ratty | 0f416351341b3242f0d6576d25eab21c5268afc3ce8bfd523c4fa43b8e012844

Analysis

max time kernel
404s
max time network
400s
platform
windows11-21h2_x64
resource
win11-20250207-en
resource tags

arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
submitted
08/02/2025, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ServerListPlus-3.5.0-Universal.jar
Size

784KB
MD5

4002d830f46e36f8d6ade80eb73361bb
SHA1

2d5c976d826604e7eb598ce763ad65db7de66f9c
SHA256

0f416351341b3242f0d6576d25eab21c5268afc3ce8bfd523c4fa43b8e012844
SHA512

0c2b5d74e4415c018d896ca6e05c2a091b61d0a1868c299288418687e4ba719ec68f1f963a30436d4dd798db52fc09bd375baebfa3448bf24ea7745530ff1327
SSDEEP

12288:ZJdfY6vr/SWvyvx38VDmiQdy10pQrukDmZEvQvqNPuNQVrTc1pv:ZJtNKWKvOFmiZ10hkDDIyNVrTc1pv

Score

10^/10

ratty defense_evasion discovery persistence privilege_escalation rat trojan

Malware Config

Signatures

Ratty
Ratty is an open source Java Remote Access Tool.
trojan rat ratty

Ratty Rat payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001a00000002b050-1142.dat	family_ratty
behavioral1/files/0x001c00000002b073-1686.dat	family_ratty

Ratty family
ratty

Downloads MZ/PE file 1 IoCs

flow	pid	Process
41	4524	msedge.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lite2Edit.jar	javaw.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lite2Edit.jar	javaw.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lite2Edit.jar	javaw.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
3328	7z2409-x64.exe
2728	7zFM.exe

Loads dropped DLL 5 IoCs

pid	Process
3320	Process not Found
2728	7zFM.exe
2620	javaw.exe
3124	javaw.exe
496	javaw.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lite2Edit.jar = "C:\\Users\\Admin\\AppData\\Roaming\\Lite2Edit.jar"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lite2Edit.jar = "C:\\Users\\Admin\\AppData\\Roaming\\Lite2Edit.jar"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lite2Edit.jar = "C:\\Users\\Admin\\AppData\\Roaming\\Lite2Edit.jar"	REG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
60	raw.githubusercontent.com
87	discord.com
51	camo.githubusercontent.com
59	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2409-x64.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3672	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2844	ipconfig.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	javaw.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	javaw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "3"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Applications\7zFM.exe\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 8c00310000000000475a469f110050524f4752417e310000740009000400efbec5525961485abba62e0000003f0000000000010000000000000000004a0000000000774d5300500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	javaw.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
2692	REG.exe
1396	REG.exe
2036	REG.exe
4548	REG.exe
3392	REG.exe
2024	REG.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ratty 1.29.3.1.7z:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 894300.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Lite2Edit.jar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
656	msedge.exe
4524	msedge.exe
4524	msedge.exe
2276	identity_helper.exe
2276	identity_helper.exe
4700	msedge.exe
4700	msedge.exe
3480	msedge.exe
3480	msedge.exe
5000	msedge.exe
5000	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1724	OpenWith.exe
2728	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2728	7zFM.exe
Token: 35	2728	7zFM.exe
Token: SeSecurityPrivilege	2728	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3328	7z2409-x64.exe
1724	OpenWith.exe
1724	OpenWith.exe
1724	OpenWith.exe
1724	OpenWith.exe
1724	OpenWith.exe
1724	OpenWith.exe
1724	OpenWith.exe
1724	OpenWith.exe
1724	OpenWith.exe
1724	OpenWith.exe
1724	OpenWith.exe
1724	OpenWith.exe
4428	javaw.exe
4428	javaw.exe
4428	javaw.exe
4428	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe
2620	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 580	656	msedge.exe	88
PID 656 wrote to memory of 580	656	msedge.exe	88
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 3768	656	msedge.exe	89
PID 656 wrote to memory of 4524	656	msedge.exe	90
PID 656 wrote to memory of 4524	656	msedge.exe	90
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91
PID 656 wrote to memory of 3556	656	msedge.exe	91

