b461b2ff99979370236584a70fa3c602099df0d013fdd863cbb4d72fc04132aa

Resubmissions

01/04/2025, 16:05

250401-tjx79a1zbv 7

31/03/2025, 21:41

250331-1j2n1a1m18 4

Analysis

max time kernel
215s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20250314-fr
resource tags

arch:x64arch:x86image:win10v2004-20250314-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
01/04/2025, 16:05

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Ground.exe
Size

521KB
MD5

e838f53b2a7dd58bc2dbe4988009a125
SHA1

002e41bbc5a477e0be8d5c2b3183a24df4e579b3
SHA256

b461b2ff99979370236584a70fa3c602099df0d013fdd863cbb4d72fc04132aa
SHA512

63d31870be100d2e18ce4d4bc9d721e85c31e9d731d99246d6ceb54d2da9ab3eb8687b8fe900bf2b9c1e4cde66e229bb5830a81830b28afbf119c51cddcaefff
SSDEEP

12288:9FMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9Vj:VZyCA8CBmn+RrNj9ay5Ij

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	gchrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	gchrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	gchrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	gchrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	gchrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	chrome.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ground.lnk	chrome.exe

Executes dropped EXE 12 IoCs

pid	Process
2560	chrome.exe
6032	gchrome.exe
5932	gchrome.exe
3196	gchrome.exe
1988	gchrome.exe
2888	elevation_service.exe
5240	gchrome.exe
3600	gchrome.exe
5900	gchrome.exe
1432	gchrome.exe
5548	gelevation_service.exe
3440	gchrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1772	powershell.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	gchrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	gchrome.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Ground.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\gAppVShNotify.exe	Ground.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\gsetup.exe	Ground.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	Ground.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\gAppVDllSurrogate32.exe	Ground.exe
File created	C:\Program Files\Microsoft Office\root\Client\gAppVDllSurrogate32.ico	Ground.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXBD91.tmp	Ground.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXBE36.tmp	Ground.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\gOSE.EXE	chrome.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui	Ground.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\gjavafxpackager.exe	Ground.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gjavafxpackager.ico	Ground.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gjdeps.ico	Ground.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	chrome.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\g7zG.exe	Ground.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui	Ground.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\gLICLUA.EXE	Ground.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe	Ground.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gcrashreporter.exe	Ground.exe
File created	C:\Program Files\VideoLAN\VLC\guninstall.ico	Ground.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\gchrome.exe	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXBCF2.tmp	Ground.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	chrome.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3244_940885461\LICENSE	msedge.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Ground.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\gappvcleaner.exe	Ground.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\gjavapackager.exe	Ground.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\gmisc.ico	Ground.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe	chrome.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\gmisc.exe	chrome.exe
File opened for modification	C:\Program Files\7-Zip\g7z.exe	elevation_service.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\_locales\uk\messages.json	msedge.exe
File opened for modification	C:\Program Files\7-Zip\gUninstall.exe	Ground.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\gjavap.exe	Ground.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\7-Zip\g7zFM.ico	Ground.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	Ground.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\gInspectorOfficeGadget.exe	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe	elevation_service.exe
File created	C:\Program Files\7-Zip\gUninstall.ico	Ground.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	Ground.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Ground.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe	chrome.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\_locales\ar\messages.json	msedge.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\RCXBC91.tmp	Ground.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gjdb.ico	Ground.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5072_1060044178\_locales\gu\messages.json	msedge.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	Ground.exe
File created	C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome.exe.sig	Ground.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui	chrome.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\gcreatedump.exe	chrome.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	chrome.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\bfsvc.exe	elevation_service.exe
File opened for modification	C:\Windows\bfsvc.exe	Ground.exe
File opened for modification	C:\Windows\bfsvc.exe	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elevation_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ground.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	gchrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	gchrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	gchrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{470C0EBD-5D73-4D58-9CED-E91E22E23282} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c27b8f0420a3db01	elevation_service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "185"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 10901ef8a46ece11a7ff00aa003ca9f67d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	elevation_service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000602d810420a3db01	elevation_service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{23170F69-40C1-278A-1000-000100020000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000101a8d0420a3db01	elevation_service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1D27F844-3A1F-4410-85AC-14651078412D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c27b8f0420a3db01	elevation_service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	elevation_service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	elevation_service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	elevation_service.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99D353BC-C813-41EC-8F28-EAE61E702E57} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 0100000000000000e967700420a3db01	elevation_service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 10901ef8a46ece11a7ff00aa003ca9f67d0000006024b221ea3a6910a2dc08002b30309d6d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	elevation_service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	elevation_service.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133879972480997880"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{596AB062-B4D2-4215-9F74-E9109B0A8153} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000001b75f0420a3db01	elevation_service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	elevation_service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	elevation_service.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF = 0100000000000000602d810420a3db01	elevation_service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	elevation_service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000d056e0420a3db01	elevation_service.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-814918696-1585701690-3140955116-1000\{C7E830A1-76E5-4301-9F16-D88924ECC8E7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-814918696-1585701690-3140955116-1000\{ECF5113B-3E89-4A16-B3C7-A0DA420BB0E7}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1724	notepad.exe

