mafiaware666 | 5727c532a044cf9fc05d38e0f1f3762b56aa2cc99ed24ad2656245af813f8779

Resubmissions

08/04/2025, 14:01

250408-rb2vcsvpt510

08/04/2025, 09:09

250408-k4fn9ssnv710

08/04/2025, 09:04

250408-k1xhlssnt910

Analysis

max time kernel
407s
max time network
409s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
Size 12.3MB
Sample250408-rb2vcsvpt5
SHA256 8cdd2fe5990836816361ce46cce780a56b70456ae2b4c6595fcb6cc2601c754a
MD5 114edffe6d90393ac464866ddf138f90
SHA1 97ebbf910fd31a626126311453f8ee87171eb92d
SHA512 1197d4e60bfc67d2b2cb13b424394bb8e6d5086514fc9c8965171a5b544b714405dd861bac058cac9c532e6d18b23344c41111dbb9db353a822910cfb40b155c
SSDEEP 6144:l+ECg0N85ETLskwa29UjofIZcVoQ+YnwRuM0IpGktXgXlF:l3ChN85GjRWUjofGciswRuM0IkF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mafiaware666 bootkit discovery persistence ransomware

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/436-1-0x0000000000390000-0x0000000000FE0000-memory.dmp	family_mafiaware666

MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666
Mafiaware666 family
mafiaware666
Renames multiple (108) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3218366390-1258052702-4267193707-1000\desktop.ini	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	SystemSettingsAdminFlows.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	vds.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\system32\diskmgmt.msc	mmc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\wallpaper.bmp"	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\PBR\setupact.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\CBS\CbsPersist_20250408140216.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\MainQueueOnline1.que	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\BCDCopy	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Timestamp.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\ReAgent\ReAgent.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\ReAgent	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\Contents1.dir	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\diagerr.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\unattend.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\setupact.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Timestamp.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.offline.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\Contents1.dir	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setupinfo	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_3326.tmp	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\ReAgent\ReAgent.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\PushButtonReset.etl	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\CBS\CBS.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\DISM\dism.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\DISM	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setup.exe	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.dev.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\cbs_unattend.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\Contents0.dir	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setup.etl	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\setupinfo	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\_s_346F.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_346F.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\ResetSession.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\CBS\CBS.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\diagwrn.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\WinRE	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy.LOG	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\cbs.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\DDACLSys.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\_s_35A9.tmp	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\SessionID.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\setuperr.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.dev.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\CBS	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\Contents0.dir	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\SessionID.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.setup.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\ResetSession.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\WinRE\bootstat.dat	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR	SystemSettingsAdminFlows.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	SystemSettingsAdminFlows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\nls\language	SystemSettingsAdminFlows.exe

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\AttributesTableCache = a2a0d0ebe5b9334487c068b6b72699c70000000000000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004b43892b2c526d360000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800004b43892b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809004b43892b000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004b43892b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004b43892b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vds.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vds.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133885945982616238"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "129"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 1e00718000000000000000000000e1a40ed25739d211a40b0c50205241530000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "3"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\1 = 1e00718000000000000000000000ea2b8ab9427d58458bd1832f41bac6fd0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "3"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3816	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
1144	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeBackupPrivilege	5604	vssvc.exe
Token: SeRestorePrivilege	5604	vssvc.exe
Token: SeAuditPrivilege	5604	vssvc.exe
Token: SeBackupPrivilege	5204	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	5204	SystemSettingsAdminFlows.exe
Token: SeSystemEnvironmentPrivilege	5204	SystemSettingsAdminFlows.exe
Token: SeBackupPrivilege	5204	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	5204	SystemSettingsAdminFlows.exe
Token: SeBackupPrivilege	5304	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	5304	SystemSettingsAdminFlows.exe
Token: SeSystemEnvironmentPrivilege	5304	SystemSettingsAdminFlows.exe
Token: SeBackupPrivilege	5304	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	5304	SystemSettingsAdminFlows.exe
Token: SeBackupPrivilege	5204	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	5204	SystemSettingsAdminFlows.exe
Token: SeSecurityPrivilege	5204	SystemSettingsAdminFlows.exe
Token: SeTakeOwnershipPrivilege	5204	SystemSettingsAdminFlows.exe
Token: SeShutdownPrivilege	460	control.exe
Token: SeCreatePagefilePrivilege	460	control.exe
Token: SeShutdownPrivilege	3816	explorer.exe
Token: SeCreatePagefilePrivilege	3816	explorer.exe
Token: SeShutdownPrivilege	3816	explorer.exe
Token: SeCreatePagefilePrivilege	3816	explorer.exe
Token: SeShutdownPrivilege	3816	explorer.exe
Token: SeCreatePagefilePrivilege	3816	explorer.exe
Token: 33	5000	mmc.exe
Token: SeIncBasePriorityPrivilege	5000	mmc.exe
Token: 33	5000	mmc.exe
Token: SeIncBasePriorityPrivilege	5000	mmc.exe
Token: SeBackupPrivilege	4160	vssvc.exe
Token: SeRestorePrivilege	4160	vssvc.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
436	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
436	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
5204	SystemSettingsAdminFlows.exe
5204	SystemSettingsAdminFlows.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
436	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
436	8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4388	OpenWith.exe
5204	SystemSettingsAdminFlows.exe
5304	SystemSettingsAdminFlows.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
5000	mmc.exe
5000	mmc.exe
5000	mmc.exe
5000	mmc.exe
5240	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1964	4924	chrome.exe	114
PID 4924 wrote to memory of 1964	4924	chrome.exe	114
PID 4924 wrote to memory of 320	4924	chrome.exe	115
PID 4924 wrote to memory of 320	4924	chrome.exe	115
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 2888	4924	chrome.exe	116
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 3140	4924	chrome.exe	119
PID 4924 wrote to memory of 3140	4924	chrome.exe	119
PID 4924 wrote to memory of 4500	4924	chrome.exe	120
PID 4924 wrote to memory of 4500	4924	chrome.exe	120
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117
PID 4924 wrote to memory of 788	4924	chrome.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
"C:\Users\Admin\AppData\Local\Temp\8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaafecdcf8,0x7ffaafecdd04,0x7ffaafecdd10
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2108,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  PID:320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2088,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2348,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2316 /prefetch:8
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2936,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4728,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5220,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5516,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4640,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5580,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5276,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5908,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5808,i,17030609488784671740,9727474638768256549,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1088