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4228	attrib.exe
3288	attrib.exe
2992	attrib.exe
2044	attrib.exe
1016	attrib.exe
4720	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ServerListPlus-3.5.0-Universal.jar
1⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa6293cb8,0x7fffa6293cc8,0x7fffa6293cd8
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6604 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7648 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,16332187047359901552,12938774137196960670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2860

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODk4MzA4NjAtM0NBQS00QkEyLUI1ODItNEQ0RkY1MzMyQkUyfSIgdXNlcmlkPSJ7MDlGN0ZGOTEtMkNFRi00NTI0LUFFMkMtRTEzRDVDQTY3MjNFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Qjc5OUYwNEQtMjdFMi00QTk3LUE5N0UtMUQ5OEQxQTVCM0FFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczODk1NTk3NyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI4NTM1NTkwMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxNjYzMTE3MjQiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3508

C:\Users\Admin\Downloads\7z2409-x64.exe
"C:\Users\Admin\Downloads\7z2409-x64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3328

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1724
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Ratty 1.29.3.1.7z"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2728

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Ratty 1.29.3.1\Ratty 1.29.3.1.jar"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4428

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Lite2Edit.jar"
1⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2620
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Lite2Edit.jar" /d "C:\Users\Admin\AppData\Roaming\Lite2Edit.jar" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2692
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\Lite2Edit.jar
  2⤵
  - Views/modifies file attributes
  PID:2992
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lite2Edit.jar
  2⤵
  - Views/modifies file attributes
  PID:3288
- C:\Windows\SYSTEM32\REG.exe
  REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Lite2Edit.jar" /f
  2⤵
  - Modifies registry key
  PID:2024

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Lite2Edit.jar"
1⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
PID:3124
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Lite2Edit.jar" /d "C:\Users\Admin\AppData\Roaming\Lite2Edit.jar" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1396
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\Lite2Edit.jar
  2⤵
  - Views/modifies file attributes
  PID:2044
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lite2Edit.jar
  2⤵
  - Views/modifies file attributes
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://discord.com/
  2⤵
  PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa6293cb8,0x7fffa6293cc8,0x7fffa6293cd8
    3⤵
    PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://discord.com/
  2⤵
  PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa6293cb8,0x7fffa6293cc8,0x7fffa6293cd8
    3⤵
    PID:4276
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:2844
- C:\Windows\SYSTEM32\REG.exe
  REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Lite2Edit.jar" /f
  2⤵
  - Modifies registry key
  PID:4548

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Lite2Edit.jar"
1⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
PID:496
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Lite2Edit.jar" /d "C:\Users\Admin\AppData\Roaming\Lite2Edit.jar" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2036
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\Lite2Edit.jar
  2⤵
  - Views/modifies file attributes
  PID:4720
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lite2Edit.jar
  2⤵
  - Views/modifies file attributes
  PID:4228
- C:\Windows\SYSTEM32\REG.exe
  REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Lite2Edit.jar" /f
  2⤵
  - Modifies registry key
  PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
88518dec90d627d9d455d8159cf660c5

SHA1
e13c305d35385e5fb7f6d95bb457b944a1d5a2ca

SHA256
f39996ab8eabdffe4f9a22abb1a97665816ec77b64440e0a20a80a41f0810ced

SHA512
7c9d7bd455064d09307d42935c57de687764cf77d3c9ba417c448f4f2c4b87bcd6fea66354dfe80842a2fa3f96c81cc25e8bf77307b4ace1bbe1346cbe68435f

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
c4aabd70dc28c9516809b775a30fdd3f

SHA1
43804fa264bf00ece1ee23468c309bc1be7c66de

SHA256
882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863

SHA512
5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
551KB

MD5
b6d5860f368b28caa9dd14a51666a5cd

SHA1
db96d4b476005a684f4a10480c722b3d89dde8a5

SHA256
e2ca3ec168ae9c0b4115cd4fe220145ea9b2dc4b6fc79d765e91f415b34d00de

SHA512
d2bb1d4f194091fc9f3a2dd27d56105e72c46db19af24b91af84e223ffcc7fec44b064bf94b63876ee7c20d40c45730b61aa6b1e327947d6fb1633f482daa529