Runs .reg file with regedit 2 IoCs

pid	Process
5512	regedit.exe
4424	regedit.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
5352	vlc.exe
4300	WINWORD.EXE
4300	WINWORD.EXE
2576	vlc.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
6032	gchrome.exe
6032	gchrome.exe
1772	powershell.exe
1772	powershell.exe
1772	powershell.exe
2528	mspaint.exe
2528	mspaint.exe
640	mspaint.exe
640	mspaint.exe
3244	msedge.exe
3244	msedge.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5352	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
5072	msedge.exe
5072	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6032	gchrome.exe
Token: SeCreatePagefilePrivilege	6032	gchrome.exe
Token: SeShutdownPrivilege	6032	gchrome.exe
Token: SeCreatePagefilePrivilege	6032	gchrome.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	6700	taskmgr.exe
Token: SeSystemProfilePrivilege	6700	taskmgr.exe
Token: SeCreateGlobalPrivilege	6700	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
4976	msedge.exe
4976	msedge.exe
5072	msedge.exe
5072	msedge.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
6032	gchrome.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
5352	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
2576	vlc.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe
6700	taskmgr.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
5352	vlc.exe
2528	mspaint.exe
2528	mspaint.exe
2528	mspaint.exe
2528	mspaint.exe
640	mspaint.exe
640	mspaint.exe
640	mspaint.exe
640	mspaint.exe
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
4300	WINWORD.EXE
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
3820	OpenWith.exe
3820	OpenWith.exe
3820	OpenWith.exe
2576	vlc.exe
7020	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 6032	2560	chrome.exe	99
PID 2560 wrote to memory of 6032	2560	chrome.exe	99
PID 6032 wrote to memory of 5932	6032	gchrome.exe	100
PID 6032 wrote to memory of 5932	6032	gchrome.exe	100
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 3196	6032	gchrome.exe	101
PID 6032 wrote to memory of 1988	6032	gchrome.exe	102
PID 6032 wrote to memory of 1988	6032	gchrome.exe	102
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104
PID 6032 wrote to memory of 5240	6032	gchrome.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Ground.exe
"C:\Users\Admin\AppData\Local\Temp\Ground.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files\Google\Chrome\Application\gchrome.exe
  "C:\Program Files\Google\Chrome\Application\gchrome.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks system information in the registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Program Files\Google\Chrome\Application\gchrome.exe
    "C:\Program Files\Google\Chrome\Application\gchrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa8a45dcf8,0x7ffa8a45dd04,0x7ffa8a45dd10
    3⤵
    - Executes dropped EXE
    PID:5932
- - C:\Program Files\Google\Chrome\Application\gchrome.exe
    "C:\Program Files\Google\Chrome\Application\gchrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1976,i,8463931453233104250,8071032861374419652,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:3196
- - C:\Program Files\Google\Chrome\Application\gchrome.exe
    "C:\Program Files\Google\Chrome\Application\gchrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --string-annotations --field-trial-handle=1600,i,8463931453233104250,8071032861374419652,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:1988
- - C:\Program Files\Google\Chrome\Application\gchrome.exe
    "C:\Program Files\Google\Chrome\Application\gchrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --string-annotations --field-trial-handle=2400,i,8463931453233104250,8071032861374419652,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2552 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:5240
- - C:\Program Files\Google\Chrome\Application\gchrome.exe
    "C:\Program Files\Google\Chrome\Application\gchrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,8463931453233104250,8071032861374419652,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3600
- - C:\Program Files\Google\Chrome\Application\gchrome.exe
    "C:\Program Files\Google\Chrome\Application\gchrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,8463931453233104250,8071032861374419652,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5900
- - C:\Program Files\Google\Chrome\Application\gchrome.exe
    "C:\Program Files\Google\Chrome\Application\gchrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4348,i,8463931453233104250,8071032861374419652,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4356 /prefetch:2
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1432
- - C:\Program Files\Google\Chrome\Application\gchrome.exe
    "C:\Program Files\Google\Chrome\Application\gchrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4776,i,8463931453233104250,8071032861374419652,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3440

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2888
- C:\Program Files\Google\Chrome\Application\133.0.6943.60\gelevation_service.exe
  "C:\Program Files\Google\Chrome\Application\133.0.6943.60\gelevation_service.exe"
  2⤵
  - Executes dropped EXE
  PID:5548

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\RegisterSave.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:1724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Desktop\RegisterSave.ps1'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x4f8
1⤵
PID:3356

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SubmitImport.mpg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5352

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\StartSuspend.reg"
1⤵
- Runs .reg file with regedit
PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa87b5f208,0x7ffa87b5f214,0x7ffa87b5f220
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1852,i,13010447972489269921,7711932959965694590,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2088,i,13010447972489269921,7711932959965694590,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1972,i,13010447972489269921,7711932959965694590,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:8
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,13010447972489269921,7711932959965694590,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,13010447972489269921,7711932959965694590,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ffa87b5f208,0x7ffa87b5f214,0x7ffa87b5f220
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1916,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2200,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2520,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4388,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4388,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4584,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4736,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4612,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4440,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4408,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4456,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=4780,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=4896,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5388,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5404,i,13415128412204015506,9069179663251424058,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:3244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2e4,0x7ffa87b5f208,0x7ffa87b5f214,0x7ffa87b5f220
        5⤵
        
        PID:2832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1920,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
        5⤵
        
        PID:4172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2196,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
        5⤵
        
        PID:5672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2512,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
        5⤵
        
        PID:3680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4392,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
        5⤵
        
        PID:4412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4392,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
        5⤵
        
        PID:2720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4592,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
        5⤵
        
        PID:4820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4632,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
        5⤵
        
        PID:1020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4692,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:8
        5⤵
        
        PID:3084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4508,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:8
        5⤵
        
        PID:3876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5360,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
        5⤵
        
        PID:2944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5728,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
        5⤵
        
        PID:380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5724,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
        5⤵
        
        PID:3900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
        5⤵
        
        PID:4868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4156,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
        5⤵
        
        PID:6344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4640,i,2662449429863446111,15102606688804218929,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
        5⤵
        
        PID:6908

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2372

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\StopConvertFrom.dib"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3588

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\CloseUninstall.rle"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\aff403968f1bfcc42131676322798b50\2010_x64.log.html
1⤵
PID:1924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5972

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\StartSuspend.reg"
1⤵
- Runs .reg file with regedit
PID:4424

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\UseFind.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3820

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MoveUnblock.avi"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2576

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6700

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3858055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:7020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\RCXBBAF.tmp