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault227ac3a1he663h44c2h85b7h14fbc9e4078f
1⤵
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault227ac3a1he663h44c2h85b7h14fbc9e4078f --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffaaf76f208,0x7ffaaf76f214,0x7ffaaf76f220
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2176,i,11960145141697889041,6804477654300828390,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1908,i,11960145141697889041,6804477654300828390,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2460,i,11960145141697889041,6804477654300828390,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3376,i,11960145141697889041,6804477654300828390,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
    3⤵
    PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:5432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulta77ca390hb64bh4b36hac78hb0a1ae8593e9
1⤵
- Enumerates system info in registry
PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x258,0x25c,0x260,0x254,0x298,0x7ffaaf76f208,0x7ffaaf76f214,0x7ffaaf76f220
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2236,i,17492541676282263426,15271382551828210891,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1932,i,17492541676282263426,15271382551828210891,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2584,i,17492541676282263426,15271382551828210891,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault3707bc8fhed04h4b9dhbdfch60a4bc72c2be
1⤵
- Enumerates system info in registry
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x258,0x25c,0x260,0x254,0x300,0x7ffaaf76f208,0x7ffaaf76f214,0x7ffaaf76f220
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2036,i,12774485739994969968,11090734633860404723,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2252,i,12774485739994969968,11090734633860404723,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2312,i,12774485739994969968,11090734633860404723,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5192

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
1⤵
- System Location Discovery: System Language Discovery
PID:4820

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:556

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
PID:5624

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5204

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5304

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2548

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2944

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3816
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" C:\Windows\system32\diskmgmt.msc
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5000

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:5564

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4020

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5328

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38d3855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

Timestamp.xml

Path C:\$SysReset\Logs\Timestamp.xml
Size 41B
SHA256 984fdc72e8e3934de4fbb34016395668d547692be92ee1a64bda40cc21aaf010
MD5 f193d0d8adbdbd2acc7a740f393c8253
SHA1 c6f40cbdbfcfc3c188898fc0af65263fa59737cc
SHA512 8e22415c456bfac56c557eb2376fa93452c1fcd15fe75ded13d3316926219ac62e23f8b7a18cf6af2331ebe6df84d184e04dc4a1455294c010a68cf843e76eab
MD5 SHA1 SHA512