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
967KB

MD5
4eaae49d718451ec5442d4c8ef42b88b

SHA1
bbac4f5d69a0a778db567e6978d4dabf2d763167

SHA256
dc4fdcd96efe7b41e123c4cba19059162b08449627d908570b534e7d6ec7bf58

SHA512
41595b67c8506c054c28ce2b5dec9d304651449464c6e1eb092a049d49326594584900cff4e9b8210ca3ad8a23e9c22d8df1ae8af15f44a69f784cc546fcced3

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
14KB

MD5
e03115ee7530777231a0051667ab23d3

SHA1
5ded32077cda52b5527f75017552a598b0523db7

SHA256
cccf6f489961bb78c5c4baecd964442b14593799403e2b6e4d50082c3e64803a

SHA512
053f81c647b55df05bef067f26be1d25b44cdd1d5a59c4341904f0b9173a1ad6cc3209035ed4782626b150f090f52276c7d99e77eaf108b2fed52f2179e959ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7a2b6a38b7ba9aa7c64738c68e58edb9

SHA1
fc9280f92eaf999ddc4dfe87c08f0640384ecc77

SHA256
ceaedf34d68a4c20e135231363cba3816453f53b96ae58fd88bc5f00135dbb6b

SHA512
69aed16cd3a96b7dbc1205714fa46040f105547b8b7338d7320cbef5338cdee2985953cd10b037e2dd7ff8a79dd7ce76edced906c7b50ef54980e52fe00a4e7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2522886e1b6b01847a8b2bd8239db83a

SHA1
4c16812bf9f827262030825bda1f644746c90ac0

SHA256
596eec2b17e61e2acd9682ba492a4d5263cab1361dadbee49dbf1a175c226cf3

SHA512
f32b6e29315f7e0459a3ee890eb40b713262b936182609c9ba7408c9aeff97353a27fd711e7713629f9a302b48cbb7cd1175bbed28dd6e07869bb947cf048c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
48KB

MD5
26440793d8a21119faf2a2eb91280f5f

SHA1
e7d6b1b045c07f1373ca67ec838c2b59deae4999

SHA256
65ef6675c2ff98d15ccaf1c248981e63893bc6ef8541358115828194854fee91

SHA512
d125b4ad58ca33f04f4a738faf035ad4bbb8856e817345e6c0e421e19692bd56bc55946a6f25acf57072da8a3f762eec41d61506ae3f5535328f60f08a01a810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
21KB

MD5
38a759878edd6734647e9cd996017d90

SHA1
196bc2d58c375a19cd5bb30afed86775d5c88842

SHA256
405513788623c259826d8340da7c0dfe462a4907df13fb9e68ff6144bff4c938

SHA512
8439ca471004ad93669750d59d029675b10c112e15a2666cd5995843c36a3b3475f9dfb36e06ee47e7befcde5fe66cd58f35fd8a6bbdd0a02d5c5cb0ff6eafc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
37KB

MD5
4c0a7d97898d984078239033559269d2

SHA1
a3633dfc9744c790606ac243ee52207b826c1e9e

SHA256
189d8dac5d80bb54dcb1b9054233e3d64c90017af89d3290eacb67089b50fbb0

SHA512
be19c6b55b37907f7864f8efd855590354d49050250d77e5d7057895b7517ef89243e7529ad8efd596988d19481c753bda06dca5e4bee582fce49a4bb096ae6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
4fd1024ba54efb125f870f5acc18ec1d

SHA1
d4ae8aa359736de6a3866415156806231316c71f

SHA256
ebac279b7a5132a42efe07edbd0f0217478d57124ff21365ef01d33a343e2f36

SHA512
e39cc9701a77b9ee2b532096ea703c751fde9d31c7a3c6f1a2bb0fa54e480009fd31d1aafeb160a8f3bfee330172ded2e3061a9ba82a95e039e5d54916343903

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
16KB

MD5
bf617fa09f98c0795e739283c270fa57

SHA1
9932a46708408e41f1a32f04a2ca0eedf66645d1

SHA256
0af924fb05a6812f03d429027b1f79f478b5874223a53108f6cc18e836136241

SHA512
20b7092b688fdb209a7ee13f53f674f1f8c8041c895f56f98a43d3579f7fc2588da0b02992d845946a1cfbf87e41f965928b0053ebc3bd07c9a6a404e7594fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
25KB

