hxxp://youtube[.]com

Resubmissions

30-01-2025 19:26

250130-x5yyfssmen 10

30-01-2025 19:24

250130-x4cntssmcj 10

30-01-2025 19:20

250130-x2afpaslfq 10

30-01-2025 19:16

250130-xy5sesslcj 10

Analysis

max time kernel
186s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2025 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://youtube.com

Score

10^/10

defense_evasion discovery trojan upx

Malware Config

Signatures

Windows security bypass 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	antivirus-platinum.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Control Panel\International\Geo\Nation	302746537.exe

Executes dropped EXE 2 IoCs

pid	Process
1292	302746537.exe
4736	antivirus-platinum.exe

Loads dropped DLL 3 IoCs

pid	Process
4996	regsvr32.exe
852	regsvr32.exe
4736	antivirus-platinum.exe

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
150	raw.githubusercontent.com
151	raw.githubusercontent.com

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023e27-830.dat	upx
behavioral1/memory/1292-839-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/files/0x0009000000023e24-850.dat	upx
behavioral1/memory/4736-851-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1292-857-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4736-860-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/4736-861-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/4736-876-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\COMCTL32.OCX	[email protected]
File created	C:\Windows\MSCOMCTL.OCX	[email protected]
File opened for modification	C:\Windows\MSCOMCTL.OCX	[email protected]
File opened for modification	C:\Windows\302746537.exe	[email protected]
File created	C:\Windows\__tmp_rar_sfx_access_check_240721078	[email protected]
File opened for modification	C:\Windows\antivirus-platinum.exe	[email protected]
File created	C:\Windows\302746537.exe	[email protected]
File opened for modification	C:\windows\antivirus-platinum.exe	attrib.exe
File created	C:\Windows\antivirus-platinum.exe	[email protected]
File created	C:\Windows\COMCTL32.OCX	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	302746537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antivirus-platinum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
3628	taskkill.exe
4312	taskkill.exe
1536	taskkill.exe
4068	taskkill.exe
3856	taskkill.exe
3176	taskkill.exe
5104	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Key created	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Software\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS"	antivirus-platinum.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D90-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Version\ = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE7-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8B0-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\ = "IButton"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8E-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6597-857C-11D1-B16A-00C0F0283628}\ = "ITabs"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\ = "DImageComboEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D8-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\ = "INode10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\ = "ListView Columns Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\ = "IImages10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{373FF7F2-EB8B-11CD-8820-08002B2F4F5A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\ = "ITabStrip"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F049-858B-11D1-B16A-00C0F0283628}\ = "IListView"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8D1-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A2-8586-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E1B5150-DB62-11D0-A0D8-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\MiscStatus\1\ = "172433"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl\CurVer\ = "COMCTL.ProgCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ = "IPanels"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Version\ = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\ = "Microsoft StatusBar Control, version 5.0 (SP2)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
3576	msedge.exe
3576	msedge.exe
1216	identity_helper.exe
1216	identity_helper.exe
3304	msedge.exe
3304	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: 33	4016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4016	AUDIODG.EXE
Token: SeDebugPrivilege	3176	taskkill.exe
Token: SeDebugPrivilege	3856	taskkill.exe
Token: SeDebugPrivilege	4068	taskkill.exe
Token: SeDebugPrivilege	5104	taskkill.exe
Token: SeDebugPrivilege	4312	taskkill.exe
Token: SeDebugPrivilege	3628	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe
4736	antivirus-platinum.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
1392	[email protected]

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4736	antivirus-platinum.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4724	3576	msedge.exe	82
PID 3576 wrote to memory of 4724	3576	msedge.exe	82
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 4588	3576	msedge.exe	84
PID 3576 wrote to memory of 2784	3576	msedge.exe	85
PID 3576 wrote to memory of 2784	3576	msedge.exe	85
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86
PID 3576 wrote to memory of 3044	3576	msedge.exe	86

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	antivirus-platinum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	antivirus-platinum.exe

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3204	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://youtube.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe857446f8,0x7ffe85744708,0x7ffe85744718
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,14134672517014524323,16174225865186748477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x154 0x324
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3160