Submit Download

537091fb-0201-4b5e-9b0e-5282e0b48d83.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\537091fb-0201-4b5e-9b0e-5282e0b48d83.tmp
Size 80KB
SHA256 8b452c3f16d51995439b9994e00b1267dd0d75567ee5b925edd90cb1ee704ec7
MD5 42be0bd157ef462f620000139ef57209
SHA1 8c277602a35fdd0f20718cece683345286b44cc8
SHA512 98497c30deb99a8045f1893f34dfbf6810da69340f0ddd2b30feb524e31564a24f65e3a0360b154265aadae0afa1b27a6a337f8eaddfe63e6f81110a0ab6eae9
SSDEEP 1536:gvsNjdpr3nOOJZd5d3Apv/x49GeaJTNnoV7SadJAfAkP3/2HNHGUrq+h:5FD3laXx49GdfoV7S6JAYkP/s8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d9d7b29bc92af4d160554a5f4bea9a5ac3efc0b53967a449da6b4e9712df7508
MD5 d3fa41d8801b1dc62c484434ffb0749a
SHA1 6e61b7b414237725d1d0be8f04832333b14070f2
SHA512 d477fe4e33d76c59c5f77d40b020d0dda117ee3ce7b1971f96726104539b24da9dcd8189118c77c5048a60bb3166cf48107294fcd935d894570b43eec0d30008
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 dea8d4bab08cdff8e7d4c62ba82e563b6bc49acae0946c0b044e039887a5df71
MD5 096f9a4ba07f6294e9d9d7e07d332f42
SHA1 ec40cccd35869262c3f18c38d73b879e1a225f2d
SHA512 8a3d839742ca8e53d1d7204200c364df23bc864e9bd95a76750d2adc380ad8294797c6fe3384e563e7a5b59650faef615d7b9fe8f3f12b1a3c7abef190890b2a
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4a627a4d579fe5bb2c54fddadd17ea64cf027d3986df0bb93e2aaaddb0fbc3cd
MD5 e793709edc741afea67da80d0360dbdc
SHA1 6f2311db4a3d16f544a775a63912dc671b14db9c
SHA512 3ca5bf86e747f4b513e34e0d26ac385679dc0e48ac1b51bec259e7ce2cdec90e2707110f55fa2f8f04a2c6edc52b265ace602e963fa60858cd9843b6610eaa01
SSDEEP 48:YXsXzLsr/H6zsTgCzsuZhsuFlzsurIsu9bsw/HGs1u+HTsifuHdiKsm/HFsuT+HI:PGPj55TmRPbu4vQdrP74s4CBPdC4KPMp
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 8a656844798ae2eb758ab1279e214fe15db31d18f92009d3a6933bcdd3a8b356
MD5 5eff62122f784b8f2a73245879e8630f
SHA1 f73d4d8eec097e8ef05180893f0c6319b621411e
SHA512 f319c1e091ee9a6d7f68d821e0b218f94982d44716a70b86ef967db62ad458ea9bbf27c45eef1b302f6845fd06b2781e6edc7b7c684463b4f8b91a6ded834a4c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1b7c499c1e2b6f0da2c31d575c68173d2d893138a31aef8e7e0e7a441ee85ff3
MD5 a6e5794467f16cbbba3d75178efd9e77
SHA1 b348304172a2911f0ea5cf743d9aeeb085b30b04
SHA512 163ef85e348f5f2b3c67f558444c497a014b0d97b2920f568de45dc3097415f5dbfe3ca795536c1c9741e66545885d40eba39eca65da2da0eafa52a808cf6224
SSDEEP 192:ZY5ycBzhZkeEFrHquOv5eZ8PRpv2GKHS+WNsB9s+E8hCe+2atQu27zpQyIsnA/g4:ZY4mzhB/Xzec6u+Xg2UqlZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8adc766dbd979de90bf2a60bc4a73e82a3591c0870fb47a30d649c4d75b14275
MD5 cf5cb3f683cfb482258bbcab3c727bbe
SHA1 06682381a3ef31cf63f9c5c1cc861f1714196d74
SHA512 a58b5f5a657c2c8b897342e54829e377ffd3f82f271dd81a4ffe33dbda2cdbd363700f16ecdd3c9235b64267eef7bf2c35fbd57d1a634cb0faf5679b6e305b5e
SSDEEP 192:ZY5ycBzhZkeEFrHquOvPZ8PRpv2GKHS+WNfB9s+EVhCe+2atQu27jGTQyIsnA/g4:ZY4mzhsXzecZu+Ug2Uq+Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 18KB
SHA256 bb4ec10c974a28993837c326f72821672131ea687d25305f4a20a267fb9eb63b
MD5 57208fdfeb622051a6baec1ac8a5787a
SHA1 08fbb369502568ec85801f0bea689beb3245331f
SHA512 faf4be78c1b00455362241cd9ca3adb00fe391d8eb99876c78ac872c72b63680db185c5eed2e30655979205fe771ff33bc170477df4404a5c1fc7f0548febffb
SSDEEP 384:auYX7pLuLcJN7pLuLcwVinXIhPkXqKf/pUZNCgVLH2Hf12vrUf2HGoFg3lMj:aPX7pLuLKN7pLuLtQXIhPkXqKf/pUZNT
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4521cc0dd1cfdf52ac04266578c2af95035f0daa06c8c6a77fd57060ee0ca4dd
MD5 6e25978c9bdeadaa1e0b15bd6775406a
SHA1 666219113ddbe13b92cddcae5e6a508ac110c595
SHA512 753acefb8b0fd727868aa5868e24eb07eb775ea79dcee12e0b85c821677e6caff4b234c99614a50e0cc868903458c4a0e0f66dc422fdca7668812cc2db07a7b9
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58c29f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c29f.TMP
Size 48B
SHA256 79f6ca29380793f4658caa4396c954953ba19de8db1f89444722e4083b14531f
MD5 e678a50a6fd4a323c7005342e8dfa29c
SHA1 9ea73c4a2819e84820a8a39a9e400bd29026cd17
SHA512 fd0bc42e24dc14ce86326e7e217dcd14f86ee5f6d57aa4d083e43de12006f2027a9dc970596b45b6949c325a33ee4b5e378576a376c3c161a80d4795e0e1b5cc