MD5
e580283a2015072bac6b880355fe117e

SHA1
0c0f3ca89e1a9da80cd5f536130ce5da3ad64bfe

SHA256
be8b1b612f207b673b1b031a7c67f8e2421d57a305bebf11d94f1c6e47d569ee

SHA512
65903ba8657d145cc3bbe37f5688b803ee03dd8ff8da23b587f64acaa793eaea52fcb6e8c0ec5032e0e3a2faacc917406ada179706182ce757d1c02979986dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
bc7d27796ff464b336ec2f019ed16f4d

SHA1
c8b1ddbda175908af68b62290efa1edb3e7e3824

SHA256
986d4dce2b0596b1ba53ecefaa66bc9b1b50df7f37c49886a0f3087ea40ac7fe

SHA512
c5ecf0fe55f1ba26f6c41e62d736222d7fa4bdbdb8ff79f6a069703f7ff080b35c42624fd3e9679c483dd0d79b430268dafc7e922df8d3c4956078ce51c863e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
7b9d77bfd0c85fa80a2e89962b375080

SHA1
f8483ad84788f16894e5d03dc6c71935ac05b1a0

SHA256
56d367d6aba240b098355c5a23582233dac0c52adf358c31d88997a0392486e8

SHA512
bc891059f2ae37bd27833a6ba29ec33b65a66b812089697e990aac33ea81ff2158bd52f94c7e1bbd50f26d0e70ad1af5f047cff2480a41b3d8b9db4611f9d46f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ce6deb0a21fd4f1da3926575bb273f86

SHA1
a1a33b0d51a2269d3a94a8d265940c10779085f4

SHA256
63fbbf189ec34b170f0e3b567d320b07ecdd819b6c7cc5728047c18f08866276

SHA512
d7bfd6b4ef482298a522b17b4b143e968c49db421da7ef3bd9a49151d0faf9275c2ff36ec6ca48ac5b0595087031e3fda2b744dd467344f96b78f3b8a7655e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
857B

MD5
ae4df1a5290a9fb4b59e63075ca10f82

SHA1
999fb1f5db4577bd783ab07b22d8e156d652a43a

SHA256
933000e3b36a8a8bb3b365eac533ff849f7b623a00084cc17f513c45efbfecbb

SHA512
fb219af4cfc8c2f5544b6360b1cbad5b5f5c793658a936e8828a69e5b1a8bf502c3a923991d6dbe29d7af9d7adb6cee7cf2adf99198ae4205c6a128e34aab446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
940B

MD5
89e9a4c55a30659213b81447204c237a

SHA1
46ed815508b2478bd858c230b64d2f761fd0358d

SHA256
645bf16de7fba87d5b9821e4ee6d9753a6521f72e9a6362a88fddc1764acc170

SHA512
fc994aebb07389baab1ff36be5e56effd9004d8bd79294dff7faa4e7de2dcbde7086c99135866c191f2f465664d8124ad931030e93ee9817062e78051782d7e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5665e5ada6b1947ac26b0b6aeb05ab81

SHA1
40fe0d1b6dfa9683f4a57b94f50e216e50f1ee65

SHA256
bb9a1c68eaf375f6911934b5e8179813ef145211db873b15029b3a7d319cf297

SHA512
e0fa4ccb4fee2d688c9753ab502888526f5ef83d17ed50b748b9142000aab15024672e42b1451e2e15684a92f2113cb078a183740e2dc9619fad12af1a7f9df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e27aaa6cc872a4847de7b5a8d255bac

SHA1
9a2c356fb8913d3fb3afb43cbea5b45681dd9c31

SHA256
47e87e17dfbc00409ea8ae338f3716810fc1238d1ffbb9a707aabe8716d5322c

SHA512
228e27b6bc9d8fc51344c0d4b56a6f7e1adda201748025b5d88a71093ba3bfbf731adc5132f5ca3602eb45596e67343f68f0ae6da4eb99dba093971fb401fbd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c01c17ee3a253e50b0e3802f5c7af91

SHA1
3add1fcad2fea7522d2e4f33ac9f24320da25ff1

SHA256
5f04b3aa3633a4686232ce1ce6b4591e72577094cdf2e8bae50ee25b894b08d9

SHA512
38a69a5e42121ae844dfdcb35f442ead7b6fb0e40c00398191eb529b54145d0e62c34a5df9b527d533c229b49cc41a279847ca101986dd40315f2530177dc16b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5df3e592c520dc8ea8b9faa1907f05d0

SHA1
7012ee70afc5659287f615fc36722fb44b7d6fe8

SHA256
937da0259f8ff5dbe526fe8b89b4278e145889e004f98f55e75cde5e7e080c73

SHA512
f4a17ae9fe1ca07b8c8fd14f0ff9641604452b289bbf7b4aaa070a6f02af4aa70c8905571ac2824c56648e04e4869817a4a99eef3bf65b7b042f4eb205052464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
40107d4613c4f694a1489975d3741ca3

SHA1
131d9802590b3872afcbe5fa7c7c774340cb3851

SHA256
1712a5937091705139e330a600f52cbaced0f7ca3b4b99e8a47f37cc6138dec9

SHA512
89241994c3658f503f8cbe74d03866881bf681ee272034e5fa7c28db12d8286a0826241eb296b3dff2e8fdf06b565e514633b9854439c854eb650349a6691442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3e29e67064b4029fab5276d8e20a21d

SHA1
2b2ef8ce119f24dbb2e18b26d79c9781ab7f62b8

SHA256
0c441789f0db681ffb9d6054adb28e85de8cb421dc2e1836fd1c11457ed560e8

SHA512
f89b14e4da39e5e4b1356efb0adc8d036974b4a0dc2b47b39e7cc9ed0a48ebb0f15e8ce8da6d918674f6f01ec6f123adbf246551168b2febb7b4d1da1c7d20ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a15354b6d8ed2e2e948e822d035aba91

SHA1
20ec8ea486c268c7c84adfd7c664f770d25a67a2

SHA256
aaa1976a24ce221ff1b65a65179b422021f236c801872ee7f531dc20e3dc4beb

SHA512
3f41009ef7576c72b6f6e6f3257a279c0190469fd61a92c41a9cd992419f57c555997e811dc6b216d92f0b261d3d9058aead05f34426ec871788989ca06ac260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2afa05143ddfca9c9d029296c2d77cf

SHA1
800777c68ca992dcf759a34f41921c471ade92c5

SHA256
e781f7e595e2526e9832a4421187340e40d3bd698076083fca26333841c74c29

SHA512
2fdaddaea13e8d01f408ae1135197ccb664bb3aa6ad1fd3a068c0215e4bbf0768ea2bc136845c96904fd7e063c6bd90cbac394e69d8c3da72ed72d2abd9edccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a63c1de204190e70ddd9ef83c5eed779

SHA1
fa4c9d517d8db717d3b57edf34076ddfbe6fa500

SHA256
cad1f8c05dba82ee0e56fb25147395b9f0cf942a236c5a0156810f16102589b2

SHA512
8471ab81acdabd0406ca418233a9a22c82d95457c0707f6e14cd5ca70abc573a052dab766202e7aa85daa3a017d945f56f36ea05be2491d8885e8dc555d1baeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
11b34bf9e134fa59fb93398ced9826aa

SHA1
54bd1db5ebd4312ee00c8a7d7e849126acaca2b8

SHA256
7a9279761d3b2d0dbca0b050a93e70f5ac03c28f4db539fd5d149e6529ab277b

SHA512
25d6e7491c8e627458c4d1e7e220ed857278f3aa99270fadaafea9225b8613fd054f4897cf11a8d5e3e093e90f6cd971b1db281cfcddccccdef8d70b8f5deca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7737dcac7dbaa6be0dc4a0dcb0cc8d62

SHA1
5ef4b7cfdda90aabb48665ee35d7d181b7cb0a74

SHA256
fe0cf40cb4a2c106e508f9b5812b03079353054473a3a2cc77c1951d9491fe78

SHA512
bc0fd018b0281e07e414df658ce8800b8c0ace8afb7802fc0043aa34c309938ba3fb72b1a117dba3c368f7f5fa01042aae961a2b6994d9e5f0a9345bdfaf06a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
71dda6a8be4c4ab88fc59ce0d14a84a2