C:\Users\Admin\Downloads\Antivirus Platinum\[email protected]
"C:\Users\Admin\Downloads\Antivirus Platinum\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:404
- C:\WINDOWS\302746537.exe
  "C:\WINDOWS\302746537.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1DDF.tmp\302746537.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1220
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s c:\windows\comctl32.ocx
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4996
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s c:\windows\mscomctl.ocx
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:852
  - - \??\c:\windows\antivirus-platinum.exe
      c:\windows\antivirus-platinum.exe
      4⤵
      Windows security bypass
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies Internet Explorer start page
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://secureservices2010.webs.com/update/update.txt
        5⤵
        
        PID:3328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ffe857446f8,0x7ffe85744708,0x7ffe85744718
        6⤵
        
        PID:4764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h c:\windows\antivirus-platinum.exe
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3204

C:\Users\Admin\AppData\Local\Temp\Temp1_Happy Antivirus.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Happy Antivirus.zip\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
PID:1392
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sidebar.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3176
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im iexplore.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im opera.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im safari.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0504c0d0b9c007a767de8a404f2ec484

SHA1
73b1066ce283079341bc94a3e5c65535f0523145

SHA256
3469f4679beea250ce59f3fa4721e48f81587735f44e0fa2b70638b78dbf8a2d

SHA512
c6c0c6edbaab3b92832c4140916e99ca6725b79e5d3a43ad59ebd94a567458ef79923e2236b43344ecb6fd75442d0c7779b024edbd1bf9035a2a86ba7e5ce606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
50236cd957789ed0d1b6564c7f0ecfae

SHA1
4c9e4dac57ab9ffb5bc55154d6ff89f1e6c1d5f4

SHA256
5820467c07d06249a1462b7c9deeb0801a8a6475ea19637397b9bbbc95f90fcd

SHA512
1cbf4be5224fecf811bf81361d6d282810de016194b17e2002d510287d384048272215b813838912eebcdddb1f657ade0aa3c122871c9d636b6a8fa8e74535d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
48f3a3f32770ff69523728a956331caa

SHA1
1053feb21b270751700c902acbc88e950cb46f95

SHA256
70ff882c858e734b3db3dd7f0e85c4ac4cb010f839be06968e6b60a985e23a61

SHA512
1d911bfb2a115d0d14eeff032eea2f295dd81ce978460b154ead8c1ed6d75bc7e776e53564ec5bcf0801782c8ab12856a82cb3145466fca43e51f11e43f6e927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
055577d2b85b5da2e8f7cf12158f57c6

SHA1
edfaf3276608ca971b605f1eab1b53ff4e3c47be

SHA256
115217987cf5ec239dc19c4e0abadb7cd7bc7a248c6561ed6039912a245d827a

SHA512
bcdc4975f895cff1a72f80431c0ca172109a950df0e21801ddc2c2a7f52817051102fc65d7bdca6366b3888287716bdffd4dc44b7a86c9f42c1c1b206a97279b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
1d7cae11171b9ea1550dbf03d415127e

SHA1
85bd29535170e0f6f2339b546d9e9b206dbbe8a0

SHA256
d6a804518f874bfd1d575c3079781d466190867a23d91b41bf3d52a38d2cebf8

SHA512
f3edf132fae7592fa5f2d61e9b7233e2a0924565e5baa06b54e707b19da947463c343bc80b7bebd84b5cfb889226e156ce6404bf3618e3604336e3c8ff59d451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
220afbe0f15c5d564f9cdc0bdc40ff89

SHA1
6e8a116c2e9291db922748819f33bc93049b6556

SHA256
2bed7c6aa743a874c9a32bf39a5f949964fae9c1cfafb0306978921418ce4b5e

SHA512
e6faee5ba51495d9f025a38454dc79cb9b6a2c298246ff33a69f64989f90ab03e637e3918b08bfcfb60ca5f9ef1115855c7c085abbe0042012ee587e04dab734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b3efd18f8945db7660aa7d826942c6e

SHA1
2c38664370e71952a14ac8119ba09bc46d61b08a

SHA256
5d10864e6a7927c0fe9bf6e7d93757524303741e92bdb01ac2cd20405771d3be

SHA512
f8b9a45cd6869827700eb32b9846e8a15ef4a539decd1e9c0122cf73a38ad42597659398c1a3082c86cad7c70e879e75c0395903c7f33b89cad1bf2a5f569245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8fefe035478373ba99788bfec1776297

SHA1
e6af16bf47b3d9bc5363fe1e92c4c172f4bfbd4c

SHA256
2b648c48ad043dc88212079403ea04e99703be2c435f5e9c542bdab98208f340

SHA512
144274ec66fb78992a6892db367689dab77852bc34f7b4b188e0c6335fba48516a060c73ac7fcb33e52a272f1f251271c15f8d721e517917d3454e4c7ad1a3a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1ca144f3dfd0a8e7751f827d137fb7c5

SHA1
490bf19009b44ac216bef51116728f101438cb13

SHA256
0b3ba09a109613fc379777c334dba8f3056dd06a0e1c2f9ebfebdf9be3c28e84

SHA512
27242c2388eaa53cacb69b8ecf6d0516b96f5aedb04ed92cd3d8a03201bbc2d58e32346d6bf98f9f88555477fe8765395a5fe5916af85cd70fe08f9be1d1f535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c82d8831531ec85a092668188e1f7547

SHA1
9ff045fa5bb16c22055939378b53cacc8daf224d

SHA256
6b51b2503d6da42896294a933b26cfbe5eec28b6cb55f4d87527f5088d95d41c

SHA512
6d7c2d2209eb19fe661f66b09e1a39262c3d5f9f5ec719f44234b89883acd64ec22ab4e4d402070865ef6980f9c7e99fcf72c1cff61f93fe7315488df423d7c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b9910120dbe166a25638063e5e091969

SHA1
03ccbf058e9d48fe9edbf935a17ec046844cea18

SHA256
0300e0f51dabcab25e2a6bae00e7985c3c882240b08da8dba0cc25a27dac8d66

SHA512
e1bc80d7f985f4dec2f5af7501424ab458e84edeaeb23e8269722e889b6ec66b59ae067eb57b6a727cf395380017ad090c843b493f85b31d859134e06329d885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
422b6f091c59e70c5f2b91014b6c7ba0

SHA1
523df36d3bed730542c539f165bde3a7f8c49989

SHA256
2b63f0416cafb0d458bcef7716230cbc4714bdbddf234b04fe0b42dec4f931bb

SHA512
5e39dd97a5027d5116fff911aca23f4effe1f3e92266303dbb7dedef5944898e45abc58b65a581b37116627a40aa1cdc99dfcee93a31c5902fd4dd48779ca943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
731d01aa4d59af093ba550cc838f0dab

SHA1
d579fed70ad5cea32505efdb9cc266f05c9a2488

SHA256
f303706322c9f97f90e7df0e3535e1a34351a7a37b51bc06b78d029169fc235d

SHA512
667178c91c29a72a6a32e8ae84527904f38281277cc9bd2c5d4880dfd9775a92e93a45c5f380bb348fa351bddf57444cde4a91cd535bb0a4f0f33c155d9b045c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\90ddd39e-bb32-4515-aeb4-4e880180b278\index-dir\the-real-index

Filesize
2KB

MD5
4b567bd967493692830b1eda2633d5be

SHA1
ae5a56e1820e4feeedc3ca2100b9d2de2eea5d3e

SHA256
923b41ae2b0fb48e6baddf5aae54ff3cd7f97dc5ac5ddf78ff776a9e283ff690

SHA512
03a6eb72a31df0d88f6ce959732d7d52b51418b8c0d958d3e5936fc49b7459b184e60c9d96181d82c23ad260cb096a0ccc91d56f2fc7a1b1726c4c9b16aae58e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\90ddd39e-bb32-4515-aeb4-4e880180b278\index-dir\the-real-index~RFe57ea60.TMP

Filesize
48B

MD5
ccd3c369b7204d60f9f662b8734c0e6c

SHA1
d142d4e95c94333e8c1bff8532e2885ebcd73cbe

SHA256
a46a1ec4eee87bf7682bc0ea21ae8fbdf23efa9a811a437996b38d86f395a6c4

SHA512
7007b39c8a5466232aaab53a09a6c5629b5734188544c841a52fb775c1d84f9de2b4a85670499ad585b83dae8907ecd809c3ef6cb2d7319dd88b1d52471d695e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
8c4886c5e6d1dfa12f07007b63ef8b9c

SHA1
2a866899d67bb1a579eec54e606950a74e169185

SHA256
88ac658bb7ce4f9f13165206195e189af1c9a57e60e3fd4f995de800ed15f7f0

SHA512
2f94508d14420cf575e12a1963e3de401c82f2c8ca4112a8949c2efa2789e19a99d5a41d52d0600a4f18c4d4980908c6deb92a95236565861f5aca475b8c1755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
96cd4c0a52478656fc3ed63d22a67657

SHA1
a2f8000d4ce295a2fccd0654e46d7823a1b2f0b0

SHA256
2229253768974c1eb6159fd7308473e80b2427105bdb7f9b3f5d5f8b17b50fb7

SHA512
77f1bd7a0cae4af4079caf88ffa6045cc843a823f6705b20d332d1eb08552f2d540c32d663d1755d882520d74f05953a9a821680847f4a3aeb133f9e3bc0881f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
7b77f5cbb3eff50176ebb77fb7b36b8e

SHA1
0a39287f6c98d7fdbb2161a17344f503bb9d8362

SHA256
163032326f04d7a0538d28f142f92897415c757360091b91540b6024f08e9764

SHA512
da6895cbfc577b46151ca46f650946a1facbc95524c90982f7fc0e9aa62a50533ef847b9f9ac8f16c7b282169f3b79a4f40f0281bb0ce49f46625188a2e6332f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
6af8624cc07ec5a72b8cd41f9673564d

SHA1
ae750289172fe6c356462be51072e8325dfa5651

SHA256
01cb44d9657bcb9a0e58694ed6c0de058f5f763ff626394d8d68c14cf3fd16ad

SHA512
8a83aca1eb758a09a26ccd17ff93a1ad7d3ad72b89977fc15144f91453c0c83c72c164f78d122d05d6ed91c1ef99a79dc9da2b6c3532d46847a14bf05ebafdc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
4eb412237967d2bfa97c9c5d6e618dac

SHA1
e000ef3ab03ef55135e70db5f42567d46dc24efb

SHA256
e17561752eaa96e21401232b362d12a89d9067e76541729f13f13cfc95d5988f

SHA512
6a4dd2bcf67794b8a039b28382c37c0348096f374b7fc94d8cbf01a5be54b67b08728b1deb55195a1a6aa4dcb4cf2ca823a61445d366fd2fd6881a4ed969a151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583870.TMP

Filesize
48B

MD5
38b41f676cf6d9223e1a4d57510bfa28

SHA1
5737453788a4f7e9f60df095a021dc4254894c8e

SHA256
7b8c0d6e62ddb617e8bd51afe5500a0bc2eb7449ad161698cc520092b8a516a0

SHA512
79824acd421d87ab880f3a435e303314a286d9cf1f43dbeab0d71409f23c706984eb6f0fcd09076f6742ceb2f6947e88d549dd15c6ca707c4d827f955e979fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9a73ef746e82450dde5f680e9fe9a965

SHA1
a41d41322f37b01288f3a85233b13d6dadee30ed

SHA256
b53b051167ccc00da0a7e80b0dfa87a96c2f11d968ea8fb3b6e30c17f7004e66

SHA512
766da9584ce1df50b305e63db161281ba26f9968351ec957b5652cee82009b92d65b706178772d22ff7ed585af1d2fe99ac1da84893be8854b8fe40a29db2ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ef3c372768cb044501a827b8561a7f0a

SHA1
50196d943d699536d5d1cf18bcfb789838e5fa7d

SHA256
e85a84ebcf21d22bc2e73e60d649d432212933db15145f3addb2e2d78a35027e

SHA512
5f6ed17eebbf217ba0a179c9efdd85873c084c2e4fdbb16d3c7b831193d0a4acffee78bcdb8831914a64d59b89e95759495242ffea9f3629d50d24b224ddb00f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9a832b51fcaae5ef2cf950001b2ce7cd

SHA1
e7023351ed4f2c08fb4eb7eb04abf4c2b96585fc

SHA256
c4c365a193f63dee8223fd9df5967210203c419f80c0c866d79c39debccf4fa9

SHA512
d11c1b7236b7ca76ab3c2bfce1bc5f6844a0ebe8a8df5908397ecc3667e206277e2cd8dffe6a2c62a39c1fff37339670536055a8ed7f327c21468f25421b9d0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
dc60d9667a8233ffd7a94d6e065967d8

SHA1
8f32b7240aa716141f83ac280e8d5b6feeed53e7

SHA256
7d504a7a5be59ab715c25b274304524c11b9ba25b025192d1ebe617c44b9f546

SHA512
ce1e98094269ca4fa899b4e345ebb90cbea42a6c17a657e7283b9622e490b8906fb2ec141b21d4af8bfa5e485de3ce06656070711d7524a7190f34677cace3d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7bf4a560438900defda797a723328315

SHA1
fd6425c6d6d65a2778545d3869bc89f79860de5b

SHA256
7781e8c92884e97e09d0d26776c21b9f380d1f59bb8761dc9cecd02087c95e4d

SHA512
a4a8c6240c383562d0e6985ae206aea3f768a4a3e2183d45202e999eec5ddf2660a7ff8342e7bf81ceb0cb7315da8f6e9d62f6f7cb9649c5eb3a73ff0a42d3b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0ae6c2b2633d84594d9b188eee2557b9

SHA1
b3f32fe32e5bf47509354b02ee53813970528bfc

SHA256
58400876ca4d9542af7721e354c5291faf69fe8af20826ed2d493681fe46e53f

SHA512
ce9d51cffa039cb69bf08554010bd069f7b6dd8df4a6208ba171a1944eb3ff8402269a953178382d78348f9a44948d1133a1afc7732da2dab50fdaa3f97dee93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582eeb.TMP

Filesize
1KB

MD5
cdf118a516435e40d95a1786de82eccd

SHA1
680a580300c6269ec521308194e7cba9070454de

SHA256
0d5e2a6aa425d6165adfa718f79896bb16087f82767a28093525c6d500faaaf8

SHA512
079b876cc2763490421e931b3f738e44c742637c8106a7eb74cae338f03dff46481e14161101819035115b5f0c8bcbd1ff20c8fe2ddfb874161d906516026847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
69a243bd1bd83fea8cf36f3ea88d0cbf

SHA1
024937d0a8b1d1fef64e38a5073fe66fc2ea09b0

SHA256
5cc5ce97d04d60fc16d6c9bb099c5b56967e143a656fdade3113c1f81df29553

SHA512
4ec6fb983af9ff23587c15ee2ca0f63fa8fe63157fdb6681c236bc8085836f29f8ce6027441cf082c009aa614a14f1a04bdf7dd03e295bb5f368d926cedcd4bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8174adabd74d3b601ec37c85627e1c8c

SHA1
95f3c969b518ef7a8dded7ff4175b192bc644e9d

SHA256
efff5dedce89175239571f195a6045eaf8130441131682aeaa82171f085f51f5

SHA512
c9c5a41d19663410aaa6ef8414b7502ab5bd6cb2f32ab67126c2cd5eb2b826ead82f809b78f2d4ef49f351043a04cca6063eb28bc1821787de71d4b4b7ab0a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d420eb723729d498382e22f63b302936

SHA1
18a5560b1e40fe54ca939088eaab2130d120b28d

SHA256
5d2ad7fe3b39f2d44b2c38f53796b4be961c64f2cc99fa77afe1fe114cd4b6ba

SHA512
7cc60dd882d58903eaa40d84f7fce41186cab9bc675a769facc6dabb42ab66e84b4454bc203ff9858ca1a98df2bf3e1c79957e8c07066fb75f1a74d642f65f56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c2b683ad75f7c21e6f779d634e0c59e1

SHA1
cfa5576a8c076681328218f5311f0fa153181869

SHA256
47c9d271573235d223511afd94628095e56a001d4cb5a9cb6b55e03d8d366bf3

SHA512
dbd58e8d23cec78ad5d33191f7a969c03381f1d76a13d539ebe9f3d5430d255c1218b3c08b97e6b8cc1798b56ca14e4adcca45dedb2bc84cce3815a7327166f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1DDF.tmp\302746537.bat

Filesize
348B

MD5
7d8beb22dfcfacbbc2609f88a41c1458

SHA1
52ec2b10489736b963d39a9f84b66bafbf15685f

SHA256
4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2

SHA512
a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

Download Submit
C:\Users\Admin\Downloads\Antivirus Platinum.zip

Filesize
699KB

MD5
ff84853a0f564152bd0b98d3fa63e695

SHA1
47d628d279de8a0d47534f93fa5b046bb7f4c991

SHA256
3aaa9e8ea7c213575fd3ac4ec004629b4ede0de06e243f6aad3cf2403e65d3f2

SHA512
9ea41fe0652832e25fe558c6d97e9f9f85ccd8a5f4d00dbcc1525a20a953fbd76efb64d69ce0fdd53c2747159d68fcb4ac0fa340e0253b5401aebc7fb3774feb

Download Submit
C:\Users\Admin\Downloads\Happy Antivirus.zip

Filesize
1.6MB

MD5
974918541aa75f380aa6cb4d8bd3c4bd

SHA1
d0a6a3a301cf5330b00281ee8ff04ed9c3455fc7

SHA256
d703fc0de3f07684528bc1931479815a4b9cd7b66fedbb753ca21314a6a300d6

SHA512
db829bba3372a6e452d03d24e998ee91d28e3816c9d1a8d81330d450b24dc695e15d2612ec69729beafb28d95271ba55b6be8b95dbe7f4b15f4f65bf5b5279b5

Download Submit
C:\Windows\302746537.exe

Filesize
22KB

MD5
8703ff2e53c6fd3bc91294ef9204baca

SHA1
3dbb8f7f5dfe6b235486ab867a2844b1c2143733

SHA256
3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035

SHA512
d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

Download Submit
C:\Windows\antivirus-platinum.exe

Filesize
9KB

MD5
cd1800322ccfc425014a8394b01a4b3d

SHA1
171073975effde1c712dfd86309457fd457aed33

SHA256
8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0

SHA512
92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

Download Submit
\??\c:\windows\comctl32.ocx

Filesize
595KB

MD5
821511549e2aaf29889c7b812674d59b

SHA1
3b2fd80f634a3d62277e0508bedca9aae0c5a0d6

SHA256
f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4

SHA512
8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

Download Submit
\??\c:\windows\mscomctl.ocx

Filesize
1.0MB

MD5
714cf24fc19a20ae0dc701b48ded2cf6

SHA1
d904d2fa7639c38ffb6e69f1ef779ca1001b8c18

SHA256
09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712

SHA512
d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

Download Submit
memory/1292-857-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1292-839-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1392-945-0x0000000005030000-0x00000000050CC000-memory.dmp

Filesize
624KB

Download
memory/1392-948-0x0000000005000000-0x000000000500A000-memory.dmp

Filesize
40KB

Download
memory/1392-949-0x0000000005350000-0x00000000053A6000-memory.dmp

Filesize
344KB

Download
memory/1392-947-0x00000000050D0000-0x0000000005162000-memory.dmp

Filesize
584KB

Download
memory/1392-946-0x0000000005680000-0x0000000005C24000-memory.dmp

Filesize
5.6MB

Download
memory/1392-944-0x0000000000440000-0x0000000000632000-memory.dmp

Filesize
1.9MB

Download
memory/4736-876-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4736-861-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4736-860-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4736-851-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download