Filesize
521KB

MD5
b69712272f9694c3fe621d57d9a14952

SHA1
c0d8b282014ebc3a58a3be30c63c90fd0dfc71b7

SHA256
c8c696d70e0a57c3ce8882274dfc9945f846df3584f9a45436a7d3b67b91ce27

SHA512
488c936d93ca3d873188f1d5e3b8ad7eef377fdd4ea968505763451f6f1272ea346942a5e41724b15ade26b071e8a9fe46e3fef35a731d5f42e66e889e8e1d30

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
521KB

MD5
425c01001c12ad9cc401557043ffdda6

SHA1
cb307c3e354defe03059da09034a52d4a0f239df

SHA256
374513db78e756924970b7dfc3eb7e2e08f486717b2284bbf582459cd455e740

SHA512
ee823bc5b4e9065f50e7c87ee398227beb1d03b624018b2d28d5857e10299b6cdc2eae909bb9f8c9e5483876271dcf1ba12addf3be1aa45f224cb024004be83f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
521KB

MD5
78e944b6b50e1576ce1e767fe56fedca

SHA1
2aed730c6defa5c021ec9dbb898d576ad4f1b827

SHA256
6f9d6a5f016de0080f9580d783c3f9d37d76988d70429d9a2c672f7b9d626cc1

SHA512
46f9d1ac1bf2b5e20c06a9342f75658c9ddf67208178d56583a8ff4f6bb5c00956893412561b15f42a0077e992bf28dd428005187ea5de1191558f0d1de211f6

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
521KB

MD5
206a11b321f08b0e59afe738f4af0658

SHA1
d0bece7c617e300d148c843346c3806f610d5c38

SHA256
ad8a8125a437555e241fdc678d5d5c7b80969eda4c11b05b7d0608c9aa18bd9a

SHA512
f4417c3235871ba914384e943a4e5e6d05dbf6f69bbdf25bf7110e9e5b39c546e9ac139a761e3dafe36baca7cae4e0f0cc84ee97698d85b0df3dc7dd1920fb60

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe

Filesize
521KB

MD5
84c40ffdfa2896e0501cd50425e49eee

SHA1
586307d641e3628bac67c1486f84785fc5216788

SHA256
919c4a002d4d7c5e0a543a9a967fc471dba4fc828a5fac48ec9ad4c64d11a6ea

SHA512
8a8a1e7a45487a736115e5b9e2b549a8eb8912acecf56212dbfe512447fe76467cab2c4ab7a38566e7f486f2b9492f4ced5bde4f6a5142f05a1070be04322a34

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe

Filesize
521KB

MD5
093ce5ea93e2f1beab90e4e605c649c2

SHA1
746b30cbb01bd48e788d7a0a1dd953261e964cf8

SHA256
8fa91ab6350ed57303c45b8798cc5e53a047ef65570ad86bcf4100945e08d991

SHA512
83c1bb2d8d0c815efc9789db5439820a02e3273a7355c46664850cc45d90d103dcc2525ea675e7cbc603e83ef1e0dd6a475813964bf807d5e8b8f99f46bb255d

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

Filesize
521KB

MD5
e838f53b2a7dd58bc2dbe4988009a125

SHA1
002e41bbc5a477e0be8d5c2b3183a24df4e579b3

SHA256
b461b2ff99979370236584a70fa3c602099df0d013fdd863cbb4d72fc04132aa

SHA512
63d31870be100d2e18ce4d4bc9d721e85c31e9d731d99246d6ceb54d2da9ab3eb8687b8fe900bf2b9c1e4cde66e229bb5830a81830b28afbf119c51cddcaefff

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\gelevation_service.exe

Filesize
1.7MB

MD5
f841e9b4807d23918456008749a08762

SHA1
d3db37ecf273e8f8fca97f55a3bd9f02ba10c213

SHA256
b7e68d52394e4c0f5ed096b2e0cf3277071312549d92759d6683bf6125452ea7

SHA512
46a7df92682b868276141ea7e478c5fb552e126f72e2303900253d1a434a3eb7d8786f933b91ad49e7bab1a5267b2663768326ce8587d3376579dd6bfaafad58

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
521KB

MD5
546487e4d6ed5617b20f5c9ee9ab1939

SHA1
2e083530512e5729dbff99b3071155470cc5ebe4

SHA256
234f804f5f47ca5087c55a756441b9d5b045a185a1bcd714018ec66b379dc018

SHA512
47888ba702b2709ccd08f3266544ebabb4f92e9d7646d50673b7a6f00c7c834aad68c64fd762e255d8b061a528691d5b91d37bf227a48009f48499d4b2749b4c

Download Submit
C:\Program Files\Google\Chrome\Application\gchrome.exe

Filesize
3.2MB

MD5
eb3385cf380c8d890240ba91decc7b74

SHA1
986ebdee92f11543487f364f9fce3a3beebe5e26

SHA256
540cd6fba25c7dfd9f324d4170e3b2223bd733dcd494ce35257a5871a4923aa0

SHA512
ef97cdb56a897feb7b775560c18abdd7f62e8fb6cba8f01ed5e031626e2e7f21b749b1f7fcf3d376e72c27e68aa4a9cf08e80ef95b977f4c80445b116d82ca2c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\gjavaws.ico

Filesize
4KB

MD5
38b41d03e9dfcbbd08210c5f0b50ba71

SHA1
2fbfde75ce9fe8423d8e7720bf7408cedcb57a70

SHA256
611f2cb2e03bd8dbcb584cd0a1c48accfba072dd3fc4e6d3144e2062553637f5

SHA512
ec97556b6ff6023d9e6302ba586ef27b1b54fbf7e8ac04ff318aa4694f13ad343049210ef17b7b603963984c1340589665d67d9c65fec0f91053ff43b1401ba9

Download Submit
C:\Program Files\Microsoft Office 15\ClientX64\gIntegratedOffice.ico

Filesize
4KB

MD5
3ea9bcbc01e1a652de5a6fc291a66d1a

SHA1
aee490d53ee201879dff37503a0796c77642a792

SHA256
a058bfd185fe714927e15642004866449bce425d34292a08af56d66cf03ebe6c

SHA512
7c740132f026341770b6a20575786da581d8a31850d0d680978a00cc4dfca1e848ef9cdc32e51bae680ea13f6cc0d7324c38765cb4e26dcb2e423aced7da0501

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE

Filesize
521KB

MD5
9291586a4ead9e0ea3c5135393226651

SHA1
e1918fb40ddadd1c3d6baaaf852565db399864b7

SHA256
b635f1fc3fa716183cdf95a9fa90d969416dd308fbe2d98217e929e27f00f694

SHA512
ca953935affacbb8635f7aae8128a30f2218896895c47321bfa88fc8e86bc4de3f631a3bc81f903f5913b628916b70cdc423af58091b9028dedeb00b39128d8a

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe

Filesize
521KB

MD5
7159a9fc7b08b50700323cff8c3a3da6

SHA1
aa8c5240137beab8332e96a761f92c12aa7a81ef

SHA256
97f7cab7eee5ce8811a5eb7ce5de31a02b52617de93b1a8b862034745c810822

SHA512
e3646cba77aa99b4fa9ac4e6af157579c5fa736d4c9499858dbf7191497c84b1371941b5d6551e4ef8cca69025488168debabdeb1094b33352d0361627756fc2

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\gmisc.ico

Filesize
4KB

MD5
fc27f73816c9f640d800cdc1c9294751

SHA1
e6c3d8835d1de4e9606e5588e741cd1be27398f6

SHA256
3cc5043caa157e5f9b1870527b8c323850bdae1e58d6760e4e895d2ab8a35a05

SHA512
9e36b96acc97bc7cd45e67a47f1ae7ab7d3818cc2fdaad147524ce9e4baedfaac9cd012923ec65db763bfd850c65b497376bb0694508bee59747f97bf1591fd4

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3244_726054673\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3244_726054673\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
521KB

MD5
575e249452274ed4edb0e2688a286b4f

SHA1
751840aa50ed3d4a4a617b943aa3b8b3e4d57abb

SHA256
43ac3f20731613939d45e02989a94cf1ef0aabe20d07df2a1acde622ea24cfed

SHA512
522eabb093cd05eb60536238c5d60007a029dabc6c8396f5f98b6e94afd47bbccec9d5e98e326500c9cff4d5eb98c91197afa514a751af970ec2f8393ffb4f4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
facd537cac22c88a32308b80042f3eaf

SHA1
2b4a64bc2e4334a44ebae45760a02210d73d32f5

SHA256
3d7e655595134823a52f6818843af31945b884076c59b7f350a5f0a09dfa63b3

SHA512
45b15dca5c71041d907e7d7e8ec23c8738ff4320ccd3987a88a020b8f8a358a415ce8f7968d31e51a8a4e6297e0a081c923e5f36974f1777a722b802ef596b2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
3188ce9025374059b62d552a33348bbd

SHA1
834208c85d6762ccc1913239358fecbcf43c65ae

SHA256
9c2eee49d8c2bc091debc59074649c2f3d17468e070425e35f3077355739f3f6

SHA512
b5f1df2a0060d7378b4eebee652daceac68027bd3b793cb944a3e706bae666f6ea7b4c2c717ac9b65d3018111af955bf16bf32581fb5921b3141ddc8bf244032

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1534d8ac1ee1fff5cee39b273f37b16a

SHA1
702c758af776c04b439cad6b0412cec4d1d71941

SHA256
75d1a8b5e18247179a11d0410dd3f5ffd1527d97429ed241bd4b2a04f2d51a1f

SHA512
a6792acf4260b4c6a10ce2630879adcf31121fb1aad7080efcef3604a67b685d217d74bb28706a5965a3410716e803bdccbfd3a50a95cc27b4695023bb2b40f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
ef99e1fd4705851571848aac4350ffbe

SHA1
264bcdf1d5fe8f90f3958f923fe49f4a830e98c6

SHA256
bf24d96af18b9047a6f6b933e118d887519901c13142e1d8a3bf682d4900186a

SHA512
31559e9bd8d3421857174aaba6fca6482ccaf266a3e79d23bbed4d90ea0430de682bf1afacd0c43d94d0cc9871a6c599da8088601866f0342496669809a8852f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
55c563d14a0ac492859eb26e49cf167d

SHA1
80532617808443987b2330281199a5c753a04698

SHA256
927ab93929f354335dd654f6bf5e9c841274f607c16c73059f522acf70b0f6bf

SHA512
cb89e7e842d58f2d2e72afe1f2d14093a9c8d5fb418773bbb80e70e1d5ebd26ed5ead795dbb23afc00c1e542988ffb70ac047d15b65864f0145dd443e69ae4f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ce5c.TMP

Filesize
48B

MD5
5b41141482372efbaebfe3cc4a7f0216

SHA1
d463ea7af217e3c6e1a98a48c926d429dacd0c6c

SHA256
9c3ba9480333ab6aeb6997db528e143c9ed9a695cb1e1bde44f8ee6906d5c962

SHA512
3e8913ba9e5dae200e46baa904918a4ea1b5ae49549971a6a86a10a1604a75d4601e45e1b89229ef415de3b3c19036295fdf10cb5f87128705fcf73935bac3b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
e7b0d5512407541de7e6601b1367cd24

SHA1
002aa2adb40c7d8dcd5f3112f52772e70d7c9f54

SHA256
52de8ef91406253f6c8bc23e2a1ade37dffddf195799f2116db66d95fb70e19f

SHA512
71d07f3c7471e4e43eec45244adc1ca257a2ee4d0158a669b95ad0a96be0bcabab7f47f4fe130a1318cc27475dc4003787021e79e834e2d4a19d910af6476b10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
ea3717ad881e9a69a48879a34b8a75e9

SHA1
c4d7f4bb5fd2111d365aba8738ad021b842eac69

SHA256
ff1f0745599b2a76a2d6c1b1120bc8f8941c5bf492b55fa1a681776b2ebf1707

SHA512
a7f8a425b4fc6339be2d88857161d48d575d1e84047245ef2e7463ee7d6e41a6a8cfb5db9243e0721c226da13df095d60dc9d04205c6c42a4fa8d6a00a003a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
57cb05e689942c387de7001bd6c33e72

SHA1
982890b2094a86ede234f27cae852a65bc3498a6

SHA256
33fc6b5088e981beff9c54c50ccc9c6a5ddef617691dca65ff6cdfbf38f7255a

SHA512
0d200d1ba72a7082a2e94922a1c6242f5c42a7e878dd70b8f3f363f7d08de6fcaa808c9efb6b4d4867345283baea5478899c443d14da890e950767ad65f99f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0db482c15f29711527204c88f2041041

SHA1
d75d1733596dff33ea97548b59072b3dd1dca507

SHA256
fe7b1dbecea356c92e926f47f6e37c6b6ac88e090178e84b8792e7f14b21cd8f

SHA512
b2c6d96d1c76624a7000f17352f25913408ee53e328e2ce66fb844c098473ca9cd10a5b5d985a45fc5a7f130b1262e4ee333bb565717e48d4ed57543b4ef0eae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a9efc13ca6c6528bae67ac7c50d015eb

SHA1
53815386c3c25c853ab5068788360df0e6d62d81

SHA256
cfe29cd70971bb1cb2fc97f872c64d1167ff163378a138fdf20006421501e693

SHA512
b94428759869fc16138a4d5e3f0c489336832ad8824ec0d65120ec605ebe89acbc162999c4b21e14bac33526255eaa06241084a8c2d8c0adfb2e10cb75ea316d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
c7bc5adb9169fb4bb2ab619cdf8da3bb

SHA1
86e73bd0fd008a8b56610167af9d0f4da94ef614

SHA256
0241767f9ce3ce9e4daa2d0977b76764d032e5d687cec0de6a9319202e4a767b

SHA512
d0784b58891412b769813f8bb474826473274ddc11d88258115adc3993bd4a4491d45f5d13d55e4b213089e77ca6c0ebe34f23b3bb1229bb67df6cbf4096e585

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61370856-0b7d-49ed-bc03-7f3594146374.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f36211c11706361e09e2098498e221ae

SHA1
7101b4c0b10f61864f905fbbb89d3cfd5e9fa357

SHA256
cef9ec5a023d7fba735ddee4f20e977e9f18d9dd878439927bdff9bab6aab518

SHA512
d4ccc60e62a0f718c4acd1bd36f9cc48c5e56ef17c275320c5418ac354bba9a99832cea27cbe6fd642ecb8d8117b058f44af003c413f0e3e35499fc9e49b9386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e87270e5f3df9798a746919fa18dfcd1

SHA1
15709fb783bd4f64cbf6f54501401208132a32c0

SHA256
fa83263428780bfd15b3e5b30ce31dfe7ce358d82f440df7343497cad8d8680a

SHA512
2ea8bc9705186c386562cca8ad18b503c7998e5d8c562549beaa13fbc5e27b3e3436a9ee58a98ed037f03780fdbcc5facf770219c82440240b5008b9dc13b51f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8beb7a5649a12df8a69ccbacfb2ae58b

SHA1
1d32bb080643c4ad444edec14db8a1a5cfcd3730

SHA256
585e1d6a13230621c99046799053db18179df8c9c423f5d6bc0b52f3122c40ac

SHA512
f2081c7280b40c52dc9671b11ca287a882b9cf79f31ab5b2971c0ebed1f41eef20acc9bdc614ec778788f69cd4f993d7cba5cb4901f6af20afad96c76b7b0afe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\af26031d-7a58-40b7-9d65-85bff79a226e.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
108KB

MD5
39a9e3091dcde72f36f2f3b6e6315948

SHA1
9ea65e854cde449fb944c26f930f5244e60b3ce9

SHA256
e07d8dea5c1f81a2e0964531111777e1d0c7cdf97d007f98926c61bc849ef24a

SHA512
908c1d035c43b4be8f1e733da0dfb648b4c6db1082ca69793b3cdbff253586d57221bfa86d7357791f32bada6e79327ecd21381078b238b5a97b1fada21ba618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
3137ace6ec98365b1c6c50d4a5524710

SHA1
5539cfa4468c1c7283f88ec89e54ab82c97952ce

SHA256
ca0e0e30ff9ec41e7f3786bee9df6e0d063b8e1e512ba9fbad73455376fd762c

SHA512
ee7712becfa5cb902d9308f3dfc1943b4e3d2cd80104ebf1cfe56c7e369c5c48fab1eda89bacf6aa52f304d956afa36c5edded910537c8a234f3ed2caefa5b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
dd5caac14f0404f7bd046b1453d71eb0

SHA1
551136cf45d13e7753eab88cbcb6ceed4f842109

SHA256
b6565f78c061ea14218b3a25db82fa9f4a7a02020c4bf1bb0cef59da24795b0e

SHA512
80a1f64cfec570580bc253f46a5afbf9acd52c4988e69d6b641e6b967fa3a9b5d42623ff76caa2ad58f7d87a4e63b43be71c6764348f115e0c278190088cc5de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
dadc4bd2abd47afd5564299e070760a5

SHA1
60274ca04775c7b92d16290db967bc72d478a790

SHA256
82bd4e44bb43947eea9a5c4344e1422c3e0de1453b7e14a09c8dd5c0dc476270

SHA512
c2796ff16216d340689019a4e8265d4dace398879c05e53938d2635b6bdc951a9a82a2fb2aacf4520a4131dc4fdb3aea1cdb703fb843bc5a552a6dfd86b4f41b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
4df76b1ac082d815ad47a258cd231781

SHA1
08f5699c0cffeb732914c73c413aae7a5e3e2c1d

SHA256
1d80048fe26a651ba60818cb2541aa20c0f5a483f9273e09a058a1d0a75430ac

SHA512
5bda1ec5a6b32aa3b93290cbf333208be1bda12ee635a583af80399ecba075d29d7c29f4ce09b0da1eb82993a5af7d3683fae19b23586c8d04a3f75cbda4bb4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
d55b4663e1cfb5be9eeaab028f92fdc2

SHA1
3a26178b8d76acc6ff3d55d3fa0786b021d6e7bc

SHA256
b3240e4a879afe6b8db872e36e398060ab21ba5e494477231cb2a23529054245

SHA512
9b48de1a843ab3c58e0279cb5db344b42a77e2cc34acff74119bc2c046b606554676359d02b9c6fece6fafd66b68acdce732b30206ba634d36df91c66f50ebf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
a39260caeea38bae9c73adbdcc52e62e

SHA1
e3c09434bba8e9f11c775f7e837068b3d3fed4cc

SHA256
8bb7b03e6b98fcdc95d464121329586a346bec44c653c92a334be55014670a1b

SHA512
ac232568d9ef40badd22a5b281e38666a2a602535873879d8ea6266c143b6afe55e716b7261a41b94c8430469bcb3a3c289e8219d00a98ba2ec6511637e9edf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index

Filesize
1KB

MD5
2231e672e05655721a07440d06d87c96

SHA1
07be5edd502a99df4c662c890dee3553d9f97a3a

SHA256
72c9c6f9a0d4046fadbbeb8552c902d4f7ccee2bf0b5a83fabfdf05f64c30343

SHA512
8ba2eab9eef63083041c26a19a47d0106e86e93e819e6190382c605176b38df0cfc1cc0072d8ef71f92868576880a51f7df885de56274ca29f3370cfa3e9b7a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index

Filesize
2KB

MD5
2c5cd13c6a094989a4e99a8ff61bec73

SHA1
5a2666a7249e6de27033702b4edf6c0c37c30605

SHA256
c61e24f80c6eee1e1424c177fa8241540c004efe04fc8bf6d6458ef993851f09

SHA512
1dab477b93e2130f6ca9a0db74e6e47c7e89b181bfb939557b1f54324c0eeec1957109acb324a9d890ff34f8df4e99e742f46ae3067e29ae5b5aec6650a87483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index~RFe58b0fc.TMP

Filesize
1KB

MD5
937694077adb63637a8a3c1171e63992

SHA1
094ccc4b20991452176021ae829c32387066f170

SHA256
b69a12bce3933796932915f90990dcb004a1b17d7159455195ecd43d18379ee4

SHA512
1ab9a860b545f29b1fe1a4100b087787d729b5322a100bde4b5d2075837ea2dbb7741408f34da7d2919b7589e9eaf8aa2c906d8b87c31f1e4256f365a8f8fcff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c4b0b60c-a39b-49fd-bb22-9f6720f0e475\index-dir\the-real-index

Filesize
96B

MD5
ef8c92f0a4f6ce8ea874babbb303725f

SHA1
c9aad02c58c4f3fe99b5b0a2d4bf67483805350b

SHA256
4732ba705dd09273a72dcb5563017591442d1de29723e387aedc9b9f981bd2db

SHA512
c5db78423a1fa42cfde7b55de8b608ec93537c45ff64d3de5d1a7e972801e3d1390cf1c78fc51413779008d68a9703dd7206e6c4d09713fe47ca2225c138ce25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c4b0b60c-a39b-49fd-bb22-9f6720f0e475\index-dir\the-real-index

Filesize
96B

MD5
a312d509fab3254ddb1c781c62eb6e71

SHA1
5f0d93ccfac2acc8f4ecf5ab449f421390e4482b

SHA256
152af8861292f50a8db8f25b93c1d964237e930134257740d6b1c6c0d03b4658

SHA512
54be049744a8bf7f5a10d2bc4482422799b5cbad1416516f25ad0152ae72e2f924d9ef2497c88de2f2d6daadb1bf038fd8a96963bf7f1ce021974ad4d0668a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
94b23ab447ee1242d0b62b8d32698327

SHA1
a3da85a32240de9079ba4ca95cbe3cd2dee55ae7

SHA256
13959b83ea39726075783fbeab0d16da6df18b258adbc8a7b220ef5d90d09280

SHA512
774aa5a5901dbd87c57116d8ee809357bb65992c2a07f085d87173718e6ed445866791b51ca748d2386ecd6d1a6d696107d70fd1d56fc5ae91a7d020c1a5d489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
614f3f45ecfe609a2e9c62bf6d60a607

SHA1
ddc1239cd05aa6c4eb03c21c3b66578aa19b9f9e

SHA256
11856edbeaaf90b7bdd0415a1ba8d8123ac58563966ed41bdda89eff36c82db6

SHA512
f080dd5fc0830777372f9ffd61de5d764de19b1509e3b1e7b31c8c3c243d0854b4417642cc7f9972875dc8fbd07c2ad37d43c120728f31a5cc549ea7825a9022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ba4fc4c038a0cc308e83e99e698f4552

SHA1
c17893770796f8539694c58c87085d444b0a476e

SHA256
4083434bab08f03465ff81f767b1a74eb862834c03b6e9f5dc423149a9cd6b7e

SHA512
d2b9e116f41aaa9c697af1513a64ad6fa7ef5384ac05f1b9b111b6233eb5193243d3828bf595daba93cbb1ae141dd683095e47dca7bebe99149bc0fb3179e58b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
679be9ff11fbc257208e2ac948dc079a

SHA1
173115b430802c4c1b286c60675da9569e58897c

SHA256
df5f22213a0ad39c094df4489978274dd038729bdc46de567988c87a8870cc82

SHA512
e7590f154721fd7c8a58d59092cbc94b572d3d480f7719642633989a82d983f39162488dfdc1df0886662f537c913cb8ef3e39ed62bf2f720250ae33251c5eb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bbc9.TMP

Filesize
48B

MD5
21908f4331bb507147e07b9a154137c4

SHA1
e52930ccc4adf40a24600baa66f0a3c1f28c608c

SHA256
9cec59c4a7b07d4e2b26565554cdb72e54abf1b69c6a42865926f6895c04a729

SHA512
52f43ad7ad1a7f1489cb6f4757ea81dd0ce20e797c8f1bfe3ae2bc53ccd19e35f40ca86ee2d9d46746a8be2b69f6855307b1c1d280883cf41d55de4f45d8ebab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
24KB

MD5
423cb26a2de5fc16e55a952d950f3253

SHA1
fc17aaddfbaa4c05d63eba6d544278bb27e045cd

SHA256
8888182ca7777678f7d9fd66ff424a3eda66fc0236f2801a03d106ef60fc9ff2

SHA512
77a1a722d9c544d243ae3c50f3bade163512bc745872f9b3d069c46c6bffe5ff537baaea96bf756db2f73c4c5a199d9874998f652623cb1560701bb7d482d533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
463B

MD5
c50d31aa3280dda9944429a7c595722d

SHA1
586392f2c8642cc6fb0d51b0194c763ba12ed655

SHA256
6d7bf0992657001fe4d81db8eec7348c9a0359a76a4b671707cfc8bb585c7ce7

SHA512
3bde02ce021587c90ff0491f3b47bc23cdfe58148dd445b6c72399e7ff47b18931318635bfb1d1f3e215a5654c03ef8b6a672b15b976ca55fdaab99f605f0fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
892B

MD5
8f630d7a8c080342e8839edf4b76402a

SHA1
9c7658cb05e8831599f363c88914f865b94ce3e4

SHA256
c0677f05d1b0224f9bfd5c17dd5059d4d4e51a220e572bd204ae14059a426ecc

SHA512
b0d702afd5568daeb49931e8d5ed530e7b0b89eabd6e0e59b4a279d456e9d63e709f78cadfa74d1fd1b362fc3c43e21315378c311288f7bd450b30b1f880a950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e2986484-c83f-4368-8c9f-db04e38c7257.tmp

Filesize
23KB

MD5
d5fb733ce21ba8cbeb44acc59f2610fe

SHA1
788a32e2b92f80379b9af1efbc10e40df68b28df

SHA256
c4de52be81ec131ff43aef3f8de2e12cad125000c60d877eeab4d6de51db6e10

SHA512
e1d0dc768501c1cfff2abeb4752d6a70f75f9826f0531e2a5c5065f6af8b9c208e7edfdd3c7aa440ca4ca61f42d79d7839d84bae59c8c0f3205f59373bd99f0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
13ea5f91c5c60ef1b7c5ef42015ea996

SHA1
fb98af3357af668f1bcac37eddafa115efac9a0c

SHA256
650d1866fdf682a55364f07e964a83464bbf63242aab7a0938b9aae591cbf24b

SHA512
43d0dcb2e4f688ccb11a0ab336eda262f38cada21822a42d565f2162dbd52d71241664f4fdc49590e860ba52ff10056c89cb6056a4c4635cf1d37247eb055215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
541b55f174538fd27626c2efe2796377

SHA1
6f9ee130a6207095ffb4ddbea165589ff48059b5

SHA256
b0ee7974fa438195ed15b7024ab34d4a0c64240946b41bccd528fcfb88ceb285

SHA512
2e924e5c7ddb288c95e7317aee0b9a9d69b82649fa77ce16feb1b1b05dfc57585adda024ed22f1ebb2cba37c297bd9fa32002144bb363c8b0c576576597992e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
47KB

MD5
47f29596aa9763b9ab51c9fe6bb02b37

SHA1
be43128651b2054c4d488624fb7e8aad56e63b88

SHA256
e6998ff7b4c6eaab176e256549b5be080ad11425f74f0e4ca7ed8d8ea8e6fbd8

SHA512
5b6e94d03dab8c5001bc210466a348b3c5e2b72f32ce791e260453d96a52b543e54652b148f2d98be0c89faba14524da48ce70f9ff28d2d3acf886169a97e71c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
7266d2794b920aa15294fd25599f4224

SHA1
43e441879962192e8b2b8d0e3ca28129ad4d3c23

SHA256
2ff68d9393d45d7d391e0f02dbb7f3848b72f71f7626a4f27184976b92cef0d5

SHA512
b48f93a095a3e8059fc2c39cc81c8aab5243556a3ef406091a1c59005bed96d514f2bdb520682b6d0fdfd6339220500e524522d651b1be54e6270bebdeccad5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
5527a8b3d1f6ae40905bef943a366d1e

SHA1
fcee054720a654d55080c9bd2aaa06b92b658479

SHA256
219a3a0d89639bde861e2562ddb8b7fa670d22ab980e9b7969e1efdca9357710

SHA512
eb9289f06e3f91008dd01132fa8d4f43877ea5c4c385843eb88fc7c74cf080b26b49014eb171088935d4cfe1dbc6f5ad766e9d18a21ce5d7a5f74d34c229988a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
afe2ba018e66f1f1c1ab06bdb3d59136

SHA1
690e333a6247a826d9ba1e9d97187b0f11804dc5

SHA256
37c2946c47787887886482549876e9f0a7a2131eaf402be4c0761ef4c53f7bd8

SHA512
728d5fc270d39127daa6a8133963e98790ec9580fa37dff769e9f4e3ffe728aed805a6c65efd817b3a350d6cb800abddb15e306f2c31d18e1a16c7cbaabd3586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDE6A7.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hn3jvlej.s41.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
18KB

MD5
50e7b8cc485633d4d5c5419e7eadd615

SHA1
adeea6bb496cb01b33779c6e7bcca86b182a8c74

SHA256
84963d46db31132a5b3a4568f02f90b865c5b905b4fc2a6d7031f2b29590df27

SHA512
84c8fb97a8a1b188025f4f861b296dede97c52f329a47f8f36773b3f5ea8c42f17070eb814f0984f86fcd67a2d0dcd126989a18464cfa87fb3448aa01029542d

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf.tmp2576

Filesize
304B

MD5
c0cd6fec5b5bc4e54b2435e4434f89a8

SHA1
30995caf90b62fd64d7eed4652f61fc8481f6267

SHA256
7ec5ecdbbb8d7b121016fd8f3293c006c44af96ead437c7820be8753e7253a90

SHA512
e6e86ed90cfc0e1ac12590d47f7e5060092ea7f02ea219fdfd80530296bf32454f4bd54b0b8f37b041f84b1239444987d9314fe7c5865b6893497cdad7559d3b

Download Submit
memory/1772-478-0x000002A9FEB10000-0x000002A9FEC12000-memory.dmp

Filesize
1.0MB

Download
memory/1772-477-0x000002A9FD350000-0x000002A9FD360000-memory.dmp

Filesize
64KB

Download
memory/1772-467-0x000002A9FE610000-0x000002A9FE632000-memory.dmp

Filesize
136KB

Download
memory/1772-479-0x000002A9FE600000-0x000002A9FE60A000-memory.dmp

Filesize
40KB

Download
memory/1772-466-0x000002A9FE670000-0x000002A9FE6FA000-memory.dmp

Filesize
552KB

Download
memory/2576-2748-0x00007FF6459E0000-0x00007FF645AD8000-memory.dmp

Filesize
992KB

Download
memory/2576-2752-0x00000183C05A0000-0x00000183C1650000-memory.dmp

Filesize
16.7MB

Download
memory/2576-2751-0x00007FFA876B0000-0x00007FFA877BE000-memory.dmp

Filesize
1.1MB

Download
memory/2576-2749-0x00007FFA9E310000-0x00007FFA9E344000-memory.dmp

Filesize
208KB

Download
memory/2576-2750-0x00007FFA88620000-0x00007FFA888D6000-memory.dmp

Filesize
2.7MB

Download
memory/2888-457-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4300-2676-0x00007FFA68C50000-0x00007FFA68C60000-memory.dmp

Filesize
64KB

Download
memory/4300-1916-0x00007FFA68C50000-0x00007FFA68C60000-memory.dmp

Filesize
64KB

Download
memory/4300-2678-0x00007FFA68C50000-0x00007FFA68C60000-memory.dmp

Filesize
64KB

Download
memory/4300-2677-0x00007FFA68C50000-0x00007FFA68C60000-memory.dmp

Filesize
64KB

Download
memory/4300-1922-0x00007FFA66430000-0x00007FFA66440000-memory.dmp

Filesize
64KB

Download
memory/4300-1913-0x00007FFA68C50000-0x00007FFA68C60000-memory.dmp

Filesize
64KB

Download
memory/4300-1914-0x00007FFA68C50000-0x00007FFA68C60000-memory.dmp

Filesize
64KB

Download
memory/4300-1912-0x00007FFA68C50000-0x00007FFA68C60000-memory.dmp

Filesize
64KB

Download
memory/4300-2679-0x00007FFA68C50000-0x00007FFA68C60000-memory.dmp

Filesize
64KB

Download
memory/4300-1919-0x00007FFA66430000-0x00007FFA66440000-memory.dmp

Filesize
64KB

Download
memory/4300-1915-0x00007FFA68C50000-0x00007FFA68C60000-memory.dmp

Filesize
64KB

Download
memory/5240-266-0x00007FFAA7380000-0x00007FFAA7381000-memory.dmp

Filesize
4KB

Download
memory/5240-265-0x00007FFAA6FB0000-0x00007FFAA6FB1000-memory.dmp

Filesize
4KB

Download
memory/5352-499-0x00007FF6459E0000-0x00007FF645AD8000-memory.dmp

Filesize
992KB

Download
memory/5352-500-0x00007FFA87B60000-0x00007FFA87B94000-memory.dmp

Filesize
208KB

Download
memory/5352-502-0x00007FFA86420000-0x00007FFA874D0000-memory.dmp

Filesize
16.7MB

Download
memory/5352-501-0x00007FFA878A0000-0x00007FFA87B56000-memory.dmp

Filesize
2.7MB

Download
memory/6140-398-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/6140-368-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/6140-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/6140-1375-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/6700-2802-0x000002ABC43E0000-0x000002ABC43E1000-memory.dmp

Filesize
4KB

Download
memory/6700-2804-0x000002ABC43E0000-0x000002ABC43E1000-memory.dmp

Filesize
4KB

Download
memory/6700-2803-0x000002ABC43E0000-0x000002ABC43E1000-memory.dmp

Filesize
4KB

Download
memory/6700-2814-0x000002ABC43E0000-0x000002ABC43E1000-memory.dmp

Filesize
4KB

Download
memory/6700-2813-0x000002ABC43E0000-0x000002ABC43E1000-memory.dmp

Filesize
4KB

Download
memory/6700-2812-0x000002ABC43E0000-0x000002ABC43E1000-memory.dmp

Filesize
4KB

Download
memory/6700-2811-0x000002ABC43E0000-0x000002ABC43E1000-memory.dmp

Filesize
4KB

Download
memory/6700-2810-0x000002ABC43E0000-0x000002ABC43E1000-memory.dmp

Filesize
4KB

Download
memory/6700-2809-0x000002ABC43E0000-0x000002ABC43E1000-memory.dmp

Filesize
4KB

Download
memory/6700-2808-0x000002ABC43E0000-0x000002ABC43E1000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads