge.exe	95
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96
PID 3220 wrote to memory of 3752	3220	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
"C:\Users\Admin\AppData\Local\Temp\f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\spooliw.exe
  "C:\Windows\spooliw.exe" -xInstallOurNiceServicesYes
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1700

C:\Windows\spooliw.exe
C:\Windows\spooliw.exe -xStartOurNiceServicesYes
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\PushOut.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x140,0x11c,0x7fff00f146f8,0x7fff00f14708,0x7fff00f14718
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x164,0x168,0x13c,0x15c,0x7ff69f6e5460,0x7ff69f6e5470,0x7ff69f6e5480
    3⤵
    PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,677911643239461566,15820883050840987622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:2192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Windows\regedit.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:376
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs regedit.exe
  PID:4536

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Windows\system32\taskmgr.exe" /4
1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2796
- C:\Windows\SysWOW64\taskmgr.exe
  C:\Windows\system32\taskmgr.exe /4
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b712a4c83dfb3c522d032cf900e863a

SHA1
4f5bec4be6f4ebfa959e899ceafc62309bb1f141

SHA256
31da2a41a051db11559c47feb923d4baad32a384f530013a435fa884dad64493

SHA512
03b24d9307623b3a341230805f3ea662b0107c314650a51ae7e89d901cb3ad212d4219bab4d763d0aa8d50831aa0e6d4e3379573cc2f724873804578e8642898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
24dada8956438ead89d9727022bac03a

SHA1
09b4fb1dba48ec8e47350131ae6113edd0fdecf0

SHA256
bf1e5c7828e4672982b16451b5a201e65e812e98a97b87c9f2f7c22677cb4ec1

SHA512
03f092a4b20a4d8cc111220b35fbf5470878b7723faeddee65b1d9cf327167053792c77864103b4530b9b9f819e32a5721b44189291dfdb5832769835ea5dd94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
41aa929593425ca6ae2f16b349deb996

SHA1
218b5e5ab9bd8ec368d2e8ec7c786ffb74339dd0

SHA256
3ef24c736e517af12f65eb182e72d78c0550c288908d7e29d1239f86aa964252

SHA512
0bd0cc71bd9124bb1fa76eeb53373d4c1e03211c061f0a4191022cf454cbf3e854b02f9e833cf79b85e1010aa62900bb17f5116af5258aab9c9683a2bfa854a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8063b148f66f63911b8ed575ada3d195

SHA1
457bd60ba6d6594e65a9801dd10da8c97efec023

SHA256
a5505738378beb0615ad1f4f57ca9efb0cab50dbbae8c812273a88148431c985

SHA512
58ccb4a90738af78453070664032d7622e3d76cc8fb66cff881db9aecc2cd3a8a16295856c2a063c8a19328acb62158ee9697ef99ab33ffa190d7984c49401ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
c36fce220ca144710c29b1954ca3c0f6

SHA1
a057b9cff0be9b24703c50458d9f9ba2be36a514

SHA256
e7e368403af38a641df3d463b61d0308b87086c218973414f7b10bfaef46760b

SHA512
52e436518e60ee9fe64d3468369c32bd432ea5c344dca359c71f0c5509f6fec2f31423e3a56cce07e4736a97139fe5ef6b38e8716460f728d626d8dbacabd723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ecc86cb3175d09e6564981e38f074255

SHA1
f3ad591baa982d24b5d7be8b2b520af58ef11ed4

SHA256
806dcab5a6c091bd181e88bca1686ec81d6fe28a8109faa08b578e9270b11bd6

SHA512
a7d24db2a84a06b297ff84f3c6c3f701f4a3a9a194be0bef379e82c59e4d15b9776e0c4ab93860e62b28abb8665b88aca9a0ef64d63d86b564fec6817e80ed5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
85eca930a791cbcb1373f5fdaf17857b

SHA1
ffea7d54e9803374a484f1e4c124766e80024efc

SHA256
fbc990061790350f00dc28f2dda277aac81bb8385a6e92e90a20101436c3312c

SHA512
2ffe0de3f80ac60f2ffa55f334026979e6be328b7c69f4603aa3c5d1bfa6c3b3744d86ac2a34ecf904d0a41b36bc485392ece58f6cc89d7ffca293d02efe5bed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
99a7edf9124dba808b6d025b14aea278

SHA1
f1de2fdd81ea87ee78e8afdc1a7cdffcf62a92ef

SHA256
9d38a8d193a503b9be7b39be5d150bcf22038c84fbf3d53979e2f075a35b9089

SHA512
fc371b7ad5606a9948ba4a315e40a0a93592f57103be4a3712020977b43e4277d95d74ff35e490239dbce1cc475fe1d1746764f5970d2e9f04483c985268f5c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4ccfd848e0ed033deb4e5c4f3590a082

SHA1
f57ea1ddf7759cf60ee123419787b2040ecfa4a6

SHA256
b7723019ad55650a926a0b723750926dc69f5cfb65240e3994438aeb4bed304a

SHA512
2fdeb71cef73013b7b0393487ee92be7e5e5b53991a6800d364d70aa7f1186e738008f51759f04c35efae26d30986a68d3953d15227d1a1c32a5147c15ce826b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d51ca4bc31ff0c202c03e2dfb0aaf4dd

SHA1
ec8b2dc3486b4d65b8422141b675c10afa9efdef

SHA256
827c34a9d4c0ebfe823d93f20a3fca5c1542ff83dbca7be04a126ed1e40f238f

SHA512
ee78e8a5836a0fe80af816f7e1b71e1589939ec3beee6d9327cb2a80b939a03061ba22061f3f4dad0f5d96921bd8bc9b8e96fc47afcb262950b784af13867178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9f60a32b3f1d9b74969b848d28158c82

SHA1
5e7e3e0fe72d5d782b6d77e356081034ba2f1b00

SHA256
39c43860b90a3b3ba24825bb927498eac4e860a62042f63bac6b525639a227a6

SHA512
a81ebbeeb9761138326e0212ae1d73b7f92a99da09a1e790a3171ab792cf0deac34d56ca30585c7b53be7eebd97b551f968d8d2b9cb97d347ccc455255dcaca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
afda22573c8a0d67815fb32cada60e2a

SHA1
0eac567ce145582642b094a6c9532b3d5c0cf24b

SHA256
07e728a4fa8dd95b4ec8fea0d774b06e83bf5dd3a663d60b000331eb6602d828

SHA512
4a2ab2c0d0a4582525d3dbcfc5684dabeadbab6dbcd2a9be4cb1ea0c30e213369c7ce82e47d566e8028eeffec7730fec47652bcb486f1b716d9a82ba1b2410d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1dd0d8ca24aaff640055eb7569b34517

SHA1
82523351281c7fe8f5185a3df23e02a0fdee5a6c

SHA256
9a5597a93f8641165f1ce34e8c82fd4cff4296c6f7aa48bef3b54e945339f408

SHA512
d72e0dbe909759ec9098db23c21e7e388f8efd9f1a7d3169214338087e18716a0cec69cb878a8682e046e3df558cedd5a58e8edd695d61b00241f950139d50c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
fcdb2893b632346cf9d382981b5c455c

SHA1
2e0421e5db4b8a86cb04da88a70ffd0847a30000

SHA256
061f1d938704958366c3be930de63274c594ef72d4fdd59a1ca5da21aa0096bd

SHA512
704f75e99cd827fb5e26dcf83eb6114a725a123b9aaf703e249823134608a1adb57ea53fe4e6eb071368edf0c0d96db74ff08c500c4a846bed33063afc4aeab7

Download Submit
C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Crack.exe

Filesize
136KB

MD5
eaae1378fe554f3acf9fdf720cf7e874

SHA1
218f17257c8a8001eeaab9139135849da76188d2

SHA256
4ddeb672f697a2c1c6b7f08a35398234520e3d68bea84a67419db8aaf0b96758

SHA512
fdfdd41191dbee29a27b4862bd0bff360ff2b1c77d9060e6c8d3b9b752ecedd68c6557e610c3c913ed1d6f4b94476906cfb3c8d610c6f7f7d4d09c6327743e4a

Download Submit
C:\Windows\spooliw.exe

Filesize
136KB

MD5
bfb932c0c15243704cf27cb8c7eff520

SHA1
8c9e5e096e0f5855e435978b932d8ab63e859a29

SHA256
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214

SHA512
b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5

Download Submit
memory/4032-287-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/4032-288-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/4032-289-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/4032-299-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/4032-298-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/4032-297-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/4032-296-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/4032-295-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/4032-294-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download
memory/4032-293-0x0000000006260000-0x0000000006261000-memory.dmp

Filesize
4KB

Download