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 153KB
SHA256 f39287b94db9ed3b8b1241e47592d05f251d7bde9677f1c02de192f38e4a901a
MD5 a5f7309e8296cd8aa1e773dff1615aae
SHA1 4ec1c24d5a7517146b32c8f6a5ae6e3a31dbb7a4
SHA512 627ab4abbc206a7b7eae09a367c06e76a372cc260daef5f673c181a6d0410e168dde53a1e6dc74a4fae4a4e8dea1317d46b02771477db719d3230f03fbcaa815
SSDEEP 3072:fZxKAtFCJAXdCQS5TWeRG7AJJmfWFD3laXx49GdfoV7S6JAYkP/s84:fZx9741QS5TXdJJ6eMi9Gdfm7S6S73b4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 153KB
SHA256 9c096eae1bcfd9fdefb317e5eca855c704367e914a3013b8c0e8d491c4e7677c
MD5 a990b735cf84054bba1a08de579734a8
SHA1 f9c6bb193c0f9af820ea22ae6006ce0ae22b3a4b
SHA512 ca74eb106b16d0af98dcbf2deccf8a31bf053829ba558dcccab15cad9379ec863e0abe33f61b370edae84fadc85c949d2f45a85fcbea9af8b73ded9a14b99469
SSDEEP 3072:0ZxKAtFCJAXdCQS5TWeRG7AJJmfWFD3laXx49GdfoV7S6JAYkP/s84:0Zx9741QS5TXdJJ6eMi9Gdfm7S6S73b4
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c41acdf5d0a01d5e9720ef9f6d503099950791b6f975ba698ccd013c4defa8c4
MD5 fed4ab68611c6ce720965bcb5dfbf546
SHA1 af33fc71721625645993be6fcba5c5852e210864
SHA512 f9ab23b3b4052f7fda6c9a3e8cd68056f21da5d0fcf28061331900cac6f31ef081705804d9a9d4103ee7d9c9bdb6aa4237987b7e821d2d96cd52da24219e55ee
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb1a67bdc2761f1f9e72bbc41b6fc0bf89c068205ffd0689e4f7e2c34264b22a
MD5 4013ebc7b496bf70ecf9f6824832d4ae
SHA1 cfdcdac5d8c939976c11525cf5e79c6a491c272a
SHA512 96822252f121fb358aa43d490bb5f5ce3a81c65c8de773c170f1d0e91da1e6beb83cb1fb9d4d656230344cd31c3dca51a6c421fda8e55598c364092232e0ad22
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1936727489422a72a0289e0d87881aa1b009b80448cc1c512160140362890c59
MD5 6fb57b837f9effd7e84dd74ee7b2e47c
SHA1 c18503c850c888f2ddb1ea24ac6ef72f63ee32ff
SHA512 5f61e7c29613cb37f2d76c8b7af8c60ac5a164b26c746496f98c827a04443ee8b03cb5d239508df1baa31c799454e1189b17630cd766fffb4c45f36e1f170dc3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a80530e89e3273ef66331c91ae45a46432d998b0312a0524d04bbe0f85bf8853
MD5 8ff4ab056ecab6dc17359c6bf980f8d3
SHA1 50244978940822d32af521e6219c54994296f375
SHA512 01e19c17e1fe89315597889450c004132fce3c16820dad64ce72ce9ef795d09686130b8bc4f8a3b0176d94d95cd21173bce779d0f1555ac6a1634e35a7609fd5
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 b5ddf51dd29abf93c17903c3bb70a4e209823f5b9b0b090989684090ae1f1e62
MD5 7317c708aaac5fe609b9a7293e7e7280
SHA1 fd7804eb2fab252dac4e485513f2cefa31904b0d
SHA512 1dea43da3771f3a82c39604ed856945ea741ce26debb80ce6ff718fecd805fe0915e87145dbba2712beeb9e5370d062204375e225b7108dd4c42a88a2fdbbbd6
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 54657b89d90f1918ea9994170f2b86732d46c24586019e28c06b328a20c47268
MD5 7c3a49d2a5b3f7c3073d2096844a79d6
SHA1 3c30e12dfac8ad71ac6e9e1914689619380a1c98
SHA512 5112a1584562b0ffda90b688c22a9074620480ad6d48c59f5ee28071522af6c06a63439a8689a4759b30a692d6067514b740244eb02dfc1e8e24423348577461
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 afdfd7c984fe869f3fb48a80523a14432bc228f885af323c10de10a506e90920
MD5 4f53d87a0560001a2843f231a36fdd39
SHA1 e4ad4d86008d517bf980c2238cfa72f60c012e57
SHA512 44d360218c584e3b36c120813af4287893554ea419524c2ebe4ec3876c64cc1e703f725bc1f88db6b38b4d5aca173981f01733cac56a8979638116f3742d7c86
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 30b501a8d462dae18b811228ec20e60f391e0b0ca10abdf0d81144609f7f91ff
MD5 e20b333824a1be61ce493ad7d2160a84
SHA1 40307b51f71bcd314628fe98d313d2f412799715
SHA512 53052fdc329ea00c032c10bf70381ec1702b99b68deec07a6ef991470064738ed249a5ec689a515339ad7f5101d99d3693ad77aefcf89da4ffe0a3a9c4c10472
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 8d3f1224ec953ce811d26e9504fb590d43096d09ba91f2edcbe1eae36f8e5f60
MD5 9714c294be9f3c0bc73e241d58d2fa6c
SHA1 949d55324cd273e1cb91ed99e316adcf1991c5a1
SHA512 19757ce1cb653532362cc8db095a27b29f5968325755677b3bfba361f58406c1fb26853cbcc1ddbba2cc8e3a1e1292dd854963abb91c53ab298b2837b3d4f67d
MD5 SHA1 SHA512