SHA1
73845208a1b7cf05fd03753c3bea41ae848daa8c

SHA256
f58c02a438bdd4f1bce7b5b7763ad4d1d50800badf463417ec4aa61dee5b28fd

SHA512
9e1acb298be8000376cb70d6dddb6850af70b6a63ef93a57f1b13e3df7c1497f51a4f0941bbce21790519868d4f592686032f2022cd4b5e32043f8c6c840fd32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
437a03d5aab83c489f03160f73c220ea

SHA1
021f59cdf9ac6aba8568c408f236633df970c6cd

SHA256
c63b131298ab34ac9f9e5318ee9732c5f4150f51e816fcc85dab417539a61aba

SHA512
9e9f529f5f50ce93ea1346724d1d625b19cf5078b5146bb373ac75b6d9e41d1262d58a28626f6d7f3279dd1b2b93939d15bb1310a88bc98506c76187d4168333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8549b9905128812e4dad1cbd3eeae7d7

SHA1
98aab8d02680c776c3f02d57c8492f5c06bdbf2f

SHA256
e09ba64f001a6b5eb6a9c0a4321f62765915f771669cd7b5f9632cb0b1df4440

SHA512
ce6c6b2a5b6e3ea0f49c89d61c9a9796b1f76615f87d18f5802643aebc4fd73c1636022439a6bfaa5b7b977d8e8c45604f677262974b6dab65633417e8d83077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
421f86d10aaf169e7866b375faa3b4a2

SHA1
e2a84f369e8a0f449f3c8f2f677fdbc50b716272

SHA256
ed709dd0ebce5ffd87b63411409f495783d003b6fe0e6b50b751f525fc4daa01

SHA512
7e4a87fc443f8389c990144818b6681292ea3604682c8ccbabcfe28a61e0a2a6f75229f3180a22987111d108487bb8d1dbe6de96851c792826ce6cf291d89942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e2900fb6eb9102c5873d75f6f476f9d5

SHA1
849b282451111f63e0a163c50ef70bc8982b5200

SHA256
b113690d8d6ef70edd1727627fcf1dfaeb5af1000c98243dfc199da80152f538

SHA512
5aca9fa096c6dd93d6bca627ebb5182d5f106a2e416b4c608784f3bd95d10644841ad1ebb83c33f28ada4888db2cb9305a5c8671f2c2175898c876b9c76dd6be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5826bd.TMP

Filesize
869B

MD5
575e03a7dea020fe95fd3608de9fdea2

SHA1
2198539701e2e2d7544afe934fad0848b59b6ae4

SHA256
a750ab4f95d0755d3653138c0dd6004ccef530020d09fcb8fd203c03f9ea2c04

SHA512
58b058eb0d9e1202e808c12ee3a9722708a2f144023a7ef6898a8c4e7423e6de629e605b42c2bd7eb1e626a389bfd3c14fd3204b153615de9023cd3f2ccc0d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f2ac3796e82db2342a2ce79ee0b93e2

SHA1
e5459949c61076423d7a0f1e3cadfea554a9d0f5

SHA256
0d7ef5399efde837a8266e29be8ac2ec77de99616dc1476058d200de3983c250

SHA512
f4f487c3774416ca5982760ab80a0814f1b5a777e53391b545cf29ba167c588ace1b57625bc63aaecfb96758177fd26f20a674d14a63147370f49d6241e5c0b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6826348727f10f5d208e4bb7b3bd533e

SHA1
2cae8c07d021d6fd5f978a471559b3adf0d31a10

SHA256
3d1e80538f2e9180f985eea2d8e44671127ac7097ae153ea150cb96d7ee75a59

SHA512
42c3537e317a06b2b982cc39284e2a7c523e52b710be2accc14e515dc6bc7ee7f96564f40f4a617d324217441b9eb3ce9f4e9a0289dd5bb6b0f8f2cc7d0f2808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0f6b9acdbf6945def220380803cb29ee

SHA1
dcca54a886f2cd3587ae9d225b3e3974a57de0de

SHA256
0cb1e1a87535f8623dc4f3520405475e2223b53e800035dde13a0a3d3f6f23b1

SHA512
372c114dd7a1156227cb92401f717b255ac284279a7bbbe13ee486e0651103ddb80333b4b6e8511143e9cf170c29bed404018abab4d88a9096a8e4fd58c1dd19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e17a51caac735a23ee3aca7920594ba4

SHA1
9218f37f26ebba2ca4f807edafc52d2c47956cca

SHA256
319faa43cde8d0daca35e44f6b2e54476309cd145205e661523b7efdf95e22fe

SHA512
b2c6943672a627d931c323a0b27b2bd788b7b454e9824bfcf11f1f012affc77e6856808e5006468b04aade85660037574a866bb9547c947f571d76341ce22384

Download Submit
C:\Users\Admin\AppData\Local\Temp\JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dll

Filesize
83KB

MD5
55f4de7f270663b3dc712b8c9eed422a

SHA1
7432773eb4d09dc286d43fcc77ddb0e1e3bce2b4

SHA256
47c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25

SHA512
9da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2969674418-3952479498-2422112087-1000\83aa4cc77f591dfc2374580bbd95f6ba_a4d4d71b-f1fb-470a-878f-fa90d842707b

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Lite2Edit.jar

Filesize
332KB

MD5
c6c76e1ba9c4d8b737a4578589dc2714

SHA1
55e84b78cab76d9e3bd49706126601dd478f45c6

SHA256
65fe703f78f896e846a98c83e242174c6bbcf5d2a658152e56c68ca1ccbcbe81

SHA512
03440dcd18337fec253af8f7e93c02fa67023ec4b3dab2bb9776d931dbd4f520665e2b925f05ddbeb6b19ed873bf8771ffc5ec06cc5bebffe29f35100627c547

Download Submit
C:\Users\Admin\Downloads\Lite2Edit.jar

Filesize
43KB

MD5
4073999b96dcb21b0e611a6e639434b3

SHA1
539e43776d29bdb77b4045f7d1a4dce0e6dfbb27

SHA256
8ba6b2e9ff11b1079d3b5ee9cc35d7cd8d91b235d6813c33db4899dff3a2b10b

SHA512
ef5d074bcb61f2d3cd1da358d8b72cdfda9f65a178b32f5797e46c2632b2e7313df6306e601241d091665b1a1173cdcfb5dbb2dfc34753fa089ae0eebd3c6dc5

Download Submit
C:\Users\Admin\Downloads\Ratty 1.29.3.1.7z

Filesize
915KB

MD5
638a7b6211f809c7d1fadc7a65779694

SHA1
70e81f54a40ce0ce90e829e910548bc56928ab52

SHA256
e0e354f4f3eb9d7f3e5f714eccf767e76ac2dbf8cfcc9acf6be359bae1ddb7ca

SHA512
cde131d07e9a265359638aa99ccbb83cb4181a87c5acc4be7f401946d7cae89cfb3f31f5b0fe7a5455de7b56ebdf79b53803eadba769f2bc8058db0ea10a2ab5

Download Submit
C:\Users\Admin\Downloads\Ratty 1.29.3.1.7z:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Ratty 1.29.3.1\Ratty 1.29.3.1.jar

Filesize
955KB

MD5
8ca515fa94b37e3cc1fa8268113f9be2

SHA1
03111bfcb720203f034665ef5e4be291b821b969

SHA256
7fb9a521a4e2241f6b2e929639a099e9bc4d60b663749f4f6f32321b73acdc9e

SHA512
4ee18b5f9f8d844a303af059c6c831d9169421163e0b42bb51c8d9b08803c579971b631ad4285886376cddf2901926fd5847ed571f624ce989b2f790d6a171b7

Download Submit
memory/1140-11-0x00000136839C0000-0x00000136839C1000-memory.dmp

Filesize
4KB

Download
memory/1140-12-0x00000136851F0000-0x0000013685460000-memory.dmp

Filesize
2.4MB

Download
memory/1140-2-0x00000136851F0000-0x0000013685460000-memory.dmp

Filesize
2.4MB

Download
memory/4428-1621-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download
memory/4428-1552-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download
memory/4428-1571-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download
memory/4428-1573-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download
memory/4428-1553-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download
memory/4428-1619-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download
memory/4428-1196-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download
memory/4428-1178-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download
memory/4428-1170-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download
memory/4428-1154-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download
memory/4428-1205-0x000001B3A1590000-0x000001B3A1591000-memory.dmp

Filesize
4KB

Download