Submit Download

10d876f9-1636-4adc-a59c-8422da1d525e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\10d876f9-1636-4adc-a59c-8422da1d525e.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0f689676cc262715763a848814fdb38c87f001a94fa76f13b46e8eeb2ddbbe6d
MD5 30c4fe09f5b1ce9369200a5f8ed734ea
SHA1 1542254bdef89a5f035da02a3ee05e5e6c4a0f16
SHA512 052e9fb4afbccb00c3a3096ec946c4d1b0f1602f41aaf3def761a1cf9f147a86d9d5d4fc59e54c4a1e5e4d7de59118ca8d3ed9d6c906fee5246c79d062a9b654
SSDEEP 96:sbiEVW7GUBscab964hA4dW8i046W6ZlmH9qx+WVoMpm+uecaYQjfI+geRnAsd4Uz:sbUTsU4htW8p+HY+WNrY4IGFdphg6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3b16c620e9214c2d0667246cb634dc7bc94a4a8d5c2c73d6a0ca0c2c73c85961
MD5 33a6214c6322a5a6b6fb811b7fd3077d
SHA1 54073b742c22115998619660c94201ed20a16f56
SHA512 5b6d17353fc0fc64917c494518b6a3903939b2cac57c8801a5fc1ed3eb213b757c585ea42581ba68bdcd685919946901b33b0d1a272c8c8b43fe4f808b221c53
SSDEEP 96:sbiEVW7GUBscabD64hA4dW8i046W6ZlmH9qx+WVoMpm+uecaYQjfI+geRnAlCudB:sbUTsC4htW8p+HY+WNrY4IGMdphg6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0212a2bb9426225bfde300e562507d6cd6251020e8a962b686ff29b49d1b082a
MD5 f78992b479ef707d397ba60dfcd0cb96
SHA1 e4362e9bf460cec5fa4819e23742dcbc0e1e474d
SHA512 81803f8fa8e50e8059d61b0c5c9074fcea577ebc327dfe6628004a12aff68b8822aa7c0669bac82ed372a52e1e02b6129249a0a0f68a9e32e1bf78030709a176
SSDEEP 96:sfiEVW7GUBscabD64hA4dW8i046W6ZlmH9qx+WVoMpm+uecaYQjfI+geRnAlCTXQ:sfUTsC4htW8p+HY+WNrY4IGQdphgmJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 1998852f27dfd818d8ea6d54ad5d5ec1ec2446af1fc69db66afad862a6986b30
MD5 1f27961298fd89cd037d9340e521ed2b
SHA1 3a0c4ca8832ab4a49a7d203594e813305f15b04e
SHA512 38684ba2454ed294134eb388843c30a32c8c5549f7e251bda9cd1b354d4a98096b3e8fc55b5841bcf2a4c5ad00007a43daec28510fbbe3c0b1934078ddc23d65
SSDEEP 768:kAa8xHvWFX5ZF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlUq/zzror1Mm:kAa8xHvWFX5ZFu1jaPeLC4zArv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 aed4de8bce0c24983a067236704f9191b6547f331ff7d28ce64e7de9e12b4b1d
MD5 83eef7009178445f6f9a7759deca269c
SHA1 350f019d552645e32ce756fd34f2da0b2b1f8b54
SHA512 98f97c7d18424eafa7b6ae035c5790133797ff90c74ebc9c45c3ca9c23883c0f5121e794ea91fd839d30a2a1eef8842b3045f6f271978fdbf167191db7826fad
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 51f8b81c015d48c86457c03cd68aecf1e4c55571c47d6e7658cbe7b035436ade
MD5 f206a901d457a974eae55ab7c46ba92c
SHA1 660767d66a806af04de4c133f96e1ce20438d07d
SHA512 63f39217c91428ba7cce4b894b035eefbd854733a4d48f470698f6f5d8a79c6ca021e9fb465b6317363f985993b0af28b52b45dc6743e5ebb33bc28172d4cd55
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 7ec675c1b5b25c8434b9919f4d1a39ce5fe32f52464dcb42f8096c5f7cc87653
MD5 ee56f22020c059de749073b0ec7e3ac7
SHA1 6b4818239948c72ad1680befe7ea7bf42e46d873
SHA512 6c763a4f94e183cd79a0e4de6f78dfa95ad7482c71fd464e0007edb184da62f5d8809a1c18a26c1d187c462627f439f0e9ffae2e17bdc7306cd3ace090feff86
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 f46c5a13811f90e7cdacbcc3ebdc3de8d0307d33e64f70d7d8c29ee730bc2b3e
MD5 cb024b141214e8aada2930cd270f7181
SHA1 b6dfa255e59ee9e66ed070b8df51de1e8cf69468
SHA512 1ba55a521f78ada54e1d7e0c2ce1df0f5c80b52a64edc7c347f7342d6c19cc547516bd20f27396f30f19d88ec41ec0cf0a4a17fc3f15ee3d35f8e9ee7a2133cb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 5ecb61bc024d4ec4332ffc7b21df8b4013e4c13fc2c5cc89b2a37c4f92a9a5de
MD5 c356d99b8abaf5f6d20fe805090f7340
SHA1 f36a3cca19d4ce8ed018e74e2e1bce6bf3a745f6
SHA512 9deb93edd8868e1a3e7afbfba265e8fcfb68be8da8c96a766f20f4d6043d79d8aef59b13486ab1c6b6d286c30e38c38b781e20f69c384b2384bc954d23bd30da
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 8c64341e0951126059f5f78e5d5aaa1d3f330c613f1fcd12a7924e4840427f2e
MD5 a987e50f17573e84ddfa51f49c4bcafa
SHA1 4ab33af1a03b98f8b717e58198260e0b0e3726cd
SHA512 7535bdb246157a7b435e7e85972311e0bc17ef6a44a01fb55a38cfa5fcb396d8e1b3cb3daaa66e1fb0bea204fd98e30f4495cf22421ae5a7f86c989496b416ee
MD5 SHA1 SHA512

Submit Download

e0ed4a1d-0548-4e7d-939d-28c6920dffe3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0ed4a1d-0548-4e7d-939d-28c6920dffe3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 5292567c508a97e0a9fbc924b1f48c70b010a5fa1a1888da54bb527d218a09f5
MD5 78fba938378c66711739e2c160bfff9d
SHA1 51039e14fc9ddf0d938a29ec3f980bfa1f0a28e9
SHA512 d2e966542d51bd7f8ff76e135a5ba7f065ff021b48fcffad22365aad0e5340b33a66ca4fbd28dedfc907c319f0efae7aff52fb2f5703bf56eb9c7c17daa5869c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 5b72c1bee89c7b5388dcea96ea5fc3aea988c604d54e940dd1063c9dbdc78e20
MD5 692ba1c71b716b31229b10d8caf9379c
SHA1 ee130f5ebdaf66084c9fb4bb54900d81674502c3
SHA512 ea124642fc488cb9dfc9f843d1a5b9f64bdbee23d57f86b52b1d7ff6623d974510deb662a33406c48e75b57e70c7a41740c4ecc7ec3a01e0228b4aa54aeb3308
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 518B
SHA256 a428f3cd866b9355324232940b039d0fa3f7c93a4ca4c5719f4c75ef9c0ab9a6
MD5 40db289caf10f112447e1d6063bc27c8
SHA1 ea7635e81f10d3bf3d3c1fc522efe9a48ae302de
SHA512 8d4f72be4c806dbe3014af61a78ffa4394baf4f1a7c7d05f1e09a035ada6a648e1f87d1c36921ce2534ad49d8a29827a7c2efda658e5ceef5bcfa77df84e2b54
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 552B
SHA256 5eabe9aa0636b772bb0ea631b41deb114f28678d699a674e1ff733246fc9aab3
MD5 9ccc7785a1e1371f0b48e9b8e603f489
SHA1 38f3365e2044c3339ed7baa3a4f4647e75829917
SHA512 fed700f301fd837e1f120371aa9a315666a855e865451c4adb6f4ad05507c12f0b9c936c96a1d0d95353b9a577a2b7b3d7c29d1f78075ebee243d0b2281e84c5
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 901df899af3dee9b6b752075bf75326bcb6af0077ee2cc763288f1e608c5a601
MD5 2ca27c91e6d35aa7968738f41d4067da
SHA1 4a39dddcbf61f97e08a7d5370fb2cf342f57d9fb
SHA512 ff69fc57af778aec8c98ca4b2166e93beaa68060dd70583c128884fd9ad786c5887548532b9c8f830b637e16a0a780af37efa2ebddd7f3d6e629098cde919384
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 c131ddd2805039caa4c90ace53ab469f594eba283bfacab24a46cb12a18be4a5
MD5 6d1a9f962231c3e04425c14b37a16768
SHA1 839071986bd2f3511628e7e2805cc8fdfd71480e
SHA512 dcc1352d7e8848da49308910e48a3b91b9c2db9ea1ede4d10c548c97c2edb90f07b69057d92ce08f0ce2bb1dff13c76fb54106faf762e52ab2357e89e2a443a6
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2250689e24000c2c9813ec4da959404d5475ad2b388acd3d888f7ed89c4466ad
MD5 af40a9e602bacdd126f06568d9e015c3
SHA1 8cfbeb6323f9640ee3b659c752336535061c4fc1
SHA512 82e84d2417cc6d2a728d3d4a41bf2c347ba906d3d5cf91d7fa51bcd8a89bdb5e17daf640143a236387ac8f85676f9b5d9598709c0485ca1c2ff7c427d26558ca
SSDEEP 192:zQsNBSyRi5WiRUXqxz2uKmePvZZcN3KNn:zQsNBSysB6qxa5VD/n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 240393ba4f306e44cccbdc67744c946a9e40e77616dd529c00ad095e6e5bc250
MD5 50c2ceca70d837dc6ed4ff244c2a940c
SHA1 b9d89c475f7b9521b02b41f72a6eb4f38f22b002
SHA512 a4f46ddb0d43340153679bf384576e4d384db729318ae62248dfc45dc2b4c173b0649126eb80e97856a85cbb83f3f335c949cc89821a44442da9e27a44593083
SSDEEP 96:hqONkCyUfUvqEsK5ih/cIVURLl8RotopeT6AmBWZPivP3z2lMKPlgeP8EwMTZkdo:IONbyRi5WiRUMqcz2uKmePvZkfKNJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eddd33bddba908f4cc9938bd9ee623129d3a5981e39f8085df445f3743be606f
MD5 147670cd3524a0fa1439669361eab4eb
SHA1 ddef6d5b29d30f492b63a7f40ce42badc0ab4255
SHA512 c0f1f3a2fc47238778ba4c4e279d566ba3eebd03bac6aead4543cb97568c6b5457ee916eb7046108190f1a6159fa97640a6c30e57032d38a1d225c015268625d
SSDEEP 96:zuqqsNkGSyUfUvqEsK5ih/cIVURLl8RotopeTdUAnBWZPu+vP3z2lMKPlgeP8EwJ:zQsNBSyRi5WiRUfqxz2uKmePvaqhVmn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ba9ed9ba013d4604284f21219188492e7a1b87bd2f95430976df88bd6a57682d
MD5 10919a247188967553479e4f31565ec1
SHA1 6ac27c8419f2a4f28cf3f7768cfd8c8a4e75fb59
SHA512 80ee613a08f4b2b874e2efc824cdd9a0863db7aef88885a91a4caf9572622f3623179d138d57a59482f709714738b220c5a32befb17fe00f151d3a3a13e801a1
SSDEEP 96:zuqqsNkGSyUfUvqEsK5ih/cIVURLl8RotopeTdbAnBWZPu+vP3z2lMKPlgeP8Ew1:zQsNBSyRi5WiRUKqxz2uKmePvzben5n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c86efab3ec1809ecc4b4c16de11ea745d83bc761799dc01e06d266ac15fe7e78
MD5 0e3ac86d2c501e67c642a0cb7ce0ccbc
SHA1 26b3082e59f407663673c8fc154e66efbcff2096
SHA512 20644cc4f3437f8b7ca9099bdc1646ce4f8419314657a07018a865893918dbc19bacee09b24613c34530f14f8b147ce0a3699c1bdc31b6323653f1643293638a
SSDEEP 96:zuqqsNkGSyUfUvqEsK5ih/cIVURLl8RotopeTdUAnBWZPu+vP3z2lMKPlgeP8Ew9:zQsNBSyRi5WiRUfqxz2uKmePvaqh3Vmn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9900d2d1e59b39c468fef8312d15fc6ef6726666fbc188f09cb2893cf3279b6a
MD5 7471c215420a17594507680b5c5b0e73
SHA1 cc9476931f0df0ec105ca5392c693717b46d8fd5
SHA512 a04c35e8d8b9e7bdb4521a49f3afefa6762a9dc99cb1eda40dd37d76c55c4e2a543c95cc1981f61cce1927113111edbcdddac1747af9c06b3a6c77c711d16981
SSDEEP 96:zulwqsNkGSaUfUvqEsK5ih/cIVURLl8RotopeTdbAnBWZPu+vP3z2lMKPlgeP8Ed:zwsNBSaRi5WiRUKqxz2uKmePvzbnn5n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 6KB
SHA256 23baf4c1de2a310e6138ffac85f6a7e0d717c934fc764d41c43826ff1cb55a2c
MD5 314274f2544c97785509d3e179122bd3
SHA1 58a1168b3e5f51f3de1f03402d6be9cb189c24c8
SHA512 9a7715b215c948a4d2e3b166ad261a960c5c36b79709e74c90861c154e39af3ea4928d42d3b2337c05d08eb2a21ed57401de740235c31280064765ab4c1a4824
SSDEEP 96:hqONkCyUfUvqkK5ih/cIVURLl8RotopeTZAmBhaPivP3z2lMKPlglTjFdqe4mJlm:IONbyRiwWiRUp+cz2uKmtjFflvfGNFJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bd967faf4ae783460276e825810c3498cc25c0c2ae0815332259e17176b3d3b6
MD5 9decedea3ed810a643e22a22993276a8
SHA1 e79f184283c84e908024d4f47c544ee014c2e189
SHA512 3968e68962100579390113e1121674471baa691ae4e81049b950ebe3c1352f4563fbbe5dbc6c25f75a20e24d2974b1a0c653e76feaa723e0257e186aff145622
SSDEEP 192:zQsNBSyRi5WiRUKqxz2uKmePvZZcN3KNn:zQsNBSysBHqxa5VD/n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
MD5 SHA1 SHA512

Submit Download

39406da8-c21a-4e3a-bef4-ddf8413e4ea4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4924_1717116\39406da8-c21a-4e3a-bef4-ddf8413e4ea4.tmp
Size 152KB
SHA256 fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
MD5 dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1 d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA512 65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
SSDEEP 3072:5TTj3gXV7obSP3uAxchhBoi+dmTfabSnVf8nik5jqfGc:5HUtoQuAx2cjsMeGiyjuGc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ResetSession.xml

Path C:\Windows\Logs\PBR\ResetSession.xml
Size 7KB
SHA256 bf10363fedba4dd385d26dc6c7edd5787c897fa7f40605a18ffeb321617cb436
MD5 bfeea1ad22cbebeb0fef1036b8d09a84
SHA1 1614d7ac502ccb33bdeb87634a2c01179727f48f
SHA512 365d8830ebf3e057c3a87e17e4919ba171bccf4d52adb0b64034a5d0a64ed894d32229ccfc611d8ecba4d044ae00fea51fcf802e81c17981c4f04fee54b1b5dd
SSDEEP 96:AySH1qHmavxT7oWN9CFSe3G47nUaMkR/jXAC7V7x79IB8MGRIyy/e/Qbi:iH1SmSR9CFSe3GOnULajwyZNWBrkOEQe
MD5 SHA1 SHA512 SSDEEP

Submit Download

SessionID.xml

Path C:\Windows\Logs\PBR\SessionID.xml
Size 106B
SHA256 8bf3c18158fb29208b4f3ffb93021af3ed76c2e6782908dab8d5a270127a5950
MD5 19b75e9ae45a854b94bd13655832b08b
SHA1 3ead35f8d3553701b2b2e57a4dafb1662123d2ad
SHA512 77f4636cdc39f10e4a4cff96378a6f30588dc6de113c31be634d03516aaba121614c39491306e7c67ba90c916acba03f9f197bf45984fa89797904bf31f38b41
MD5 SHA1 SHA512

Submit Download

Timestamp.xml

Path C:\Windows\Logs\PBR\Timestamp.xml
Size 42B
SHA256 e3bbee1c318cd82b410bee955533dc1b5d91d9dcc54d7f3bca0c5b5b6bffe7a4
MD5 4d2d4b9c965c39b8e4cc9f073c5345c6
SHA1 43ad29e51da8fb341df648be98fab44852da7545
SHA512 4e7af944c6bc3c4fa4e2fe18594e75b9e25aa131c9f624184081d4808d4961420282986369e57697d3feffc53b3f02443a36b35693dbc99ac27510422b791f78
MD5 SHA1 SHA512

Submit Download

bootstat.dat

Path C:\Windows\Logs\PBR\WinRE\bootstat.dat
Size 66KB
SHA256 b7bbc3f2463000f52eadcce2e262512dc79bbbb3355c62c734f18db57e0fba82
MD5 3c08dea20e350ea34f7309e856576428
SHA1 d7a048ccc07b4d16afc4d778d5601a067fb151b9
SHA512 1c1cdd554cbf98dcb7358808cfa2682bd09a596e24a3708ab73e379e5f8ae7dc394b8e88824589327e2f67487ca19dacba9e3288993e2e92463dc32aaef67f9d
SSDEEP 3:dlE/71tCl2:y1tCU
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\Logs\PBR\setupact.log
Size 118KB
SHA256 533fc58f1bd4ab9955c7e65e9d90963bcbf3ad2df8be3a80e2830aa64ab59d1c
MD5 f33518ff4d7cc2983478861aab786538
SHA1 28f924a0c02722a2a756f1f68b2d32cc334ef980
SHA512 0e3413def0dcbc4e953fbdb96723aa667b5b4b2af90e37e595fea857c087d0ea5dc6a1c3c0674d56a1cc456c2db5b651f210539d527e52ab93f2949fbdf349b3
SSDEEP 384:V9BAX1ASz52JXE0sdCwSh0Fea+x1Avms1An1A1RDzGTvkz1tSt/bmdkLHyNIS/K3:45kcCpim25ukp4OG4cTJa0UoKJa0USzg
MD5 SHA1 SHA512 SSDEEP

Submit Download

setuperr.log

Path C:\Windows\Logs\PBR\setuperr.log
Size 5KB
SHA256 dabb7a05e30ef5d7c667cf4bacbc6420a4a87c93e339f64f7f27ca19301349b7
MD5 afee2b02a38302beac8ad13a39ed72b5
SHA1 2dd5b9fa1eeaa69960d03c4800f45283c85a24e2
SHA512 d657aa64fe6e6d7226ef6b84164ef9fd1eadf784ca8334244a641f97d122bf88aa5779782d4a636d9b77562153a8399f645748c4610d1a58f5860d02f834b77e
SSDEEP 96:y1DMx4xlWOZT1DMx4xlN1DMx4xlN1DMx4xlOC1IMi4xlq1MMW4xlq1MMW4xlq1MN:y1MxaWwT1MxaN1MxaN1MxaOCGMiaqSME
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 9KB
SHA256 35d66d80352ea77ddab275e0656bb5870bed7b7d60db2e6dc6d7626f63eceb7d
MD5 4f157b5055b21ae34028756156c332f4
SHA1 d9c1427ea79fcfb6187b32f206ff796c539e6f67
SHA512 5afd347c51f1176b9d2b7e98d2748e14a1c52751c1734e5b2c753a45c9b1e0f032aa0f4277cdb02712e29cf47b4d01a95d3677e854d936391f82ea13c362d71b
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnt:53gbq3gbq3gbY3gbq3gbt
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 13KB
SHA256 d2e5312c62f62035ee2cdb1f9765af5af0963a292d6ab0f182e3798c12cef2cc
MD5 74899c297e4745811fb90a613243d007
SHA1 cc79dfd00548062b7232b9676775217b2126aed2
SHA512 7d99b9869aa54ffbaa7c0340519156b6739552253f68bc3f84249f2f039083fe47113c42fdf4b461274f53a0c6fb7f1a03d9121e28e4e614e6a7abc88abc8864
SSDEEP 192:53gbq3gbE7cEjmX3gbY3gbq3gbEvlwlPlQ1+FFZiQ1lYiy7iQ1oL:53Iq3IScJ3IY3Iq3IASp79gn7WL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 4c9a55fc75bc2056ff74aee773d6cc8e3bb7622aed6f9251b2f3c2094120e5c1
MD5 3c045c0f5e731d7940396e9e4a860adf
SHA1 48a0e9024583356d5e042df5b301f8198aaf57d1
SHA512 5a16e4eb9b6925b1bd31c9d6e6ddc3e2544f7e5383a71fcfee8278c4c747b0672e4ead7312b12a7a6029347384a7b178fbced9a8e5bf2d189e01c1da512c1e81
MD5 SHA1 SHA512

Submit Download

memory/436-2-0x0000000006060000-0x0000000006604000-memory.dmp

Download

memory/436-1-0x0000000000390000-0x0000000000FE0000-memory.dmp

Download

memory/436-3-0x00000000059C0000-0x0000000005A52000-memory.dmp

Download

memory/436-4-0x0000000074E00000-0x00000000755B0000-memory.dmp

Download

memory/436-0-0x0000000074E0E000-0x0000000074E0F000-memory.dmp

Download

memory/436-5-0x0000000005A70000-0x0000000005A7A000-memory.dmp

Download

memory/436-6-0x0000000074E00000-0x00000000755B0000-memory.dmp

Download

memory/436-23-0x0000000074E0E000-0x0000000074E0F000-memory.dmp

Download

memory/436-29-0x0000000074E00000-0x00000000755B0000-memory.dmp

Download

memory/436-32-0x0000000074E00000-0x00000000755B0000-memory.dmp

Download

memory/436-126-0x0000000074E00000-0x00000000755B0000-memory.dmp

Download

memory/3816-1043-0x00000000054A0000-0x000000000588C000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads